Web Agent Guides › Web Agent Configuration Guide › Protecting Web Applications › How Response Attributes Work with Web Agents

How Response Attributes Work with Web Agents

SiteMinder response attributes instruct applications how to collect user data and apply that information to display personalized content for each user.

SiteMinder provides configurable response attributes as a means of delivering data to applications and customizing the user experience.

You configure responses using the Administrative UI, and then associate them with specific rules in a policy. When a request triggers a rule with a configured response, the Policy Server sends the response data to the Agent, which interprets the information and makes it available to Web applications.

When you configure a response, you associate the response with an Agent action. You can associate HTTP header and cookie response attributes with the actions GET and POST. These attributes can also be tied to Authentication or Authorization events. The Policy Server can send a response if the user is accepted or rejected for either of these events.

Note: When configuring response attributes note that the maximum buffer size for the web server for agent responses is 32 KB. There is no length limit of a response other than the total buffer size.

Response attributes other than the header and cookie attributes can only be used when an authentication or authorization event occurs (whether or not the user is accepted or rejected for either of these events). For example, you can select an Authorization event action for a rule and then configure a WebAgent-OnReject-Redirect response attribute. If a user is rejected during the authorization process by SiteMinder, the Agent redirects the user to another page that could display a message indicating why that user was rejected.

The following illustration shows how response attributes are sent from the Policy Server to the web server:

To simplify the task of maintaining responses, define a separate response for each type of event. For example, define one response for an OnAccept event and another response for an OnReject event. Creating a separate response makes it easier to find attributes when you need to modify response values.