ADF and SiteMinder not working

Question

Hi,
I'm working on a project where the CA SiteMinder Authenticator and IdentityAsserter have been configured in a clustered environment alongside the Default Authenticator and IdentityAsserter. An ADF app using a combination basic J2EE security (isUserInGroup/Role type calls to show/hide tabs depending on user's role) and ADF Security roles and policies (used to lock down task flows to specific roles/groups/users).
The J2EE security call works fine, proving that SiteMinder has populated the security Subject with the correct Principals and authorised correctly.
However, ADF Security does not work at all, even though I can see the groups that originated in the SiteMinder Authenticator in the Enterprise Manager security config screens.
I have mapped the ADF Application Roles to J2EE groups successfully, but when I access the application having successfully logged in as a user who is a member of that group, the taskflows don't show up...
When I run this in a non-clustered WLS environment with only DefaultAuthenticator/IdentityAsserter, all is well, TaskFlows show/hide as expected.
This falls neatly between Oracle and CA in terms of problem solving, can't get much help from either at the moment.
Any thoughts or possible lines of enquiry are welcome.
Edited by: 893022 on 27-Oct-2011 04:23

Answer 1

Hi Frank,
I'm just trying that now - reducing the variables seems like a good plan.
A couple of things we're unsure of:
1. Does ADF support Siteminder R12? My feeling is that the two are probably not related as ADF accesses the security realm via OPSS and the SiteMinder app server agent is an implementation of the WLS SSPIs, which would never be directly accessed from ADF (as far as I can tell).
2. I've seen an example on redstack where an ADF application is deployed into an environment that is configured to use an Acitive Directory provider. There is a step includes that involves editing jps-config.xml on the server to include username.attr and user.login.attr properties to the idstore.ldap service instance. Is there similar any FMW-level config I'd need to do for SiteMinder?
3. When JDeveloper builds the ADF app, it changes the class uses Groups and Users from:
oracle.seurity.jps.internal.core.principals.JpsXmlEnterpriseroleImpl
to:
weblogic.security.principal.WLSUserImpl
We did some debugging on on our app and saw that the SiteMinder 'Groups' that are fed into WLS by the SSPI are actually of a different class althoghether:
com.netegrity.siteminder.weblogic.sspi.auth.SmWLSGroupImpl
I'm building my ADF app with Maven so have used XMLTask to make this change to jazn-data.xml on deploy, but still no joy. ADF just doesn't appear to be able to 'see' the users and groups that have come from SiteMinder providers.