Technical Notes

If you use SiteMinder version 5.5 or higher to administer single sign-on authentication for multiple applications, Reflection for the Web can be integrated with your SiteMinder installation. This technical note describes the steps to install and configure SiteMinder and Reflection for the Web so that they will work together to provide user authentication.

Supported Versions

• Reflection for the Web versions 8.0 or higher support SiteMinder version 5.5.
• Reflection for the Web version 9.5 introduces support for SiteMinder version 6.0.

Reflection for the Web and SiteMinder

When Reflection for the Web and SiteMinder are configured to work together, users are authenticated using the single sign-on capability of SiteMinder. If preferred, you can configure additional authorization in Reflection for the Web to restrict access to sessions.

To integrate Reflection for the Web and SiteMinder, follow the steps in each of these sections:

1. Install SiteMinder

Install SiteMinder, including the Policy Server and necessary web agents. Refer to the SiteMinder Installation Guides for detailed information about the policy server or the web agents.

2. Install Reflection for the Web

Install Reflection for the Web management server. Automated installers are available for Windows, Solaris, HP-UX, and Linux systems. Follow the steps in the Reflection for the Web Installation Guide, which is available from these locations:

• On the product CD: installguide.html at the root of the CD directory
• In the root directory of the downloaded Reflection for the Web package
• On the Attachmate support site (HTML):

Your next step is dependent on the operating system on which you installed Reflection for the Web.

On Solaris, Linux, AIX, or HP-UX

If you used the automated installer for Solaris, Linux, or HP-UX or did a manual installation to any of these platforms or to AIX using tomcat.zip, continue with step 3. Set the Path to the SiteMinder Libraries.

On Windows

Follow these steps if you used the Windows automated installer or did a manual installation on Windows using tomcat.zip.

1. Verify that the file, msvcp60.dll, is installed on your system.
2. If you do not see this file in your C:\WINNT\system32 folder, download a copy from the Microsoft web site: http://support.microsoft.com/default.aspx?scid=kb;en-us;259403.
3. Continue with step 4. Configure SiteMinder.

3. Set the Path to the SiteMinder Libraries

You must set the path to the SiteMinder libraries if you performed a non-automated (manual) installation on Solaris, Linux, AIX, or HP-UX using tomcat.zip.

Follow the procedure for your operating system. Note: The examples use the default path to the jakarta folder.

The path to the SiteMinder libraries is set in the setenv.sh file, located in the <install path>/Reflection Server/jakarta-tomcat/bin directory.

On Solaris, Linux, AIX, or HP-UX

1. Open <jakarta folder>\bin\setenv.sh and locate this section:

2. In the section specific to your operating system (Solaris, Linux, AIX, or HP-UX), uncomment both the library path statement and the export command.
3. Save the setenv.sh file.

On Windows

The path is already set when you install Reflection for the Web to a Windows platform. Continue with step 4. Configure SiteMinder.

4. Configure SiteMinder

Once the products are installed and the path to the SiteMinder libraries is set, you are ready to configure SiteMinder.

1. Open the SiteMinder Administration console. (In Windows: Start > SiteMinder > Policy Server User Interface.)
2. Select Agents in the left pane under System Configuration (on the System tab) and note the Name of the web agent that you are configuring to work with Reflection.
3. In the Agents Properties dialog box, select the check box to Support 4.x agents, if required for your environment.

• If you select the check box, enter and note the Shared secret. (You will enter the agent name and shared secret when you configure Reflection.)
• If you do not select the check box, SiteMinder defaults to using 5.0 or higher agents.

4. Enter the IP address or host name of the Reflection for the Web server.
5. Save your settings.

If you have SiteMinder version 6.x, you must create a new security realm for Reflection for the Web content.

1. Use the same name for the web agent that you specified in step 4B.
2. Set the Resource filter to /rweb/.
3. Under this realm, create a new security rule, setting the Resource parameter to * .

5. Configure Authentication in Reflection for the Web

Use the Administrative WebStation to configure authentication.

1. Start the Reflection for the Web Administrative WebStation. For more information, see the Reflection for the Web Installation Guide.
2. In the left navigation bar under Tools, click Access Control Setup.
3. On the Access Control Setup - Current Settings page, click Configure.
4. On the Choose Authentication Method page, select SiteMinder, and then click Next.
5. On the Set Up Reflection for SiteMinder page, enter the following.

Policy Server Address	DNS name or IP address of the SiteMinder policy server
Port	Optional port number of the policy server
Admin Name	Name of the administrative account on the policy server
Admin Password	Password of the administrative account on the policy server
Reflection Management Server Address	DNS name or IP address of the Reflection Management server
Host Config Object	Name of the preconfigured host configuration object on the policy server
Host Config Path	Full path to the host configuration file to be created (typically SmHost.conf)

Troubleshooting

If you receive an error while configuring authentication, "Failed to initialize SiteMinder libraries," it may be due to a .dll version conflict. To resolve this issue, you must manually upgrade the smjavaagentapi.jar and smjavaagentapi.dll files. Locate these file in your SiteMinder installation, and copy them to the following Reflection locations:

Once the files have been copied, restart the Reflection for the Web Management Server.

6. Configure Authorization in Reflection for the Web

Once SiteMinder authentication is configured, you can choose to restrict Reflection access to specific users. Follow these steps to configure your authorization preferences.

1. On the Choose Authorization Method page (displays after you configure Authentication), select either method: Allow authenticated users to access published sessions or Use LDAP to restrict access to sessions.

• If you provide access to specific sessions, users can log into SiteMinder and go directly to their sessions.
• If you provide access to the Reflection links list, all users authenticated by SiteMinder have access to all published sessions.

• If you provide access to specific published sessions, users log into SiteMinder and go to their sessions. If the user is not authorized, an error message appears.
• If you provide access to the Reflection links list, you can use the Access Mapper to assign sessions to specific users and groups. Users log into SiteMinder, go to their links list, and then click a link to any session they are authorized to access.

2. After you select an authorization method, click Next.

3. Review your choices on the Confirm Access Control Setting page, and then click Save Settings.

7. Define and Publish Sessions

Use the tools in the Administrative WebStation to define and publish sessions.

1. Click Session Manager in the left navigation bar. Click Add, and follow the steps in the Session Manager to configure sessions.
2. Click Access Mapper in the left navigation bar. If you have chosen to use SiteMinder authentication only, publish the session by selecting the check box next to the session name, and then click Save Settings.

Note: Users must first authenticate using SiteMinder before they can access Reflection for the Web sessions. The SiteMinder web agent downloads a cookie to each user's browser memory, which authenticates them for that browser session only.