How Siteminder Interacts with LDAP

Please follow the below URL

http://www.coreblox.com/2009/06/how-siteminder-interacts-with-ldap/

openssl extract cert and private key

Export the private key file from the pfx file
===============================================

openssl pkcs12 -in filename.pfx -nocerts -out key.pem

Export the certificate file from the pfx file
==============================================

openssl pkcs12 -in filename.pfx -clcerts -nokeys -out cert.pem

Remove the passphrase from the private key
==========================================

openssl rsa -in key.pem -out server.key

Siteminder Log out settings

Solution
======

1) Find the URL of the logout action in the app (from the docs, by hovering over it, or by tracing the HTTP traffic)

2) Open the SiteMinder Web Agent configuration (either in the SiteMinder console or in the local WebAgent config file) and add a LogOffUri setting to reflect the above URI. Note: this is a URI not a URL. So remove the http://hostname portion.

Download SiteMinder Policy Server and Web Agents

How to download any hotfix version of SiteMinder

1: log into https://support.ca.com
2: click on "Support By Product"
3: type in "CA Site" it will auto fill "CA SiteMinder"; hit enter
4: click on "Recommended Reading"
5: click on "CA SiteMinder Hotfix/Cumulative Release Index"
6: click on the type of download you want. For example, "SiteMinder Web Access Manager Agents"
7: scroll until you see the version you are seeking
8: click this link
9: click the next link (ignore the os/webserver information as its misleading)
10: click "Solution Downloads"
11: click the solution download you need.

No initial key management object found

Error : No initial key management 
object found. This policy 
server is configured in 
read-only key management mode. Unable to proceed

Description : The Policy Store does not hold an initial Agent Key Management object and Key Generation has not been enabled.

Solution : Go To Policy Server Management Console ->Enable Key Generation Under Key Tab.

How Siteminder cache works

Caches implemented by the Policy Server

Object Store Cache

Purpose: Stores contents of the Policy Store in memory in order to reduce round trip calls to LDAP and ODBC policy stores.

Policy Cache

Purpose: Stores the list of policy links applicable to a given resource and action. Prevents the scanning of all rules within a given realm in order to determine which policies protect a particular resource.

Agent Name Cache

Purpose: Stores easy searchable table of Agent Oids. During IsProtected it is necessary to determine Agent Oid from Agent Name. The Agent Name Cache prevents enumerating all agents to find one with matching name.

Agent Group Cache

Purpose: Stores easy searchable lists of Agent Oids. During IsProtected it is necessary to find all Agents that might protect this resource, i.e. if given agent belongs to Agent Group, all agents (and agent groups) of this group might protect given resource. The Agent Group Cache prevents recursive scanning of all agents to find applicable ones.

Realm Cache

Purpose: Stores Realms for best resource matching. During IsProtected it is necessary to find best matching Realm for given Agents and resource. The Realm Cache prevents scanning of all Realms to find best lexical match.

Server Command Cache

Purpose: Stores Server Commands for configurable amount of time (default 10 seconds) before actually storing them in Policy Store. When changes are made to Policy Store, duplicate commands may be created. Also, “Flush” commands of broader scope overwrite more specific Flush commands. For example, if user initiates “Flush All” command, all other “flush” commands become irrelevant. This is done to decrease overall number of Server Commands.

User Authorization Cache

Purpose: Stores information about policies applied to a given user. When a policy is bound to a user directory object such as a group it is necessary to determine whether a particular user belongs to the group i.e. it is necessary to search the directory to get the user’s membership list. The User Authorization Cache prevents this round trip to the directory. Note that if a policy is bound to a user name (or DN, OU, and O), the Authorization Cache is ineffective because in this case there is no need to search the directory in the first place.

Authentication Cache

Purpose: Stores full response packets for a successful user authentication. Prevents a round trip to the LDAP or ODBC user store in order to authenticate a particular user. There are a number of limitations with this cache

Certificate Revocation List (CRL) cache

Purpose: Stores CRLs. Eliminates search of the CRL Directory during certificate-based authentication.

Type: Unbounded linked list of objects. During successful lookup the “NextUpdate” field of the CRL is checked. If the current time is bigger then the value of that field, the entry is removed.

To create the SiteMinder schema

1. Start the Query Analyzer and log in as the person who administers the Policy Server database.
2. Select the database instance from the database list.
3. Open sm_mssql_ps.sql in a text editor and copy the contents of the entire file.
4. Paste the schema from sm_mssql_ps.sql into the query and execute the query.
The policy and key store schema is added to the database.
5. Open SQLServer.sql in a text editor and copy the contents of the entire file.
6. Paste the schema from SQLServer.sql into the query, and execute the query.
The policy store schema is extended.
7. Repeat steps three and four to use the policy store as an audit logging database. Use the following schema file:
sm_mssql_logs.sql
Note: You are not required to configure the policy store to store additional SiteMinder data. You can configure individual databases to function as a separate audit log database, key store, and session store.
The database can store SiteMinder data.