Web Agent Guides › Web Agent Configuration Guide › Single Sign-On (SSO) › Integrate an IIS 6.0 Agent with SharePoint Portal Server 2003

Integrate an IIS 6.0 Agent with SharePoint Portal Server 2003

The IIS 6.0 Web Agent can work with Microsoft’s SharePoint Portal Server 2003 and provide single sign-on for resources stored on that server.

Note: In a SharePoint security context, the user store must be Active Directory (AD).

To integrate the Web Agent and the SharePoint sever,

1. Complete both of the following prerequisites:
   • Install a r12.0 SP3 (or later) Web Agent for IIS 6.0.
   • Apply the hotfix described in Microsoft Knowledge Base Article 824330, "IIS 6.0 Does Not Return AUTH_TYPE for Integrated Security."
2. Add the following to the default virtual server’s web.config file, located, for example, in c:\inetpub\wwwroot2\web.config.
3. Place the following entry between the </system.web> attribute and the </configuration> attribute:

   <appSettings>
   <add key="SPS-EnforceIISAnonymousSetting" value="false"/>
   </appSettings>
   

4. Enable the session server so the Web Agent can provide the user security context for the SharePoint Portal Server resources.

   Note: For more information, see the Policy Server documentation.

   The Web Agent is integrated with the SharePoint Portal Server 2003.

Specify the Cookie Path for Agent Cookies

When a Web Agent creates a cookie, the web agent automatically uses the root (/) directory as the cookie path. The domain and path attributes of cookies are compared to the URL of a request. If the cookie is valid for the domain and the path, the client sends the cookie to the server. When the cookie path uses the root value, the client sends the cookie to the server with all requests in the domain.

You can set SiteMinder cookies to a given set of paths to eliminate the web traffic caused when cookies are sent for unprotected resources. For example, if a cookie path is set to /mypackage, the client only sends the cookie for requests in a particular package in the domain.

To specify the cookie path for agent cookies

1. Open your Agent Configuration Object or your local agent configuration file.
2. Set the Cookie Path for the Cookie Provider in the following parameter:

   MasterCookiePath

   Specifies the path for the primary-domain session cookies created by the cookie provider. For example, if this parameter is set to /siteminderagent, all session cookies that the cookie provider creates will have the /siteminderagent path. If this parameter is not set in the Cookie Provider Agent, the default value is used.

   Default: / (root)

3. Set the cookie path for the secondary agents in the following parameter:

   CookiePath

   Specifies the cookie path for the following secondary agent browser cookies:

   • xxSESSION
   • xxIDENTITY
   • xxDOMINODATA
   • xxCHALLENGE (including SSL_CHALLENGE_DONE)
   • xxDATA
   • xxSAVEDSESSION

   For example, setting this parameter to /BasicAuth, all of the secondary agents in the previous list are created using /BasicAuth as the path. If not specified, the default value is used.

   The CookiePath is not added to credential cookies (such as xxxxCRED) to maintain backwards compatibility with 4.x agents.

   The following cookies will always use the root (/) path:

   • ONDENIEDREDIR
   • TRYNO

   If the CookiePathScope parameter is greater than zero, the CookiePath parameter settings are overriden.

   Default: / (root)

4. (Optional) If you want the Web Agent to extract the cookie path from the URL instead of using the CookiePath value, set the following parameter to a number greater than zero:

   CookiePathScope

   Specifies the scope of the cookie path for the following secondary agent cookies:

   • xxSESSION
   • xxIDENTITY
   • xxDOMINODATA
   • xxCHALLENGE (including SSL_CHALLENGE_DONE)
   • xxDATA
   • xxSAVEDSESSION

   Using a CookiePathScope greater than zero in this parameter overrides the setting of the CookiePath parameter.

   Default: 0

More information:

Configure Full Logoff

How CookiePathScope Settings Work

The following table shows how the value of the CookiePathScope parameter works with the following settings:

• A URL such as http://fqdn/path1/path2/path3/path4/index.html
• A CookiePath parameter value of /BasicA

These settings also affect simple SSO. For example, if the value of the CookiePathScope is set to 1 or higher,users will get challenged for credentials for both /BasicA/Index.html and /BasicB/Index.html since the SESSION cookie with a path /BasicA will not be valid for /BasicB/Index.html request.