1

I don't use or have Siteminder, but have to support a customer of our product who wants to use it and therefore want to ask around here how Sitemidner works with IIS.

I have a Linux system that is not to be changed. It can forward the user towards an IIS-page. The URL contains a nounce. That IIS-page then uses e.g. Kerberos based authentication with single sign on. It is very simple and just learns the name of the user (asp.net provides that) and then creates a ticket containing nonce and username and redirects back towards the closed Linux system that is not to be changed.

This works fine using Kerberos or NTLM and Windows integrated authentication.

How would this work with Siteminder? Would they also provide the username of the currently logged in user towards an asp.net application? Would they support redirects?

I'd like them to just have written an ISAPI extension or so that parses their cookies and then lets my simple asp.net page run.

Improve this question
4

The SiteMinder IIS agent is an ISAPI filter/extension. It sits in the web server and passes through requests to the underlying page which no changes required on the page as long as you can look to a header for the authenticated user ID. The agent handles all the redirects for authentication and will preserve the originally requested location so that after authentication the user is sent on to the correct page.

SiteMinder supports a concept called responses. With a response you can set any HTTP header you want. As described above, SM_USER is set by default, but you can also set REMOTE_USER or any other header you would like. Since SiteMinder supports a significant number of authentication schemes, you could continue to use Windows Integrated Authentication with the IIS server.

If you want to get into more details, I'm @tclayton on Twitter.

Improve this answer
1
  • What if only some users are using SiteMinder, but the rest using ADFS or forms auth? Will it just ignore/skip the ISAPI filter? – CloudMeta May 19 '15 at 18:18
1

I believe Site Minder passes the user along as an http header. The default is remote_user, but this can be changed.

Improve this answer
0

(remote_user is no longer the default.) SiteMinder sets SMUSER by default, but you might want to set a custom header explicitly in order to control the format.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.