Federation Security Services Guide › Federation Security Services Overview › Solutions for Federation Use Cases › Solution 2: Single Sign-on based on User Attribute Profiles

Solution 2: Single Sign-on based on User Attribute Profiles

Solution 2 shows how SiteMinder Federation Security Services can be deployed at smcompany.com and partsco.com to solve Use Case 2: Single Sign-on Based on User Attribute Profiles.

SiteMinder is deployed at both sites. The interactions between the user and each site is similar, where partsco.com is acting as the consuming authority.

The following illustration is similar for SAML 1.x, SAML 2.0, and WS-Federation; however, the Federation Web Services components are different as follows:

• For SAML 1.x, the Artifact Resolution Service (for artifact profile only) is at the IdP and the SAML credential collector is at the SP.
• For SAML 2.0, the Assertion Retrieval Service (for artifact binding only) is at the IdP and the Assertion Consumer Service at the SP.
• For WS-Federation, the Single Sign-on Service is at the IdP and the Security Token Consumer Service is at the SP.

  Note: WS-Federation only supports HTTP-POST binding.

Note: The SPS federation gateway can replace the Web Agent and Web Agent Option Pack to provide the SiteMinder Federation Web Services application functions. For information about installing and configuring the SPS federation gateway, see the CA SiteMinder Secure Proxy Server Administration Guide.

The configuration is similar to Solution 1: Single Sign-on based on Account Linking, except for the following:

• The administrator at smcompany.com defines the consumer/SP for partsco.com with an attribute specifying the user's department at the company. The assertion generator will include this attribute as part of the user profile in the SAML assertion created for partsco.com.
• The administrator at partsco.com defines an authentication scheme (artifact, post, or WS-federation) for smcompany.com. The scheme extracts the department attribute from the SAML assertion and searches the user directory at partsco.com for the user record that matches the department value taken from the assertion. The administrator defines one user profile record for each department that is allowed to access partsco.com's Web site.