Siteminder for authentication

Hello folks,

Has anyone used site minder for single sign on to teamsite?
We are planning to use it and have some questions before we go ahead
1) We'll be using NTOS so the authentication rules will be a mix of OS rules and siteminder rules..Is that going to be a pain?
2) We understand that siteminder will only do the authentication process and all the authorisation is handled by teamsite...I that going to be hard?

Has anyone done this(or something similar) before.
Any tips or documentation appreciated!

Thanks

Find more posts tagged with

Comments

Tbag

I've never done SSO with TeamSite, but check out the ts.650a.admin.win.pdf (TS Admin manual) and there'a a whole chapter on integrating with SiteMinder...

mike_jaixen

We used a custom integration with SiteMinder with version 5.5, but we are abandoning SiteMinder in our migration to 6.5. Our SiteMinder team is displeased with the latest Interwoven integration with SiteMinder, and we've found that integration with SiteMinder adds as much complexity as it tries to solve; our worst outages have been traced back to problems with SiteMinder.

One time, our SiteMinder infrastructure was down for an entire afternoon, and so not only was our secured web site malfunctioning, we couldn't easily update our web site to communicate that fact to our users.

Johnny

We ended up writing a PAM module that authenticates against SiteMinder (we use solaris).

It works ok - but PAM support isn't as complete as Interwoven states.

Now that we can use PAM for SiteMinder authentication - we get password authentication - but nothing else - IE session management etc.

We did it this way because our security policy restricts third party components from being installed on the SiteMinder Policy server. That's the only Interwoven supported approach unfortunately.

John Cuiuli

ruler

Thanks for the feedback gang. For Mike ..What specific problems did you have with siteminder when you talked about the outages.Just want to make sure.
I have couple more specific questions on this.

1) Pros and cons of using siteminder vs NT Auth for Interwoven Teamsite access. Remember we will have legacy users that could use NT Auth as well as contractors... just looking for general pros/cons here, e.g. if there are features one authentication method provides/allows that the other doesn't. Additionally - is it possible to have both?

2) Assuming we go with Siteminder, what are the pros and cons of installing the webagent:
in the Weblogic Server instance that is running Teamsite
in a iPlanet/Sun Web server that fronts the weblogic server that runs Teamsite

I appreciate if someone can help me answer these questions.

Thanks,
Sridhar

ruler

Whats the PAM module and what does it do?

reddyl

PAM stands for "Pluggable Authentication Module" you can write your module that can authenticate user credentials with 3rd party tools.

ruler

What language is this custom module written in?
What i dont understand is why do you need PAM when siteminder itself is a tool thats supposed to provide you the authentication interface.
Whats the point in writing a custom module when you are using that?
We are using LDAP to check againt for user/group credentials with siteminder.

Edited by ruler on 01/25/06 12:03 PM (server time).

Johnny

We were unable to use LDAP in our environment.

John Cuiuli

ruler

Got it...Thanks John!

mstradling

In reply to:

What i dont understand is why do you need PAM when siteminder itself is a tool thats supposed to provide you the authentication interface.
Whats the point in writing a custom module when you are using that?

From what I've read a PAM doesn't do any authentication - it's more of a communication module.

Your application needs to be told a user is authorised in format A, but your authentication system (e.g. text password file, LDAP, SiteMinder, etc) needs to be passed username/password in format B, returning the result in format C.

The PAM translates between the two systems. Take a look at Sun's PAM pages

ruler

Thanks for correcting me Mark.That makes sense.

One of the other questions i had was whats the best place to install the web agent, Webserver vs application server.
We were wondering if there are any load related issues of doing the web agent install on webserver.
Can any one tell me the pros and cons in doing one against the other.

Any SPECIFIC bad experiences with Siteminder.