CA SiteMinder® Federation Standalone Installation and Upgrade Guide › Install CA SiteMinder® Federation Standalone › How to Run the CA SiteMinder® Federation Standalone Configuration Wizard › Determine the Deployment Mode Before Configuration › Proxy Mode

Proxy Mode

In a proxy mode deployment, you use CA SiteMinder® Federation Standalone in the DMZ to forward requests to backend web servers that host federated applications. These backend systems sit behind a firewall and are not directly accessible.

Proxy mode offers the following advantages:

• Provides one access point into your network.
• Enables CA SiteMinder® Federation Standalone to supply identity attributes using HTTP headers from the SAML assertion to backend applications. The applications can then be customized to provide a more personalized user experience.

Note: You can protect the HTTP Headers against modification by an unauthorized user by setting an HTTP Header prefix. More information is available for protecting HTTP Headers in proxy mode.

Important! In proxy mode CA SiteMinder® Federation Standalone passes all requests to the backend network. Therefore, be sure that all resources on a backend web server are protected by CA SiteMinder® or another access control product. For example, a backend web server may host a federated application as well as unprotected resources behind the firewall. If the administrator exposes the federated application, the unprotected resources are also exposed because CA SiteMinder® Federation Standalone allows full access to the backend web server without checking for authorization. This assumes that the non-federated resources are URL-addressable.

The following figure shows a typical proxy mode deployment from the perspective of the relying party.

The previous figure shows the following communication flow at the relying party:

1. A user makes an initial request for a federated resource.
2. Based on the data in the assertion, CA SiteMinder® Federation Standalone authenticates the user, contacting the user directory at the internal site to complete the user disambiguation process.
3. After successful authentication, CA SiteMinder® Federation Standalone returns a redirect response back to the user's browser.
4. CA SiteMinder® Federation Standalone proxies the request to the target web server and the user accesses the resource.