Policy Server Guides › Policy Server Configuration Guide › Strong Authentication › Protect the Sample Application › Realms and Rules for the Sample Application

Realms and Rules for the Sample Application

For this example, the following four realms protect the various resources that make up the sample application:

• A realm that contains public resources
• A realm that contains resources requiring at least a level 5 authentication
• A realm that contains resources requiring at least a level 15 authentication
• A realm that contains resources available only to users authenticated with SafeWord

The realms are shown in the following illustration.

The protected realms are configured with the AuthChannel front-end authentication scheme, as shown in the following illustration.

The SampleAgentGroup may contain any Web Agents that provide points of entry to the sample application.

The following requirements are necessary for Web Agents protecting realms as part of the Credentials Selector functionality:

• Single sign-on must be configured between all Web Agents protecting realms. This means that they are in the same cookie domain or they use the same cookie provider.

  Note: To configure single sign-on, see the Web Agent Configuration Guide.

• The value of the @smagentname directive in the FCC file must match the expected value for at least one of the Web Agents protecting the originally requested resource.

  The expected value is the value of the Web Agent's AgentName parameter or the DefaultAgentName parameter, if the AgentName parameter is not assigned a value. If the EncryptAgentName parameter in the Agent's configuration is set to yes, the value must be encrypted.

  One way of setting the @smagentname directive is by configuring each Web Agent with the same naming properties. They can even share the same Agent Configuration Object. Another method is to configure the @smagentname directive programmatically in the FCC file, provided that the name is not encrypted.

  Important! If the @smagentname directive is misconfigured, you may see a "No realm received in request" error message in the Policy Server log.

• The FCCForceIsProtected parameter must be set to yes to ensure that a second IsProtected call is made for the new target generated by the selectlogin.fcc file. The IgnoreQueryData parameter must be set to no so the Web Agent does not ignore the URL query parameters.

Rules for the Policy Protecting Sample Application

You can configure any type of rule for the realms that contain the sample application resources.