Enabling SPNEGO single sign-on for SiteMinder

1. Right-click Apache Default Settings Agent and select Duplicate Configuration Object.
2. Enter the Name and description of the Agent Configuration Object.
3. Update the following parameters to match your environment:

   DefaultAgentName

   Name of the Apache Agent created earlier

   CookieDomain

   your_domain

   where your_domain is your Connections domain. If, for example, the URL is http://activities.example.com/activities, your host name is activities.example.com and your domain is example.com. In this example, you would set CookieDomain=example.com. .

   RequireCookies

   NO

   This parameter configures the Web Agent to support basic authentication but without requiring all API client programs to support cookies.

   BadCSSChars

   <,>

   This parameter enables the Invite colleagues functionality in Profiles.

   LogOffUri

   URI

   Configure SiteMinder to recognize only one web address as the logout web address. Uncomment one of the following URIs by removing the number sign (#) character:

   #LogOffUri="/activities/service/html/ibm_security_logout"

   #LogOffUri="/blogs/ibm_security_logout"

   #LogOffUri="/communities/communities/ibm_security_logout"

   #LogOffUri="/dogear/ibm_security_logout"

   #LogOffUri="/files/ibm_security_logout"

   #LogOffUri="/forums/ibm_security_logout"

   #LogOffUri="/homepage/web/ibm_security_logout"

   #LogOffUri="/moderation/ibm_security_logout"

   #LogOffUri="/news/ibm_security_logout"

   #LogOffUri="/profiles/ibm_security_logout"

   #LogOffUri="/search/ibm_security_logout"

   #LogOffUri="/wikis/ibm_security_logout"

1. Right-click IIS Default Settings Agent and select Duplicate Configuration Object.
2. Enter the Name and description of the Agent Configuration Object.
3. Update the following parameters to match your environment:

   DefaultAgentName

   Name of the Apache Agent created earlier

   CookieDomain

   your_domain

   where your_domain is your Connections domain. If, for example, the URL is http://activities.example.com/activities, your host name is activities.example.com and your domain is example.com. In this example, you would set CookieDomain=example.com. .

   RequireCookies

   NO

   This parameter configures the Web Agent to support basic authentication but without requiring all API client programs to support cookies.

   BadCSSChars

   <,>

   This parameter enables the Invite colleagues functionality in Profiles.

1. Right-click Apache Default Settings Agent and select Duplicate Configuration Object.
2. Enter the Name and description of the Agent Configuration Object.
3. Update the following parameters to match your environment:

   DefaultAgentName

   Name of the Apache Agent created earlier

   CookieDomain

   your_domain

   where your_domain is your Connections domain. If, for example, the URL is http://activities.example.com/activities, your host name is activities.example.com and your domain is example.com. In this example, you would set CookieDomain=example.com.

   AssertionAuthResource

   /siteminderassertion

   AssertbyUserID

   True

4. Check whether the PrevalidateCookie property exists in the Configuration Values as follows:
   • If PrevalidateCookie does exist, click Edit and set it to YES.
   • If PrevalidateCookie does not exist, click Add, add a parameter named PrevalidateCookie, and set it to YES.
   • Click OK and then click OK again to save the parameters.

Maximum Timeout Enabled

2 Hours 0 Minutes

Idle Timeout Enabled

1 Hours 0 Minutes

com.netegrity.siteminder.websphere.auth.SmTrustAssociationInterceptor

• HTTP:

  Listen 8888
  <VirtualHost *:8888>
  	ServerName connections.example.com
  </VirtualHost>

• HTTPS:

  Listen 444
  <VirtualHost *:444>
  	ServerName connections.example.com
  	SSLEnable
  	Keyfile "/opt/IBM/KeyFiles/webserver-key.kdb"
  	SSLStashFile "/opt/IBM/KeyFiles/webserver-key.sth"
  </VirtualHost>

  Save and close the file.

HTTPS: IgnoreHost="connections.example.com:444"

HTTP:IgnoreHost="connections.example.com:8888"

1. In the Integrated Solutions Console on the Deployment Manager, click Environment > Virtual Hosts > default_host > Host Aliases > New.
2. Enter the host name and port of the alias. For example: enter * and 444 for HTTPS, or * and 8888 for HTTP.
   Note: Verify that HTTP Server copied the updated plugin-cfg.xml file to the ibm_http_server_root/Plugins/config/webserver1 directory. The timestamp on the file indicates when it was updated.

1. Check out the LotusConnections-config.xml file. For information about editing configuration files, see the Changing common configuration property values topic.
2. Add 444 or 8888 to each instance of interService URL. For example, change <sloc:interService href="http://connections.example.com"/> to <sloc:interService href="https://connections.example.com:444"/>
3. Save and check in the file.

• execfile("app_server_root/profiles/DMGR/bin/connectionsConfig.py")

  Note: If you are prompted to specify which server to connect to, enter 1.

  LCConfigService.checkOutConfig("working_directory","cell_name")

For example:

LCConfigService.checkOutConfig("c:/temp","foo01Cell01")

1. Configure the custom authenticator to support server-to-server authentication for SiteMinder and SPNEGO:

   LCConfigService.updateConfig("customAuthenticator.name",

   "DefaultAuthenticator")

2. Set the value of the custom.authenticator.cookieTimeout parameter to be equal to or less than the maximum timeout and idle timeout values that you configured earlier. Specify the timeout value in minutes.

   LCConfigService.updateConfig("customAuthenticator.CookieTimeout","timeout"

   where timeout is a value in minutes that is less than or equal to the SiteMinder timeout values.

LCConfigService.checkInConfig()