Web Agent Guides › Web Agent Configuration Guide › Authenticate Users with Forms › Use Credential Collectors for Authentication and Single Sign-On › Configure Credential Collectors in a Mixed Environment

Configure Credential Collectors in a Mixed Environment

Beginning with 5.x QMR 2, the forms (FCC/SFCC), SSL (SCCs), and NTLM (NTC) credential collectors operate differently than 4.x credential collectors. When a user submits credentials, the credential collector does not have to create a credential cookie in the user's browser and send the user back to the original Web Agent. Instead, the credential collector can log the user in to the Policy Server directly on behalf of the Web Agent protecting the requested resource.

Note: We recommend using credential collectors to log users in directly rather than setting cookies. Using credential collectors to log users in better secures user credentials because these credentials are not being passed around the network in cookies. This is an important consideration when you are configuring credential collectors in a mixed environment.

For a credential collector to log a user in, it needs the name of the Web Agent protecting the requested resource and the credentials supplied by the user.

To learn the Agent name, a credential collector uses the following process:

1. Use the SMAGENTNAME query parameter that the original Web Agent adds to the query string of the URL as it redirects the user to the credential collector.
2. If there is no Agent name appended to the URL, use the Agent name from Agent name-to-host name mappings in the credential collector's Agent configuration file or Agent Configuration Object.

   Each mapping specifies the name and IP address of a host using that collector for its protected resources. Mappings are defined in the AgentName parameter.

3. If no Agent name mappings are configured, use the fully qualified host name of the target URL as the Agent name. This is determined by enabling the AgentNamesAreFQHostNames parameter in the Agent's configuration.

   This parameter is disabled by default, so the credential collector uses the value of the DefaultAgentName parameter as the Agent name.

When you upgrade, you must consider the credential collector algorithm and how it affects the configuration of an FCC, SCC, SFCC, or NTC so it can communicate with a 4.x Web Agent.