Federation Security Services Guide › Federation Security Services Overview › Solutions for Federation Use Cases › Solution 8: Multi-protocol Network

Solution 8: Multi-protocol Network

Solution 8 illustrates how SiteMinder Federation Security Services can be employed to solve Use Case 8: Multi-protocol Support.

In this solution:

For User 1:

• smcompany.com is the SAML 2.0 Identity Provider for ahealthco.com. The partner, ahealthco.com, is included in an affiliate domain as a SAML 2.0 Service Provider.
• ahealthco.com is where the SAML 2.0 authentication scheme is configured, and where smcompany.com is identified as the Identity Provider.

For User 2:

• smcompany.com is the SAML 1.0 producer for discounts.com, which is a SAML 1.0 consumer. This site uses the SAML Affiliate Agent, which can only consume SAML 1.0 assertions. It cannot perform any authentication tasks.

The following illustration shows a SiteMinder federated network that implements multiprotocol support.

Note: The SPS federation gateway can replace the Web Agent and Web Agent Option Pack to provide the SiteMinder Federation Web Services application functions. For information about installing and configuring the SPS federation gateway, see the CA SiteMinder Secure Proxy Server Administration Guide.

In this multiprotocol solution, smcompany.com can issue a SAML 2.0 assertion for User 1 to access resources at ahealthco.com. Additionally, smcompany.com can issue a SAML 1.0 assertion for User 2 to authenticate at discounts.com. Smcompany.com issues an assertion based on the session cookie that is set during initial authentication and determines the appropriate protocol for the assertion.

The SAML Affiliate Agent at discounts.com needs to be configured so that smcompany.com is added to its producer information settings in its AffiliateConfig.xml configuration file so that it accepts SAML 1.0 assertions from this site.