Federation Security Services Guide › Deploy Federation Using the Sample Application

Deploy Federation Using the Sample Application

This section contains the following topics:

Legacy Federation Sample Application Overview

Legacy Sample Application Deployment

Sample Application Components

Prerequisites to Deploy the Sample Application

How To Run the Sample Application

Test Single Sign-on with the Sample Application

Test Single Logout with the Sample Application

Review Application-Generated SiteMinder Objects

Legacy Federation Sample Application Overview

To become familiar with SiteMinder Federation Security Services, deploy the legacy federation sample application. The sample application automates all the federation setup tasks to accomplish SAML 2.0 single sign-on and single logout. After you run the sample application, look at the SiteMinder policy objects that the sample application creates. Also, examine the SiteMinder logs containing assertions. Finally, use the sample application objects as a basis for configuring your own federation environment.

Note: The Federation Security Services sample application only creates SAML 2.0 objects.

Legacy Sample Application Deployment

The sample websites in the SiteMinder federated network are an Identity Provider named idp.demo, and a Service Provider named sp.demo. A business partnership is established between idp.demo and sp.demo.

You can deploy the sample application in many ways. We recommend one of two ways:

• On one system acting as an Identity Provider (IdP) and a Service Provider (SP). In this instance, install all SiteMinder components (Policy Server, Web Agent, and Web Agent Option Pack) on one system.
• Two systems acting as an Identity Provider (IdP) and a Service Provider (SP). Install the Policy Server on one system and the Web Agent and Web Agent Option Pack on a second system.

The following illustration shows two deployments of the sample application.

Sample Application Components

The legacy sample application contains the following components:

FederationSample.conf

The FederationSample.conf file contains configuration settings that define the IdP and SP-side policy objects.

SetupFederationSample.pl Perl script

The SetupFederationSample.pl Perl script executes the federation sample application. This script creates the objects for the IdP and SP sites. The script also creates the necessary web pages to initiate single sign-on and single logout between the IdP and the SP. The script relies on the information in the FederationSample.conf file to operate.

Use the Perl interpreter included with the sample application to run the application.

Web pages to test single sign-on and single logout

The sample application installs two directories that contain template pages for testing SAML 2.0 single sign-on and single logout transactions. The directories, idpsample and the spsample, are installed in the directory siteminder_home/siteminder/samples/federation/content.

These directories are also copied to the default document root directory of the web server.

• IDP Pages

  The IdP web pages are in the idpsample directory. These pages include:

  index.jsp

  Index.jsp is the first web page the user accesses at the IdP for IdP-initiated single sign-on. This page provides the link to the protected target resource at the sp.demo partner site. This page also provides a single logout link.

  Note: The single logout link is displayed only if FSS is the IdP and an SMSESSION cookie is in the request headers.

  SLOConfirm.jsp

  SLOConfirm.jsp displays a message that the user has successfully logged out from idp.demo and sp.demo domains.

• SP Pages

  The SP web pages are in the spsample directory. These pages include:

  index.jsp

  Index.jsp is the first web page the user accesses at the SP for SP-initiated single sign-on. This page provides a link to the protected target resource. This page also provides single logout link.

  Note: The single logout link is displayed only if FSS is the IdP and an SMSESSION cookie is in the request headers.

  target.jsp

  Target.jsp, a protected page at the sp.demo partner site, is located in the /spsample/protected directory. The SAML 2.0 authentication scheme protects this page. A user sees this page when single sign-on between the IdP and SP succeeds.

  SLOConfirm.jsp

  SLOConfirm.jsp displays a message that the user has successfully logged out from the idp.demo and sp.demo domains.

Prerequisites to Deploy the Sample Application

Before you run the sample application, satisfy the following requirements.

Deployment requirements (SiteMinder r12.0 SP3 components recommended):

• Install a Policy Server.
• Install a Web Agent.

  The web server where you install the Web Agent does not require an SSL port.

• Install the Web Agent Option Pack. The Web Agent Option Pack requires a supported application server.

  If you install the Policy Server, Web Agent, and Web Agent Option Pack on one system, we recommend using ServletExec as the application server. To install the Web Agent Option Pack and deploy Federation Web services on an application server, see the Web Agent Option Pack Guide.

• Install an LDAP or ODBC user directory.

On the Policy Server system:

• Point the Policy Server to the user directory that you set up.
• Configure a policy store.
• Configure and enable a session store to use the sample application for testing HTTP-Artifact single sign-on and single logout. Set up a separate session store repository from the policy store repository. The session store can be CA Directory (LDAP) or an ODBC database.

  For instructions on configuring a session store, see the Policy Server Administration Guide.

On the web agent system:

• (Optional) Enable logging in the LoggerConfig.properties file. This file is in the directory web_agent_home/affwebservices/WEB-INF/classes. Enabling trace logging generates the FWSTrace.log file. The trace log lets you view the assertion after you test single sign-on.

Note: If your deployment uses only one system, install all components on that one system. If your deployment has more than one Policy Server and more than one Web Agent, complete the prerequisites on all relevant systems.

Verify that the Policy Server and Web Agent are configured properly and that you can protect a resource.

Important! Core SiteMinder must function properly to run the sample application successfully.