Federation Security Services Guide › Federation Security Services Overview › Federation Security Services Concepts › Federated Single Sign-on with Security Zones

Federated Single Sign-on with Security Zones

A SiteMinder environment can be set up to include a Web application environment for web service protection and a federation environment for federated resource protection. This method can make a SiteMinder deployment more efficient.

Certain Federation Security Services features require a persistent user session because the SAML assertion must be stored in the session store at the Policy Server.

These features include:

• Artifact Single sign-on - For SAML 1.x and SAML 2.0, the SAML assertion is stored in a persistent session that is later retrieved by the consuming site.
• Federated Logout - For SAML 2.0 Single Logout and WS-Fed Signout at producer and consumer sites. Partner data is stored in a persistent user session to facilitate notification of partners during a federated logout.

Use of persistent user sessions can slow down performance because of the calls to the session store to retrieve assertions or handle log-off requests. However, security zones can eliminate the need for a persistent user session for requested producer-side applications protected by a Web Agent. A security zone is a segment of a single cookie domain, used as a method of partitioning applications to permit different security requirements for resource access. All applications in a single zone permit single sign-on to one another. If an application is in another zone, single sign-on is determined by the configured trust relationship.

Security zones are a part of SiteMinder's single sign-on feature and are implemented by SiteMinder Web Agents.

Note: In a federated environment, you can only configure Web Agents and SAML Affiliate Agents to use security zones. Secure Proxy Agents and Application Server Agents do not support this feature.

To configure security zones, you enter values for the following Web Agent parameters:

• SSOZoneName--identifies a single sign-on security zone. The zone name gets added to the cookie domain name so you know which are associated with which domains.
• SSOTrustedZone--ordered list of trusted security zone names. When you define zones and trusted zone lists, it determines the cookies that the Web Agent is able to read and/or write.

These parameters are part of an Agent Configuration Object or a local Agent configuration file.

To find more information about security zones, see the SiteMinder Web Agent Configuration Guide.