Integrate SiteMinder
SiteMinder provides policy-based authentication and single sign-on for Web-based applications. See https://www.broadcom.com/products/identity/siteminder. You can protect access to SiteMinder by integrating SiteMinder with Identity as a Service. Once integrated, users can use single sign-on to log in to their SiteMinder account through Identity as a Service.
Note: This integration was tested using Identity as a Service version 5.33 and SiteMinder 12.8.x version. Other versions of SiteMinder may require integration and configuration steps that differ from those documented in this procedure. In the event of other issues, contact support@entrust.com for assistance
To integrate SiteMinder with Identity as a Service, you must do the following:
Before you begin, open two browser windows. In one window, log in to your SiteMinder administrator account. In the other window, log in to your IDaaS administrator account.
Step 1: Copy the SAML configurations from Identity as a ServiceStep 1: Copy the SAML configurations from Identity as a Service
Copy the SAML Configuration from Identity as a Service
Log into your Identity as a Service administrator account.
Click 
> Security > Applications. The Applications Lists page appears.
Under SAML Cloud Integrations, click SAML Configuration. The SAML Configuration dialog box appears.
This dialog box contains information you need to configure your SAML application for Identity as a Service authentication.
Do one of the following:
Leave this dialog box open to reference later in this procedure.
Copy the Entity ID, Single Sign-on URL, and Single Logout URL to a text file and save it to reference later in this procedure.
Note: Depending on the integration you are performing, you may not need all three of these SAML configuration values.
Step 2: Copy the SAML signing certificate from Identity as a ServiceStep 2: Copy the SAML signing certificate from Identity as a Service
Copy a SAML signing certificate
Log in to your Identity as a Service administrator account.
Click > Security > Applications. The Applications List page appears.
Under SAML Cloud Integrations, click SAML Signing Certificates. The SAML Signing Certificates page appears.
Click 
next to the certificate to copy it to the clipboard.
You can additionally download the certificate and save it for future use.
Open a text editor, such as Notepad, and paste the contents of the certificate into the text file.
Save the file.
Note: Be sure to same the file with the .cer extension, for example, SAML_certifcate.cer.
Step 3: Configure SiteMinder for Identity as a Service authentication
This integration uses SiteMinder Access Gateway as the local Service Provider and Entrust Identity as a Service as Remote Identity Provider with default settings. There are various combinations to configure a Federation Partnership.
This integration requires the following prerequisites:
User Directory
Policy Server
Access Gateway server details to configure SAML, URLs to Servlets that Initiate Single Sign-on
See the SiteMinder documentation or contact your SiteMinder administrator to configure Federation Partnership.
To configure the prerequisites, you need to create Federation Entities and Federation Partnerships. This involves three steps:
Step 3.A: Configure Local SAML 2.0 SP EntityStep 3.A: Configure Local SAML 2.0 SP Entity
Log in to the SiteMinder Administrator console.
Go to Tasks > Federation > Partnership Federation > Entities. The Entities page appears.
Click Create Entity. The Select Entity Type page appears.
In the Select Entity Type page, do the following:
For the Entity Location, select Local.
From the New Entity Type drop-down list, select SAML2 SP.
Click Next. the Configure Entity page appears.
In the Configure Entity page, do the following:
In the Entity ID field, enter the Entity ID that belongs to the remote partner.
Example: https://siteminderaccessgateway.domain.com
Enter an Entity Name.
In the Description field, enter a description for the Entity.
In the Base URL field enter the base location of the server that is visible to the intended users of the federation. This server is typically the server where SiteMinder is installed.
Example: https://siteminderaccessgateway.domain.com
Note: Do not put a forward slash at the end of the base URL. A final slash results in two slashes being appended to other URLs that use this base URL.
Expand the Supported Name ID Formats and select Unspecified.
Leave the remaining settings at the default values.
Click Next. The Confirm page appears.
Open a text editor, such as Notepad and under Confirm, copy the following to the text file:
Assertion Consumer Service URL
Entity ID
You need these values in Step 4: Add SiteMinder to Identity as a Service.
Click Finish.
Step 3.B: Configure Remote SAML 2.0 IDP EntityStep 3.B: Configure Remote SAML 2.0 IDP Entity
Log in to the SiteMinder Administrator console.
Go to Tasks > Federation > Partnership Federation > Entities. The Entities page appears.
Click Create Entity. The Select Entity Type page appears.
In the Select Entity Type page, do the following:
For the Entity Location, select Remote.
From the New Entity Type drop-down list, select SAML2 IDP.
Click Next. the Configure Entity page appears.
In the Entity ID field, enter the Entity ID you copied in Step 1: Copy the SAML configurations from Identity as a Service.
In the Description field, enter a description for the Entity.
In the Remote SSO Service URLs, section, do the following:
From the Binding drop-down list, select HTTP-Redirect.
In the URL field, enter the Single Sign-on URL you copied in Step 1: Copy the SAML configurations from Identity as a Service.
Expand the Signature and Encryption options section and do the following:
Click Import. The Select File page appears.
For the Input File As, select Single Key / Cert File.File.
Click Browse and browse to select the SAML signing certificate you file downloaded in Step 2: Copy the SAML signing certificate from identity as a Service.
Click Next. The Confirm page appears.
Click Finish.
Step 3.C: Configure PartnershipsStep 3.C: Configure Partnerships
Log in to the SiteMinder Administrator console.
Go to Tasks > Federation > Partnership Federation > Partnerships. The Partnerships page appears.
Click Create Partnership.
From the Create Partnership drop-down list, select SAML2 SP -> IDP. The Configure Partnership page appears.
In the Configure Partnership page, do the following:
Enter a Partnership Name. For example, EntrustIDaaSSiteminderPartnership.
From the Local SP list, select the Entity you created in Step 3.A: Configure Local SAML 2.0 SP Entity.
From the Remote IDP list, select the Remote SAML 2.0 IDP Entity you created in Step 3.B: Configure Remote SAML 2.0 IDP Entity.
Set the Skew Time (Seconds) to 30.
Under User Directories and Search order, select the user directory configured for the SiteMinder Policy Server and move it to Selected Directories.
Click Next. The User Identification page appears.
In the User Identification page, do the following:
Select Use Name IDb>.
From the NameIDPolicy Format drop-down list, select *Unspecified.
In the LDAP Search Specification. field enter the LDAP search specification. This value changes depending on the LDAP used. For example, for ODSEE LDAP, the value is uid=%s.
For Federated Users, under User Class, select All Users in Directory.
Leave the remaining settings at the default values.
Click Next. The SSO and SLO page appears.
In the SSO and SLO page, do the following:
For the Authentication Binding Request, select HTTP-Redirect.
For the SSO Profile, select HTTP-POST.
From the Issuer Format drop-down list, select *Unspecified.
Click Next. TheConfigure AuthnContext page appears.
Leave the Configure AuthnContext settings at the defaults.
Click Next. The Signature and Encryption page appears.
In the Signature and Encryption page, do the following:
From theVerification Certificate Alias: drop-down list, select the certificate you imported in Step 3.B: Configure Remote SAML2.0 IDP Entity.
Leave the remaining settings at the default values.
Click Next. The Application Integration page appears.
In the Application Integration page, do the following:
For the Redirect Mode : No data select the default setting.
In the Target field, enter the URL that is protected by SAML. This is the resource protected behind the SiteMinder Access Gateway.
Leave the remaining settings at the default values.
Click Next. The Confirm page appears.
Review all settings and then click Confirm.
Step 4: Add SiteMinder to Identity as a ServiceStep 4: Add SiteMinder to Identity as a Service
In Identity as a Service, click > Security > Applications. The Applications Lists page appears.
Click Add. The Select an Application Template page appears.
Do one of the following:
Select SAML Cloud Integrations from the search drop-down list and scroll to find the application you want to add to IDaaS.
- or -
In the Search bar, enter a search option to filter for the application you want to add to IDaaS.
Click SiteMinder. The Add SiteMinder page appears.
Enter an Application Name.
Enter an Application Description.
Optional. Add a custom application logo.
Click 
next to Application Logo. The Upload Logo dialog box appears.
Click 
to select an image file to upload.
Browse to select your file and click Open. The Upload Logo dialog box reappears showing your selected image.
If required, resize your image.
Click OK.
Select the Authentication Flow that appears to users during login.
Click Next. The General page appears.
In the Default Assertion Consumer URL field, enter the Assertion Consumer Service URL, enter the Assertion Consumer URL you copied from SiteMinder in Step 3.B: Configure Remote SAML IDP Entity.
In the Service Provider Entity ID field, enter:
In the Single Logout Service URL field, enter the Single Sign-on URL you copied from SiteMinder in Step 3.B: Configure Remote SAML IDP Entity.
Enter the SAML Session Timeout to the time when the SAML Assertion times out. The maximum is 720 minutes.
Enter the Max Authentication Age (seconds) to set the maximum amount of time that can elapse before a user is required to reauthenticate during a new login attempt. This applies for both SP-initiated and IDP-initiated login. Set this field to -1 to disable this feature.
From the SAML NameID Attribute drop-down list, select User ID.
From the SAML NameID Encoding Format drop-down list, select Unspecified.
From the SAML Signing Certificate from the drop-down list, select the SAML Signing Certificate that you imported into SiteMinder.
Deselect Enable Go Back Button if you do not want users to be able to go back to the ReviewInc login page to log in.
Select Show Default Assertion Consumer URL Service in the My Profile. When selected, the Default Assertion Consumer URL appears in a user's My Profile page in addition to relay states and Alternative Assertion Consumer URLs.
Add an Alternate Assertion Consumer Service URL
Click Add.
Enter a Name.
Enter a URL Value field. For example, https://<userID>.<mycompany.com>/SAML20/
Select Show in My Profile to display the Alternative Consumer Service URL in a user's My profile page.
Optional. Add an Application Logo.
Click Add.
Leave the remaining settings at the default values.
Click Submit.
Step 5: Add a resource ruleStep 5: Add a resource rule
Step 6: Test the integrationStep 6: Test the integration
Testing Service Provider Login
See the Siteminder documentation regarding URLs to Servlets that Initiate Single Sign-on.
Note the following:
The page with these hard-coded links must reside in an unprotected realm.
The hard-coded link that the user selects must contain specific query parameters, which are used in an HTTP GET request to the AuthnRequest service.
The syntax for the link is:
Example: http://sp_server:port/affwebservices/public/saml2authnrequest?ProviderID=idp_id&RelayState=target_URL
https://cag.domain.com/affwebservices/public/saml2authnrequest?ProviderID=https://entrust.us.trustedauth.com/api/saml&RelayState=https://cag.domain.com/saml
To test Service Provider login
Access the hard-coded link to be redirected to the Identity as a Service login page.
Log in with your first factor credentials.
Respond to the second-factor authentication challenge. If you respond successfully, you are redirected Target URL of SiteMinder.
Testing Identity as a Service redirect log in
Log in to your Identity as a Service account.
Go to your My Profile page if you are not already there.
Under Applications, click SiteMinder.
Respond to the second-factor authentication challenge. If you respond successfully, you are logged in to SiteMinder.