In accordance with the JSR-115 specification JACC Policy Decision and Enforcement Subcontract, you can configure the SiteMinder JACC Provider to secure transport guarantees for any HTTP accessible resource using J2EE user data permissions.
For example, if the Servlet /Snoop is only to be made available for access over HTTPS for actions GET and POST, the security configuration for “/Snoop” should consist of a J2EE user data constraint with value CONFIDENTIAL for those actions.
Note: It is important to verify that transport guarantee policy requirements have been propagated to the SiteMinder JACC Provider for predeployed web applications.
To configure an HTTP transport guarantee for an HTTP resource, append its SiteMinder resource specification with the term /CONFIDENTIAL:
/contextPath/[resourcePath]/CONFIDENTIAL
Context-path of the web application servicing this URI.
Example: /sm/mywebapp
The relative path to the resource requested.
Multiple path elements must be treated as separate slash(/)-delimited parameters.
Example: /foo/bar/my.jsp?a=b
Note: If you omit the resourcePath parameter and specify only the contextPath, all resources associated with the specified web application are subject to the transport guarantee and are therefore only accessible over HTTPS.
For example,
/sm/mywebapp/CONFIDENTIAL
/sm/mywebapp/foo/bar/my.jsp/CONFIDENTIAL
Copyright © 2010 CA. All rights reserved. | Email CA Technologies about this topic |