Integrating siteminder and sun access manager

Hi,
I need to perform the following integration. I have an client which generates a saml assertion using Sun access manager which is consumed by another system which is again having Sun access manager. Now the client wants to move on to Siteminder. Would there be any compatibility issues? Would the recipient system having Sun access manager be able to consume the saml assertion generated by siteminder?
Thanks in advance.

SAML is a standard, therefore you should check SAML versions support in siteminder and do the proper configuration.

Similar Messages

  • Migration from Siteminder DMS to Sun Access Manager

    Hi
    We are working on a project that involves migration of Siteminder and SiteMinder-DMS to Sun Access Manager.
    My concerns are
    1. Do I need any changes to the Directory Tree of the LDAP..?
    2. How do I migrate the policies..>
    3. Does Sun have the exact quivalents(the same coarse grained APIs) as Siteminder-DMS..?
    4. Heard of a tool that can do the migration from Siteminder to Sun Access Manager. How good is the tool and what in its scope and what are its limitations.?
    Thnx
    siva

    I currently reviewing migrating from SiteMinder to Sun Access Manager. I have the same issues as you have had. I would greatly appreciate any feedback on any of these issues. My email address is [email protected] if you prefer to email me directly.

  • Sun Access Manager,Policy Agent 2.2, IIS7?

    Hello everybody
    Is it possible to protect IIS7 with policy agent 2.2 and Sun Access Manager 7.1?
    Policy Agents 3.0 (for Open SSO) works with Sun Access Manager 7.1?
    regards!
    Alex Dávila

    Tanks handat      
    I found
    http://download.oracle.com/docs/cd/E19575-01/820-5816/galtf/index.html
    http://download.oracle.com/docs/cd/E19681-01/821-0267/gfxhz.html#scrolltoc     
    greetings
    alex davila

  • Integrate IdM roles with Sun Access Manager roles

    Hi all,
    I am currently working on a solution involving Sun Identity Manager 7.1 and Sun Access Manager 7.1 as well. We use AM for overall authentication and SSO across the application, and IdM for user provisioning.
    I need to create roles in Identity Manager, and I would like that when I assign a role to a user in Identity Manager, he gets the same role in my Access Manager repository (Sun LDAP). Identity Manager does provide a way to set attribute values in resources when a role is set. Access Manager on the other hand has both dynamic roles, based on an LDAP search, and static roles.
    What are the important differences between static and dynamic roles in AM?
    Does anybody know a good way to propagate roles from Identity Manager to Access Manager?
    Thanks.

    I found answers to my question. I succeeded in setting the Access Manager role from Identity Manager using the nsRoleDN attribute. Here are some references to begin with:
    About directory server roles:
    http://docs.sun.com/app/docs/doc/820-2493/fvbrn?a=view
    Forum thread reference:
    http://forums.sun.com/thread.jspa?threadID=5208694
    Here are roughly the steps I followed to get this working.
    Access Manager roles setup:
    1. In Access Manager, create a new static role named test_role under the identities realm (in Subjects > Role).
    Identity Manager roles setup:
    1. Create a new role in Identity Manager: tab Roles, click New....
    2. Assign the LDAP resource to synchronize the role with.
    3. On the Assigned Resources line, click the Set Attributes Values button. This shows up the attributes listing allowing you to bind your IdM role to your LDAP repository.
    4. Set the attribute nsRoleDN to the LDAP DN of the role that was created in AM (nsRoleDN must be added in the resource attributes mapping before).
    * In the column Value override, select Text.
    * In the column How to set, select Authoritative merge with value, clear existing. (* See IDM Admin guide about this setting, I am still not sure how it reacts with multi-value attributes)
    * In the text box, enter the role DN text (ex: cn=test_role,dc=com).
    5. Save the role. You can now add the role to a user.

  • Integration of sun identity manager with sun access manager

    Hi i am working on integration of sun identity manager 6.0 with SP1 and sun access manager7.0.IDM was deployed on Sun application server 8.1.SAm is installed on SunOneWebserver i am working on windows 2003 server.I downloaded the agent for the application server and installed.
    when i am configuring resource in IDM i am getting following error.
    testconnection failed for resource(s):
    sun access manager could notconnect as user 'amadmin' with specified password==>com.sun.identity.authentication.spi.AuthLoginException:failed to create new AuthenticationContext{0}\n.
    i modified amagent.properties,amconfig.properties and web.xml also
    can any one help me on this.

    Hi i am working on integration of sun identity manager 6.0 with SP1 and sun access manager7.0.IDM was deployed on Sun application server 8.1.SAm is installed on SunOneWebserver i am working on windows 2003 server.I downloaded the agent for the application server and installed.
    when i am configuring resource in IDM i am getting following error.
    testconnection failed for resource(s):
    sun access manager could notconnect as user 'amadmin' with specified password==>com.sun.identity.authentication.spi.AuthLoginException:failed to create new AuthenticationContext{0}\n.
    i modified amagent.properties,amconfig.properties and web.xml also
    can any one help me on this.

  • Siebel Integration with SUN Access Manager

    Hi Guys,
    We are trying to integrate siebel with Sun access Manager.
    I have gone thro the sun site but unable to find any documentation and policy agent to download.
    Please guide me where can i find documenttaion and policy agent software download.
    Thanks
    Regards,
    Mohit

    There is no agent to integrate with Siebel directly. However it should be possible by using Sun web server or IIS agent. Here is an old document that may still apply.
    http://docs.sun.com/source/816-6901-10/Chapter.html#wp19548
    There was more detailed integration document on Siebel web site. But it has been removed after Oracle acquisition (http://www.siebel.com/partners/portal/docs/integrationbriefs/siebel77_sjsam_tib.pdf)
    thanks,
    shivaram

  • Username and password for Sun Access Manager 7.1

    Hi
    Thank you for reading my post
    I ge the new Java Application Platform SDK Update 2 which has access manager and portlet management inside it.
    Can you tell me what is username and password for Sun access Manager 7.1 administration cosole?
    thanks

    with me it was amadmin : admin123
    in the readme file in the addons directory:
    Done! Access the AM server URL and see if the Access Manager is working or not -
    <amserver_protocol>://<amserver_host>:<amserver_port>/amserver
    user : 'amadmin', password : <admin password>
    in a config file i found the password was admin123

  • Integrating windows authentication with Sun ACCESS MANAGER

    Hi,
    I have implemented sun access manager and successfully protected an application (ABC). At present iam using the SDS as the authentication and authorization directory. I login in to the machine using the network username and password which is on AD.
    I want to integrate my authentication/authorization mechanism from SDS to AD. so that when i login into the machine and open application ABC it should not ask me for the credentials; instead allow me to the homepage directly.
    How to do this.
    Thanks in advance
    Maruthi

    Hi!
    Maybe this helps you, it describes how to setup AM and policy agent to handle basic authentication protected sites. While the article is about sharepoint it should work for any application.
    http://developers.sun.com/identity/reference/techart/sharepoint.html
    Christoph

  • BO Authentication with Sun Access Manager

    Post Author: aboucher
    CA Forum: Authentication
    Hi,
    Is there a way to use Sun Access Manager (Role base) with BO. We are using XIR2 but we are willing to move to XIR3 if this version can do this job. I know that BO can be configured with LDAP, AD, Enterprise but is there a Custom choice. Any idea?
    Thanks

    Post Author: TAZ
    CA Forum: Authentication
    So quickly reviewing sun access manager it doesn't seem to be an LDAP server per se. It's more like a portal used for SSO. If that's the case then you would integrate LDAP accounts and then use technology like trusted authentication for SSO from the sun access maanger portal. In that case trusted auth will support just about any front end as long as the user info can be forwarded to us in one of 7 methods. You can read more about trusted authentication in the XIR2 deployment guide
    http://support.businessobjects.com/documentation/product_guides/default.asp
    Integrations of this level typically involvel in depth planning and should probably be done with the assistance of a BO consultant.
    Regards,
    Tim

  • Getting error while opening Sun access manager console

    We are facing problem while accessing console of Sun Access Manager. We got No Page Found error whenever we try to access the Sun Access Manager console. We have tried restarting the directory server and web server but even that doesn�t help us. Following are the error that gets recorded in log files:-
    ERROR: AuthD init() com.iplanet.dpro.session.SessionException: AuthD failed to get auth session
    ERROR: Error creating service session java.lang.NullPointerException

    The ns-slapd.exe process belongs to the Directory Server. You should therefore check if your DS instance is set up properly.
    Michael

  • Securing web services with Sun Access Manager

    Hi!
    I have gone through some documentation about Sun Access Manager, and I'm a little bit confused.
    What I want is to secure some web services which are deployed on a BEA WebLogic 9.1 server (WLS). Two solutions are possible: To install some kind of plugin into WLS or to place some kind of proxy in front of WLS. In both cases, the purpose would be to authenticate the caller based on some kind of ticket (SAML or similar) and authorize access to the web service.
    I have read about the "Sun Java System Access Manager Policy Agent 2.2 for Weblogic 9.1" (those guys really like long names....), but in this documentation web services aren't mentioned at all. They only seem to care about HTTP requests from a browser.
    I have also read about the Policy Agent 2.2 in the documentation called "Sun Java System Access Manager Policy Agent 2.2 Guide for Sun Java System Application Server 9.0/Web Services" (puh...). This document explicitly talks about securing web services the way I want.
    My questions are:
    1) Is it possible to secure WLS based web services in the same way using the Policy Agent for WLS?
    2) Are there any documentation/tutorials/etc?
    Thanks in advance :-)
    Anders

    what you need is a webservices agent that would enable you to "protect" your webservice provider, which I assume is on a BEA weblogic provider.
    the "Sun Java System Access Manager Policy Agent 2.2 for Weblogic 9.1" is "NOT" awebservices agent, but a normal J2EE policy agent.
    So.. having said that. here's what I'd recommend.
    1. install the webservices agent on bea weblogic. (note: NOT the J2EE policy agent)
    2. configure it to use your access manager instance for authentication.
    3. configure your webservices client to use the webservice provider. (note: you'd need the webservices APi's available on the client too... so the quick dirty method would be to install the webservices agent on your client too....) you can later bundle the webservices client independently and provide your"customers" with a webservices client bundle...
    4. voila... your webservices are not "protected" by acces manager ;-)

  • Policy Agent doesn't reset Sun  Access Manager session time idle value

    Hi,
    We have the following setup in our environment:
    - apache web server/web and policy agent 2.2 for apache 2.0.54
    - webmethods portal server (jetty)
    -Sun Access Manager (with Sun Directory Server)
    We use policy agent for authentication purpose only (via Sun Access Manager/LDAP) when the users access the portal. We have custom code that creates session in Sun Access Manager for custom LDAP services. For testing purpose, we configure SAM session to have Max Session Timeout at 120mins and Time Idle at 15mins. I would assume that, after the initial login request, for all subsequent accesses to the portal the policy agent should intercept the request and reset the Time Idle value of SAM session. However, when I monitor time idle value using SAM console, session tab, the time idle value didn't change when the portal user access pages, submit actions, etc. I can see in the debug log of policy agent that requests are being intercepted/processed, but the time idle didn't get reset.
    Does anyone know if this is a bug in configuration or in policy agent itself or am I making the wrong assumption?
    Thanks a lot for the help.

    Thanks for the reply, Shivaram. The issue appears to occur at random time, not accurately at the 3 min interval as you mention. I tested changing this value to 1, theoretically, after one 1 minute of idle time, accessing a link would make the agent reset the time idle value for the user session in SAM, but it didn't even after 3 minutes. This seems to be either a policy agent or system access manager bug.
    We performed a 'vanilla' test using the apache server manual pages (only plain HTML, no POST requests), the pages are protected by the policy agent. At the first login, rwe were prompted to enter credential to be validated by SAM/LDAP, and then a user session is created in SAM session table. We browse around the manual pages, once in a while, certain pages cause the policy agent to reset the time idle. However, revisiting these links after a few minutes doesn't reset the idle value. Caching setting has been disable as well. Could there be or lack of some settings in AMConfig.properties or AMAgent.properties that might have caused this behavior?
    Thanks for all your help,

  • Sun Access Manager Event Sequence

    I have a third party black box piece of hardware that is redirecting browser requests to my server for authentication. I want to utilize the Sun Access Manager to perform these authentications. Do I need to use the Policy Agent, or should I attempt to communicate directly with the Access Manager? What benefit will I gain from including the Policy Agent into the mix?
    If I don't use the policy agent, here is the sequence of events as I understand them:
    1) Browser hits Black Box (BB) for protected information.
    2) BB redirects the browser to me.
    3) Browser sends me a SAML snippet. I decode and inflate the snippet, then send it off to the access manager (AM).
    4) The AM throws an invalid id exception because the user has never logged in.
    5) I catch the invalid id exception, and redirect the browser to the AM login URL. The user enters a valid id and password and hits submit.
    6) ... ?
    Is this correct up to step 5, and what happens after step 5? Any hints would be greatly appreciated.

    Okay, never mind then.

  • Sun Access manager

    Hi all,
    i am developing a sample application using sun access manager.it would be very helpful if anyone could help me out in giving some code examples and help me out in developing a sample web app.I have to use the oracle database to get the users and roles.If anyine could post me some sample code for the same it would be really great of u..
    Thanx in advance,
    Sidharth

    ya thats right.....i tried the purejaasexample given in that...and it worked...but my problem is that....supppose i create an user in my db and then when his authntication is suceeded then can i know from the console who has logged in and all...tell me what is the best example i can try from the samples directory....
    basically i want to create a smaple application using sun access manager and implement it in one of our companys big app

  • Sun Access Manager 7.1 configuration

    I am trying to configure Sun Access Manager 7.1 update 1 on websphere 6.1.0.11 running on windows 2003 server and am getting a crypt error on SunJCE. Any suggestions on how to fix this?
    The thread dump looks like this
    05/16/2008 11:22:00:509 AM EDT: Thread[WebContainer : 2,5,main]
    05/16/2008 11:22:00:509 AM EDT: Thread[WebContainer : 2,5,main]ERROR: Crypt: failed to set password-based key
    java.security.NoSuchProviderException: no such provider: SunJCE
    at sun.security.jca.GetInstance.getService(GetInstance.java:82)
    at javax.crypto.b.a(Unknown Source)
    at javax.crypto.SecretKeyFactory.getInstance(Unknown Source)
    at com.iplanet.services.util.JCEEncryption.setPassword(JCEEncryption.java:377)
    at com.iplanet.services.util.Crypt.createInstance(Crypt.java:139)
    at com.iplanet.services.util.Crypt.<clinit>(Crypt.java:103)
    at java.lang.J9VMInternals.initializeImpl(Native Method)
    at java.lang.J9VMInternals.initialize(J9VMInternals.java:192)
    at com.sun.identity.setup.ServicesDefaultValues.validatePassword(ServicesDefaultValues.java:396)
    at com.sun.identity.setup.ServicesDefaultValues.setServiceConfigValues(ServicesDefaultValues.java:107)
    at com.sun.identity.setup.AMSetupServlet.processRequest(AMSetupServlet.java:307)
    at com.ibm._jsp._configurator._jspService(_configurator.java:221)
    at com.ibm.ws.jsp.runtime.HttpJspBase.service(HttpJspBase.java:85)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:856)
    at com.ibm.ws.webcontainer.servlet.ServletWrapper.service(ServletWrapper.java:989)
    at com.ibm.ws.webcontainer.servlet.ServletWrapper.service(ServletWrapper.java:930)
    at com.ibm.ws.webcontainer.filter.WebAppFilterChain.doFilter(WebAppFilterChain.java:145)
    at com.sun.identity.setup.AMSetupFilter.doFilter(AMSetupFilter.java:89)
    at com.ibm.ws.webcontainer.filter.FilterInstanceWrapper.doFilter(FilterInstanceWrapper.java:190)
    at com.ibm.ws.webcontainer.filter.WebAppFilterChain.doFilter(WebAppFilterChain.java:130)
    at com.ibm.ws.webcontainer.filter.WebAppFilterChain._doFilter(WebAppFilterChain.java:87)
    at com.ibm.ws.webcontainer.filter.WebAppFilterManager.doFilter(WebAppFilterManager.java:761)
    at com.ibm.ws.webcontainer.filter.WebAppFilterManager.doFilter(WebAppFilterManager.java:673)
    at com.ibm.ws.webcontainer.servlet.ServletWrapper.handleRequest(ServletWrapper.java:498)
    at com.ibm.ws.wswebcontainer.servlet.ServletWrapper.handleRequest(ServletWrapper.java:464)
    at com.ibm.wsspi.webcontainer.servlet.GenericServletWrapper.handleRequest(GenericServletWrapper.java:122)
    at com.ibm.ws.jsp.webcontainerext.AbstractJSPExtensionServletWrapper.handleRequest(AbstractJSPExtensionServletWrapper.java:205)
    at com.ibm.ws.webcontainer.webapp.WebApp.handleRequest(WebApp.java:3276)
    at com.ibm.ws.webcontainer.webapp.WebGroup.handleRequest(WebGroup.java:267)
    at com.ibm.ws.webcontainer.WebContainer.handleRequest(WebContainer.java:811)
    at com.ibm.ws.wswebcontainer.WebContainer.handleRequest(WebContainer.java:1455)
    at com.ibm.ws.webcontainer.channel.WCChannelLink.ready(WCChannelLink.java:113)
    at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.handleDiscrimination(HttpInboundLink.java:454)
    at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.handleNewInformation(HttpInboundLink.java:383)
    at com.ibm.ws.http.channel.inbound.impl.HttpICLReadCallback.complete(HttpICLReadCallback.java:102)
    at com.ibm.ws.tcp.channel.impl.AioReadCompletionListener.futureCompleted(AioReadCompletionListener.java:165)
    at com.ibm.io.async.AbstractAsyncFuture.invokeCallback(AbstractAsyncFuture.java:217)
    at com.ibm.io.async.AsyncChannelFuture.fireCompletionActions(AsyncChannelFuture.java:161)
    at com.ibm.io.async.AsyncFuture.completed(AsyncFuture.java:136)
    at com.ibm.io.async.ResultHandler.complete(ResultHandler.java:195)
    at com.ibm.io.async.ResultHandler.runEventProcessingLoop(ResultHandler.java:743)
    at com.ibm.io.async.ResultHandler$2.run(ResultHandler.java:873)
    at com.ibm.ws.util.ThreadPool$Worker.run(ThreadPool.java:1469)
    05/16/2008 11:22:00:509 AM EDT: Thread[WebContainer : 2,5,main]ERROR: JCEEncryption:: not yet initialized

    Have you followed the release notes instructions? There is one specifically about changing JCE:
    http://docs.sun.com/app/docs/doc/819-5899/gdpsl?a=view
    http://docs.sun.com/app/docs/doc/819-4683/gfvfl?a=view
    http://docs.sun.com/app/docs/doc/819-5899/gdxas?a=view
    shivaram

Maybe you are looking for