Skip to main content

SiteMinder / CA SSO authentication

Profile: sitemindersecurity

SiteMinder / CA SSOSSO An authentication scheme that lets users sign in once with an identity provider and access Process360 Live without re-entering credentials. is a proxy that authenticates users before requests reach the application and passes the authenticated user to the platform in an HTTP header. It's a preauthentication scenario: the platform does no authentication of its own and expects the user to be authenticated already. Make sure there's no way to reach the platform without going through the SiteMinder proxy first.

Prerequisites​

  • A configured SiteMinder service that protects the application.
  • The authenticated users must exist in the platform — a user who can authenticate but doesn't exist in the platform can't access it.

Steps​

  1. With SiteMinder protecting the application and your users available, activate the sitemindersecurity profile (see Configuring authentication) and restart the application server.

  2. Optional — customize the user header. By default the platform reads the username from the SM_USER HTTP header. To use a different header, set this in igrafx.properties in the base directory:

    igrafx.usercentral.siteminder.requestheadername=SM_CUSTOM_NAME

SiteMinder and the desktop client​

SiteMinder authentication works in the browser only — the iGrafx Desktop Client can't communicate with the SiteMinder architecture. To keep the desktop client working, allow its requests through your SiteMinder Application Server Agent (ASA): every HTTP request from the desktop client carries a non-empty Flow-Client-Request HTTP header, which you can use to distinguish client requests from web requests. Alternatively, allow client requests through on a specific port — though the security impact is slightly higher.