SiteMinder and ASP.NET

Process Description

1. User types the URL for an ASP.NET application into the web browser.
2. The SiteMinder Web Agent intercepts the request and checks its resource cache. If there is no information in cache about this resource (URL), the Web Agent then sends the request to the Policy Server, asking if the resource is protected.
3. The Policy Server responds indicating that the resource is protected.
4. The Web Agent forwards the request to a login page for challenging the user for their credential.
5. The Web Agent forwards the credentials back to the Policy Server for authentication and authorization.
6. The Policy Server authenticates the user against a directory. After verifying the user’s identity, the Policy Server checks rules in the Policy Store, where user entitlements are stored and grant the user access to the resource.
7. The Policy Server notifies the Web Agent that the user is authenticated and authorized for this resource.
8. The Web Agent constructs several SiteMinder HTTP headers with information about the authenticated user (userid), generates an encrypted session cookie and redirects the request to the original target URL.
9. The request reaches the ASP.NET application where the userid can be extracted from the SiteMinder headers for further processing.