Agent Guide › Configuring the SiteMinder Agent, SiteMinder-Side › Configure the TAI, SiteMinder-Side › Configure the TAI to Only Handle Requests from SiteMinder Session Holders › Create an Assertion Realm for Non-Challenged Requests

Previous Topic: Set the AssertionAuthResource Agent Configuration Parameter

Next Topic: Configure the TAI to Challenge Requests for Credentials
Create an Assertion Realm for Non-Challenged Requests

If your SiteMinder TAI is not configured to challenge requests for credentials (the challengeforcredentials Agent configuration parameter is set to no), you configure a SiteMinder TAI Assertion Realm in which SiteMinder simply asserts the identities obtained from SiteMinder session cookies associated with HTTP requests. This assures that requests by HTTP clients already authenticated by SiteMinder (and thus with associated SiteMinder session cookies) are not rechallenged by WebSphere when they access your web applications. Other requests are rejected.

Note: The following procedure provides an overview of the steps required to create the required policy objects with appropriate parameter settings. For detailed procedural information, see the Policy Server Configuration Guide.

To create a realm for non-challenged requests

  1. Start the SiteMinder Administrative UI.
  2. Configure a user directory connection to the same LDAP user store as the one used by WebSphere.
  3. Create a domain and assign the user directory from Step 2 to this domain.
  4. Create a realm with the following properties:
    Domain

    The domain you created in step 3.

    Name

    SiteMinder TAI Assertion Realm.

    Description

    SiteMinder TAI Assertion Realm.

    Agent

    The SiteMinder Agent Identity you configured for the SiteMinder TAI.

    Resource Filter

    /AssertionAuthResource (any value is valid, but it must match value of AssertionAuthResource Agent configuration parameter specified for the TAI module).

    For example, /siteminderassertion.

    Default Resource Protection

    Protected.

    Authentication Scheme

    Basic or any authentication scheme.

    Maximum Timeout

    This option must be disabled.

    Idle Timeout

    This option must be disabled.

    Persistent Session

    Non-persistent.

Configuring rules or policies for this assertion realm is unnecessary. However, to implement user mapping, you must set an authentication response attribute, and then configure appropriate rules and policies for the assertion realm.