Agent for SharePoint Guide › Features to Set Up Following Basic Installation and Configuration of the CA SiteMinder® Agent for SharePoint › Claims Provider › Claims Provider Searches and Results

Claims Provider Searches and Results

The SharePoint claims provider lets you search your CA SiteMinder® directories with the SharePoint people picker.

The following table describes the relationships between the search criteria you enter in the people picker and the search results that appear:

Agent for SharePoint Virtual Attribute Mappings

Virtual attribute mappings create relationships between the attributes from your SiteMinder user directories and the SiteMinder claims provider. These mappings allow SiteMinder to search your user directories for claims, and display the results in the SharePoint people picker.

The following types of claims are supported:

• User claims (one is required)
• Group claims
• Role claims

Note: Configuring this feature requires information from several systems or administrators in your organization. Work with the administrators for your SharePoint environment and with administrators for the user directories in your organization.

Virtual Attribute Mapping Examples for an LDAP Directory

To search the user directory in your CA SiteMinder® environment using the SharePoint people picker, create virtual attribute mappings. The CA SiteMinder® Agent for SharePoint requires at least one attribute mapping for claims that are based on the ID of a user. Create additional mappings to accommodate your needs.

Each additional mapping creates another association between a specific attribute in your user directory and the Agent for SharePoint. The people picker in SharePoint uses these associations to search your user directory using the values you specify. For example, you can create an attribute mapping that lets you search by user name, group name or email address.

The following table identifies the typical LDAP directory attribute mappings and describes how they are used in your CA SiteMinder® and SharePoint environments:

Virtual Attribute Mapping Examples for a Microsoft Active Directory Server

To search the user directory in your CA SiteMinder® environment using the SharePoint people picker, create virtual attribute mappings. The CA SiteMinder® Agent for SharePoint requires at least one attribute mapping for claims that are based on the ID of a user. Create additional mappings to accommodate your needs.

Each additional mapping creates another association between a specific attribute in your user directory and the Agent for SharePoint. The people picker in SharePoint uses these associations to search your user directories using the values you specify. For example, you can create an attribute mapping that lets you search by user name, group name or email address.

The following table identifies the typical Microsoft Active Directory attribute mappings and describes how they are used in your CA SiteMinder® and SharePoint environments:

Virtual Attribute Mappings Using User Claims

Integration with SharePoint requires at least one claim that contains an identifier that uniquely identifies the user. These claims often appear in the people picker as cryptic values, such as the following example:

uid=e123456

Such claims are difficult to associate with the intended user. The CA SiteMinder® Agent for SharePoint uses a special attribute mapping which retrieves the display name of the user. This user name appears next to the related identifier claim in the people picker. After this user mapping is configured, the previous example appears in the people picker like the following one:

uid=e123456 associated_user_name

More information:

Create an Attribute Mapping for User Claims in an LDAP Directory

Create an Attribute Mapping for User Claims in a Microsoft Active Directory Server

Create an Attribute Mapping for User Claims in an LDAP Directory

The CA SiteMinder® Agent for SharePoint requires an attribute mapping based on an attribute with a unique value for each user. Use the Administrative UI to create a pair of attribute mappings that defines how SiteMinder searches for user claims through the SharePoint people picker.

Note: For more information about the relationships between attribute mappings in an LDAP directory and the other components of your environment, see the LDAP examples chart.

Follow these steps:

1. Log on to the SiteMinder Administrative UI.
2. Click Infrastructure, Directory, User Directory, Modify User Directory.

   A list of user directory connections appears.

3. Click the option button for your user directory, and then click Select.

   The Modify User directory page appears.

4. Click Create.

   The create attribute mapping page appears.

5. Verify that the Create a new object of type Attribute Mapping option button is selected, and then click OK.
6. Click the name field, and enter the following name:

   useridentifier
   

7. Verify that the Alias option button is selected, and then click the Definition field.
8. Enter the following definition:

   uid
   

9. Click OK.

   The Modify User directory page appears.

10. To create the second mapping, repeat Steps 4 through 5.
11. Click the name field, and then enter the following name:

    smuserdisplayname
    

12. Verify that the Alias option button is selected, and then click the Definition field.
13. Enter the following definition:

    displayName
    

14. Click OK.

    The Modify User directory page appears.

15. Click Submit.

    The attribute mappings are created.

Create an Attribute Mapping for User Claims in a Microsoft Active Directory Server

The CA SiteMinder® Agent for SharePoint requires an attribute mapping that is based on an attribute with a unique value for each user. Use the Administrative UI to create a pair of attribute mappings that defines how SiteMinder searches for user claims through the SharePoint people picker.

Note: For more information about relationships between attribute mappings in an Active Directory server and other components of your environment, see the Active Directory examples table.

Follow these steps:

1. Log in to the SiteMinder Administrative UI.
2. Click Infrastructure, Directory, User Directory, Modify User Directory.

   A list of user directory connections appears.

3. Click the option button for your user directory, and then click Select.

   The Modify User directory page appears.

4. Click Create.

   The create attribute mapping page appears.

5. Verify that the Create a new object of type Attribute Mapping option button is selected, and then click OK.
6. Click the name field, and enter the following name:

   useridentifier
   

7. Verify that the Alias option button is selected, and then click the Definition field.
8. Enter the following definition:

   sAMAccountName
   

9. Click OK.

   The Modify User directory page appears.

10. To create the second mapping, repeat Steps 4 through 5.
11. Click the name field, and then enter the following name:

    smuserdisplayname
    

12. Verify that the Alias option button is selected, and then click the Definition field.
13. Enter the following definition:

    displayName
    

14. Click OK.

    The Modify User directory page appears.

15. Click Submit.

    The attribute mappings are created.

Virtual Attribute Mappings Using Group Claims

You can also configure a claim that uses the groups to which the user belongs. Group mappings assign SharePoint permissions based on groups of users rather than individuals.

Some user directories define the groups of users by including an attribute in the record that contains the distinguished name (DN) of each group. The DN also appears as a cryptic value such as the following example:

entryDN=cn=grp12345,ou=Groups,dc=example,dc=com 

Such claims are difficult to identify the name of the group associated with the value in the people picker.

The CA SiteMinder® Agent for SharePoint uses two attribute mappings and the groups setting you specify in the SharePoint connection wizard to search for groups by their display name. The CA SiteMinder® Agent for SharePoint retrieves both the display name of the group and DN of the group.

Both the display name and the DN of the group then appear in the people picker, for as shown in the following example:

cn=grp12345,ou=Groups,dc=example,dc=com(Sales Managers).

More information:

Create Attribute Mappings for Group-based Claims in LDAP Directories

Create Attribute Mappings for Group-based Claims in Active Directory

Create Attribute Mappings for Group-based Claims in LDAP Directories

You can also create attribute mappings based on a group of users. Use the Administrative UI to create an attribute mapping that defines how SiteMinder searches for group claims through the SharePoint people picker.

Note: For more information about the relationships between attribute mappings in an LDAP directory and the other components of your environment, see the LDAP examples chart.

Follow these steps:

1. Log on to the SiteMinder Administrative UI.
2. Click Infrastructure, Directory, User Directory, Modify User Directory.

   A list of user directory connections appears.

3. Click the option button for your user directory, and then click Select.

   The Modify User directory page appears.

4. Click Create.

   The create attribute mapping page appears.

5. Verify that the Create a new object of type Attribute Mapping option button is selected, and then click OK.
6. Click the name field, and enter the following name:

   smusergroups
   

7. Verify that the Alias option button is selected, and then click the Definition field.
8. Enter the following definition:

   description
   

9. Click OK.

   The Modify User directory page appears.

10. Click Submit.

    The attribute mapping is created.

Create Attribute Mappings for Group-based Claims in Active Directory

You can also create attribute mappings based on a group of users. Use the Administrative UI to create an attribute mapping that defines how SiteMinder searches for group claims through the SharePoint people picker.

Note: For more information about relationships between attribute mappings in an Active Directory server and other components of your environment, see the Active Directory examples table.

Follow these steps:

1. Log on to the SiteMinder Administrative UI.
2. Click Infrastructure, Directory, User Directory, Modify User Directory.

   A list of user directory connections appears.

3. Click the option button for your user directory, and then click Select.

   The Modify User directory page appears.

4. Click Create.

   The create attribute mapping page appears.

5. Verify that the Create a new object of type Attribute Mapping option button is selected, and then click OK.
6. Click the name field, and enter the following name:

   smusergroups
   

7. Verify that the Alias option button is selected, and then click the Definition field.
8. Enter the following definition:

   name
   

9. Click OK.

   The Modify User directory page appears.

10. Click Submit.

    The attribute mapping is created.

Virtual Attribute Mappings Using Role Claims

You can also configure any number of claims in Name=Value format. These name/value pairs are often named role claims.

Role claims are found by reading a configurable attribute on the user record in your user directory. You can then assign any name you want for the claim. For example, you can name a claim “userrole” and configure it to point to the “employeeType” attribute in your LDAP directory.

After authentication the CA SiteMinder® Agent for SharePoint creates a name/value pair such as “userrole=manager” for the claim. If the "employeeType" attribute for the authenticated user contains the value named manager, SharePoint allows the user access to the resource.

More information:

Create an Attribute Mapping for a Role-based Claims in LDAP Directories

Create an Attribute Mapping for a Role-based Claims in Active Directory

Create an Attribute Mapping for a Role-based Claims in LDAP Directories

You can also create attribute mappings based on user roles. Use the Administrative UI to create an attribute mapping that defines how SiteMinder searches for role-based claims through the SharePoint people picker.

Note: For more information about the relationships between attribute mappings in an LDAP directory and the other components of your environment, see the LDAP examples chart.

Follow these steps:

1. Log on to the SiteMinder Administrative UI.
2. Click Infrastructure, Directory, User Directory, Modify User Directory.

   A list of user directory connections appears.

3. Click the option button for your user directory, and then click Select.

   The Modify User directory page appears.

4. Click Create.

   The create attribute mapping page appears.

5. Verify that the Create a new object of type Attribute Mapping option button is selected, and then click OK.
6. Click the name field, and enter the following name:

   userrole
   

7. Verify that the Alias option button is selected, and then click the Definition field.
8. Enter the following definition:

   employeeType
   

9. Click OK.

   The Modify User directory page appears.

10. Click Submit.

    The attribute mapping is created.

11. (Optional) Create more role-based mappings to suit your needs.

Create an Attribute Mapping for a Role-based Claims in Active Directory

You can also create attribute mappings based on user roles. Use the Administrative UI to create an attribute mapping that defines how SiteMinder searches for role-based claims through the SharePoint people picker.

Note: For more information about relationships between attribute mappings in an Active Directory server and other components of your environment, see the Active Directory examples table.

Follow these steps:

1. Log on to the SiteMinder Administrative UI.
2. Click Infrastructure, Directory, User Directory, Modify User Directory.

   A list of user directory connections appears.

3. Click the option button for your user directory, and then click Select.

   The Modify User directory page appears.

4. Click Create.

   The create attribute mapping page appears.

5. Verify that the Create a new object of type Attribute Mapping option button is selected, and then click OK.
6. Click the name field, and enter the following name:

   userrole
   

7. Verify that the Alias option button is selected, and then click the Definition field.
8. Enter the following definition:

   countryCode
   

9. Click OK.

   The Modify User directory page appears.

10. Click Submit.

    The attribute mapping is created.

11. (Optional) Create more role-based mappings to suit your needs.

Install Claims Provider

If you are not the user who installed or configured SharePoint, you need one of the following privileges to run the Claims Provider installer:

• Administrator for the local server
• Administrator for the group
• Farm Administrator (for any SharePoint farms)

If you are installing your Claims provider on a new SharePoint farm, install the claims provider on your SharePoint central administration server. If you add any additional SharePoint servers to your farm later, install the claims provider on each SharePoint server you add.

Follow these steps:

1. Verify the following prerequisites before continuing:
   • The Policy Server is installed, configured, and contains a token-signing certificate.
   • The CA SiteMinder® Agent for SharePoint is installed, and the connection wizard was run.
   • A trusted identity provider was created.
2. Log on to your SharePoint central administration server.
3. Copy the installation program from the download location on the CA Support site.
4. Locate the following executable:

   ca-spclaims-version-win64.exe
   

5. Right-click the executable, and then select Run as administrator.

   The installation program starts.

6. Follow the installation wizard.
7. Restart your system after the installation finishes.

   The Claims provider is successfully installed.

More information:

Locate the CA SiteMinder® Agent for SharePoint Platform Support Matrix

Locate the Installation Media

Verify Claims Provider Installation

Follow these steps:

1. Start SharePoint 2010 Central Administration from Start, Programs, Microsoft SharePoint 2010 Products.
2. Click System Settings.

   The Central Administration>System Settings page appears.

3. Click Manage Farm Solutions, in the Farm Management section.

   The Central Administration>Solution Management page appears and the status of the Claims Provider is shown as Deployed.