Agent Guide › Configure the SiteMinder Authentication Provider › Configure the Agent to Return Group Membership to WebLogic Server Using Agent Configuration Parameters › SiteMinder User Directory Not Configured in Identity Manager Environment (Use DMS API)

SiteMinder User Directory Not Configured in Identity Manager Environment (Use DMS API)

In this set up, the SiteMinder Agent requires the SiteMinder Administrator credentials and the SiteMinder user directory structure configured within the Authentication Realm to gather user and group information. In the Agent Configuration Object, you set the credentials using the SMAdminUserName and SMAdminUserPassword parameters and configure this structure using the SmUserDirectory multivalued parameter.

We recommend that you set these parameters centrally in the Agent Configuration Object using the Administrative UI because the SiteMinder administrator password cannot be encrypted in the WebAgent.conf file. Using this interface, you can encrypt this password in the Agent Configuration Object stored in the policy store.

Note: The following procedure provides an overview of the steps required to create the required policy objects with appropriate parameter settings. For detailed procedural information, see the Policy Server Configuration Guide.

To modify the Agent Configuration Object in the Policy Store

1. Open the SiteMinder Administrative UI.
2. Open the Agent Configuration Object that you want to modify.
3. Add the following SiteMinder administrator parameters:

1. Add an "SmUserDirectory" parameter with the following comma-separated values:

   Directory_Type, LDAP_User_Directory_Name, usernameobjectclass, username-field, username-description, groupname-objectclass, groupname-attribute, groupname-description

Important! Values containing a comma can be concatenated using the ^ symbol. For example, inetorgperson, person becomes inetorgperson^person as in the following sample Value field entry: DMS, MyLDAPUserDirectory, inetorgperson^person, uid, description, groupofuniquenames, cn, description

Note: Because SmUserDirectory can be a multivalued parameter, you can configure more than one user directory in the Agent Configuration Object. You can use multiple parameters to declare more than one DMS configuration or CA Identity Manager environment.

1. In the startWebLogic.cmd file (for Windows) or startWebLogic.sh file (for UNIX), add the path of the smjavasdk2.jar file (located in ASA_HOME\lib) file to the WebLogic Server CLASSPATH.

   The modified CLASSPATH variable should resemble the following on Windows:

   set SMASA_CLASSPATH=%ASA_HOME%\conf;

   %ASA_HOME%\lib\smagentapi.jar;%ASA_HOME%\lib\sm_cryptoj.jar;

   %ASA_HOME%\lib\smclientclasses.jar;%ASA_HOME%\lib\smjavasdk2.jar;

   set CLASSPATH=%SMASA_CLASSPATH%;%WEBLOGIC_CLASSPATH%;

   %POINTBASE_CLASSPATH%;%JAVA_HOME%\jre\lib\rt.jar;

   %WL_HOME%\server\lib\webservices.jar;%CLASSPATH%

   The modified CLASSPATH variable should resemble the following on UNIX:

   SMASA_CLASSPATH=$ASA_HOME\conf;

   $ASA_HOME\lib\smagentapi.jar;$ASA_HOME\lib\sm_cryptoj.jar;

   $ASA_HOME\lib\smclientclasses.jar;$ASA_HOME\lib\smjavasdk2.jar;

   CLASSPATH=$SMASA_CLASSPATH%;$WEBLOGIC_CLASSPATH;

   $POINTBASE_CLASSPATH%;$JAVA_HOME\jre\lib\rt.jar;

   $WL_HOME\server\lib\webservices.jar;$CLASSPATH

2. Restart the WebLogic Server for configuration changes to take effect. Reboot this server because the SmUserDirectory parameter is not dynamic.