CA eTrust SiteMinder Developer's Guide for Java

More documents

Recommendations

Info

Connection to a Policy Server■■Upgrades from the JNI Java Agent API on Unix systems requires users ofcustom 4.x-based agents that use shared secrets encrypted with the 4.xencryptkey tool to update their shared secret on the agent side forupgraded agents.The pure Java Agent API does not obtain Agent configuration informationfrom the Windows Registry.Connection to a Policy ServerBefore an agent can perform work on behalf of its users, it must initializeconnections to one or more Policy Servers by issuing the init() method.Through the InitDef parameter, you can specify connection parameters suchas failover mode and connection pool size. This step creates TCP connectionsand typically does not need to be done more than once per agent instance.After the Agent API is initialized, all API calls are fully thread-safe with respectto the initialized API instance.It is possible to initialize more than one API instance (for example, whenworking with Policy Servers that use separate policy stores).Immediately after initialization, the agent should communicate its versioninformation to the Policy Server by calling doManagement() with the constantMANAGEMENT_SET_AGENT_INFO set in the ManagementContextDef object.The actual information can be any string containing enough information aboutthe agent, such as the build number, and the version number. The string isrecorded in the Policy Server logs.After the Agent API has been initialized, the agent can perform useful work. Atthis point it can start accepting requests from its users, such as receiving GETrequests for URLs.36 Developer's Guide for Java
User Access to ResourcesUser Access to ResourcesThe agent must perform the following steps before granting a user access to arequested resource. The outcome of most steps can be cached to improveagent performance. The agent can choose to cache as little or as much aspossible.1. Accept a user request.Accept a user request to access a resource. This is the application-specificrequest. For example, the Web Agent would accept a user’s GET requestfor a URL.2. Check if the resource is protected.Call isProtected() to determine if the requested resource is protected.If the resource is protected, the policy server returns the requiredcredentials that must be obtained from the user in order to validate theuser’s identity. If the resource is not protected, access to the requestedresource should be allowed.The outcome of this step can be cached.3. Authenticate the user.Call login() to collect the required credentials from the user and toauthenticate the user.Upon successful authentication, the Policy Server creates a session andreturns response attributes, including the unique session id and sessionspecification. These response attributes are policy-driven and may includeuser profile data, static or dynamic privileges, a number of predefinedauthentication state attributes, or any other data that was designated by apolicy administrator.The agent can now perform session management by caching user sessioninformation and keeping track of session expiration.4. Check if the user is authorized.Call authorize() to validate that the user has access to the requestedresource.Upon successful authorization, the policy server returns responseattributes including resource-specific privileges. These response attributesare policy driven and may include user profile data, static or dynamicprivileges, or any other data that was designated by a policyadministrator.At this point the user’s authorization information with respect to therequested resource is known and can be cached to speed up futurerequests.Chapter 3: Agent API 37
Page 2 and 3: This documentation and any related
Page 5 and 6: ContentsChapter 1: Java API Overvie
Page 7 and 8: Make Policy Management API Requests
Page 9: Set Search Parameters When You Crea
Page 12 and 13: Code SamplesCode SamplesThe SiteMin
Page 14 and 15: Policy Management APIThe SiteMinder
Page 16 and 17: How Java Components Fit TogetherHow
Page 18 and 19: Java API FlowThere are two types of
Page 20 and 21: Java API FlowIf you do not already
Page 22 and 23: Java API FlowYou might already have
Page 24 and 25: Javadoc ReferenceJavadoc ReferenceT
Page 26 and 27: Connection ClassConnection ClassYou
Page 28 and 29: Result ClassInterpret a Result Obje
Page 30 and 31: Property ClassThe core methods of t
Page 32 and 33: Agent API Class HierarchyThe Agent
Page 34 and 35: Implement the Pure Java Agent API5.
Page 38 and 39: User Access to Resources5. Audit ca
Page 40 and 41: Java Agent API ServicesJava Agent A
Page 42 and 43: Authorization ServicesSession Termi
Page 44 and 45: Tunnel ServicesTunnel ServicesTunne
Page 46 and 47: Single Sign-on4. Custom agent creat
Page 48 and 49: Server ClustersAdvantages of Sessio
Page 50 and 51: Server ClustersCluster failover occ
Page 52 and 53: Agent TypeAgent TypeThe Agent Type
Page 54 and 55: About Policy ManagementAbout Policy
Page 56 and 57: Policy Store Objects■■■■■
Page 58 and 59: Write a Policy Management Applicati
Page 60 and 61: Agent Configuration Object MethodsA
Page 62 and 63: General Object MethodsMethoddeleteD
Page 64 and 65: ODBC Query Scheme MethodsODBC Query
Page 66 and 67: Realm MethodsMethoddoImport()Descri
Page 68 and 69: Self-Registration MethodsSelf-Regis
Page 70 and 71: Utility MethodsMethodgetUserPolicie
Page 72 and 73: Retrieve Objects from the Policy St
Page 74 and 75: Authentication Scheme Configuration
Page 81: individuals might increase their in
Page 86 and 87:
Authentication Scheme Configuration
Page 88 and 89:
Page 90 and 91:
Page 92 and 93:
Page 94 and 95:
Page 96 and 97:
Page 98 and 99:
Page 100 and 101:
Page 102 and 103:
Page 104 and 105:
Page 106 and 107:
Page 108 and 109:
Page 110 and 111:
Page 113 and 114:
Chapter 5: Authentication andAuthor
Page 115 and 116:
Shared InformationShared Informatio
Page 117 and 118:
Create a Custom Authentication Sche
Page 119 and 120:
Page 121 and 122:
Page 123 and 124:
Page 125 and 126:
Page 127 and 128:
Use the Authorization API8. After t
Page 129 and 130:
Use the Authorization APIInterpret
Page 131 and 132:
Use the Authorization APIOther Clas
Page 133 and 134:
Use the Authorization APIActive Rul
Page 135 and 136:
Use the Authorization APITo modify
Page 137:
Use the Authorization API■■To e
Page 140 and 141:
The Required JAR File■■Adding a
Page 142 and 143:
Attribute-based DelegationAttribute
Page 144 and 145:
Implementation Class■SiteMinder a
Page 146 and 147:
Search ClassThe objects correspondi
Page 148 and 149:
Write a Directory Management Applic
Page 150 and 151:
Page 152 and 153:
Page 154 and 155:
Page 156 and 157:
Page 158 and 159:
SearchesSet Search Parameters When
Page 160 and 161:
SearchesSet the Search FilterThe se
Page 162 and 163:
SearchesSearch an OrganizationIn th
Page 164 and 165:
User Password StateThe following co
Page 166 and 167:
Restricted Methods■■SmDmsUser.a
Page 168 and 169:
Restricted MethodsMethodsearchForwa
Page 170 and 171:
Authentication Scheme Dialog • 11
Page 172 and 173:
getDmsContext() • 144, 166getDmsD
Page 174 and 175:
organizations in flat directories
Page 176 and 177:
SmApiResult class • 27SmApiSessio
show all

CA eTrust SiteMinder Developer's Guide for Java

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?