Integrating CA (formerly Netegrity) SiteMinder 6.0 with IBM Lotus Connections 2.0

Integrating CA (formerly Netegrity) SiteMinder 6.0 with IBM Lotus Connections 2.0 Xin BJ Xu IBM Software Group, WPLC Beijing, China Xiao Feng Yu IBM Software Group, WPLC Staff Software Engineer Shanghai, China Patrick Curtin IBM Software Group WPLC Test Infrastructure Engineer Dublin, Ireland October 2008 Copyright International Business Machines Corporation 2008. All rights reserved Abstract: This white paper provides step-by-instructions on how to integrate CA (formerly Netegrity) SiteMinder 6.0 with IBM Lotus Connections 2.0 to provide your users with the security of a single sign-on environment. 1

Contents 1 Introduction...3 2 Create Configuration objects on SiteMinder Policy Server...4 2.1 Create objects for WebAgent...4 2.1.1 Create the Web Agent objects...4 2.1.2 Create an Agent Conf Object...5 2.1.3 Create a Host Conf Object...6 2.2 Create Objects for SiteMinder ASA...8 2.2.1 Create SiteMinder ASA objects...8 2.2.2 Create an Agent Conf Object...9 2.2.3 Create a Host Conf Object...10 2.3 Create a User Directory...11 2.4 Create an Authentication Scheme...12 3 Configure the Domains...13 3.1 Define a Domain for the WebAgent...13 3.2 Define a Domain for the ASA...15 3.3 Define the Realm Definitions for both Domains...15 3.3 Define Rules for the Realms...19 3.4 Create a Policy for the Domain...21 4 Install and configure SiteMinder WebAgent...24 4.1 Install the SiteMinder WebAgent...24 4.2 Configure the SiteMinder WebAgent...27 Add SiteMinder cookie setting...27 4.2.2 Configuring SiteMinder logout...28 4.2.3 Create rewrite rules to map Blogs URLs...29 5 Install and configure SiteMinder ASA...30 5.1 Install SiteMinder ASA...30 5.2 Configure the ASA for WebSphere Application Server...32 6 Update AJAX proxy configurations...32 7 Enable SiteMinder for Lotus Connections...33 8 Troubleshooting...33 9 Conclusion...36 10 Resources...36 11 About the authors...36 2

1 Introduction IBM Lotus Connections is social software for business that empowers you to be more innovative and helps you execute more quickly by using dynamic networks of coworkers, partners, and customers. Computer Associates (formerly Netegrity) SiteMinder is a Web access control product providing Web single sign-on (SSO), centralized policy management for authentication, authorization, and auditing and user entitlement. This white paper describes how to integrate SiteMinder 6.0 (hereafter called SiteMinder ) with Lotus Connections 2.0 to provide your users with the security of an SSO environment. Figure 1 shows a sample Lotus Connections 2.0 cluster deployment environment, in which lccn60-1 is the IBM WebSphere Application Server Network Deployment Manager (DM), SM is SiteMinder, and lccn61-1 and lccn60-2 are the two nodes. For the IBM HTTP Server (IHS), assume it is also installed on lccn60-1. Figure 1. Cluster environment topology Here the SiteMinder Web Agent is hosted on the IHS, lccn60-1, and the SiteMinder Application Server Agent (ASA) is hosted on all three Application servers: lccn60-1, lccn60-2, and lccn61-1. 3

Note that lccn60-1 is used as the example for SiteMinder ASA configuration throughout this paper. To configure SiteMinder to work with your Lotus Connections 2.0 environment, we must first create Configuration objects on the SiteMinder Policy Server and then, for the Lotus Connections environment, we will: 1. Configure the Domains and Realms on the SiteMinder Policy Server. 2. Install and configure the SiteMinder WebAgent. 3. Install and configure the ASA. 4. Update common Ajax proxy configuration files. 5. Enable the SiteMinder WebAgent and ASA. The specific configuration we are using is: SiteMinder Policy Server v6.0 SP5 SiteMinder ASA 6.0 Agent for WebSphere Application Server with CR0006 Hotfix SiteMinder WebAgent v6qmr5-cr011 NOTE: Be sure you are using SiteMinder ASA 6.0 with all the latest updates applied to all SiteMinder components. 2 Create Configuration objects on SiteMinder Policy Server You need to create and configure many Policy Server objects when working with the SiteMinder Policy Server. Some objects represent connections to existing network entries, and the others represent groupings of resources and policies that determine entitlements to those resources. 2.1 Create objects for WebAgent 2.1.1 Create the Web Agent objects 1. To create an Agent, right-click on icon under System Configuration on the System tab of the left-hand pane of the console. Select Create Agent ; the dialog box in figure 2 displays. 4

Figure 2. SiteMinder Agent Properties dialog 2. Fill in the *Name and Description fields with lccn60-1wa and Lotus Connections 2.0, respectively, ensuring the *Name field contains a unique value not used previously for an existing agent on the server. 3. Click OK to save and close. 2.1.2 Create an Agent Conf Object The IBM HTTP Server is Apache based, for which products it is recommended that you create a duplicate of the existing ApacheDefaultSettings Agent Conf Object on the Policy Server and modify the duplicate as appropriate. To do this, follow these steps: 1. To create an Agent Conf object for your HTTP Server, click the icon under System Configuration on the System tab of the left- hand pane of the console. 2. Right-click the "ApacheDefaultSettings Agent Conf object in the Agent Conf Object List in the right-hand pane of the console and select Duplicate Configuration Object. The dialog box in figure 3 displays. 5

Figure 3. Agent Configuration Object Properties dialog 3. Enter a unique name, for example, lccn60-1wa_conf, for the object in the *Name field. 4. Then, in the Configuration Values section, set the following parameters to the values below or to the appropriate value for your server by clicking each parameter and clicking the Edit button: DefaultAgentName: Name given to agent created in above step AllowLocalConfig: Set to Yes CssChecking: Set to No BadUrlChars: remove // and /, %00-%1f, %7f-%ff, and %25 from the default list of Bad Url Characters All other parameters can be left as default. 5. Click OK to save and close. 2.1.3 Create a Host Conf Object First, it is recommended that you create a duplicate of the existing DefaultHostSettings Host 6

Conf Object on the Policy Server and modify the duplicate as appropriate. Then, to create a Host Conf object for your HTTP Server, follow these steps: 1. Click the icon under System Configuration on the System tab of the left-hand pane of the console. 2. Right-click the existing Host Conf object in the Host Conf Object List in the right-hand pane of the console and select Duplicate Configuration Object. The dialog box in figure 4 displays. Figure 4. Host Config Object Properties dialog 3. Enter a unique name and description (optional). 4. Edit the Parameter Value #Policy Server, removing the # sign from the front of the parameter name and entering the IP Address of your Policy server in the appropriate place in the value field. 5. Click OK to save and close. 7

2.2 Create Objects for SiteMinder ASA 2.2.1 Create SiteMinder ASA objects 1. To create an Agent, right click the icon under System Configuration on the System tab of the left-hand pane of the console. Select Create Agent; the dialog box in figure 5 displays. Figure 5. Agent Properties dialog 2. Fill in the *Name and Description fields with lccn60-1asa and Lotus Connections 2.0, respectively, as shown in the figure, ensuring the *Name field contains a unique value not used previously for an existing agent on the server. 3. Click OK to save and close. 8

2.2.2 Create an Agent Conf Object To create an Agent Conf object for your Application Server: 1. Click the icon under System Configuration on the System tab of the left-hand pane of the console. 2. Right-click the IISDefaultSettings Conf object in the Agent Conf Object List in the right-hand pane of the console. Select Duplicate Configuration Object ; the dialog box in figure 6 displays. Figure 6. Agent Configuration Object Properties dialog 3. Enter a unique name for the object, for example, lccn60-1asa_conf, in the *Name field. 4. Then, in the Configuration Values section, set the following parameters to the values below, or to the appropriate value for your server, by clicking each parameter and clicking the Edit button: a. DefaultAgentName: Name given to agent created in above step 9

b. AssertionAuthResource: Set to /siteminderassertion c. AssertbyUserID: Set to true 5. Click OK to save and close. 2.2.3 Create a Host Conf Object To create a Host Conf object for your HTTP Server: 1. Click the icon under System Configuration on the System tab of the left-hand pane of the console. 2. Right-click the existing Host Conf object in the Host Conf Object List in the right-hand pane of the console, select Duplicate Configuration Object, and you see the dialog box in figure 7. Figure 7. Host Configuration Object Properties dialog 3. Enter a unique name, for example, Host_lccn60-1ASA, and description (optional) in the respective fields. 10

4. Click OK to save and close. 2.3 Create a User Directory SiteMinder uses LDAP/Database to authenticate users who access its configurations. Configuring access to an LDAP User Directory on the Policy Server is required so that the policy you set up for your Lotus Connections Server can access and use the appropriate LDAP server to authenticate your Lotus Connections Users. NOTE: The Lotus Connections server must be configured to use the same LDAP repository or at least a LDAP repository that contains the same user information as the LDAP repository accessed by the SiteMinder Policy Server. To create a User Directory, follow these steps: 1. Right-click the icon under System Configuration on the System tab of the left-hand pane of the console and select Create User Directory. The dialog box in figure 8 displays. Figure 8. User Directory Properties dialog 11

2. Enter a unique name and description (optional) in the *Name and Description fields. 3. Set the *Namespace field to LDAP, and enter the fully qualified host name of your LDAP server in the *Servername field. 4. Fill in the LDAP Search and LDAP User DN Lookup fields as appropriate for your LDAP users. 5. Click OK to save and close. NOTE: Depending on your particular LDAP server configuration, you may also need to add in Required Credentials on the Credentials and Connection tab in order for the Policy Server to be able to bind with your LDAP server. Also, if you want to use mail as a login attribute, you can modify the LDAP User DN Lookup parameters. 2.4 Create an Authentication Scheme To create an Authentication Scheme: 1. Right-click the icon under System Configuration on the System tab of the left-hand pane of the console and select Create Authentication Scheme. The dialog box in figure 9 displays. 12

Figure 9. Authentication Scheme Properties dialog 2. Enter a unique name, for example, lccn60-1_scheme, and description (optional) in the fields provided. 3. Select HTML Form Template from the Authentication Scheme Type drop-down box. 4. Enter the Fully Qualified Domain Name of your Web Server in the Web Server Name field. 5. Click OK to save and close. 3 Configure the Domains A policy domain is a logical grouping of resources associated with one or more user directories. Policy domains contain realms, rules, responses, and policies. The resources in a policy domain can be grouped in one or more realms, where a realm is a set of resources with a common security requirement. Access to resources is controlled by rules, which are associated with the realm that contains the resource. 3.1 Define a Domain for the WebAgent 1. On the SiteMinder Policy Server, select Create Domain (see figure 10). 13

Figure 10. Create Domain 2. Enter a unique name (for example, lccn60-1wa_domain) and description (optional) in the fields provided (see figure 11). 3. From the drop-down list at the bottom of the dialog, select the User Directory that you will use in this Domain, and click the Add button to add it to the User Directories tab. 14

Figure 11. Domain Properties dialog 3.2 Define a Domain for the ASA On the SiteMinder Policy Server, select Create Domain and enter a unique name (for example, lccn60-1asa_domain) and description (optional) in the fields provided. Note that you don t need to select a User Directory for this domain. 3.3 Define the Realm Definitions for both Domains To define Realm Definitions for the WebAgent Domain: 1. Right-click the domain you created for the WebAgent and select Create Realm. Figure 12 shows an example of a realm for defined for resource /blogs/atom. 15

Figure 12. Realm Properties dialog 2. Enter a unique name (for example, AtomBlogs) and description (optional) for the Realm. 3. On the Resource tab, in the Agent field, enter the name of the agent that you created in Section 2.1 (here it s lccn60-1wa), or select it from the Lookup listing. 4. Define the Resource Filter as /blogs/atom. 5. Set the Default Resource Protection option to Protected. 6. Leave all other fields on the Resource, Session, and Advanced tabs as default. 7. The only Realm that has an extra change is the Realm that has the Protected Resource /. For this Realm, set the Authentication Scheme to the HTML Forms scheme you created earlier. The realms in tables 1 and 2 must be defined for your Lotus Connections environment: 16

Table 1. Realms with Protected setting 17

Table 2. Realms with Unprotected setting Note that these resources are set as Unprotected due to nature of the notification code, and Waltz-Profiles Integration (WPI) / Waltz-Communities Integration (WCI) and API Service Descriptions URLs. To define Realm Definitions for the ASA Domain: 1. Right-click the domain you created for the ASA and select Create Realm; a dialog similar to that in figure 13 appears. 18

Figure 13. Realm Properties dialog 2. Enter a unique name and description (optional) for the Realm. 3. In the Agent field on the Resource tab, enter the name of the agent that you created for the WebAgent in this environment (here it s lccn60-1asa), or select it from the Lookup listing. 4. Define the Resource Filter as /siteminderassertion. 5. Set the Default Resource Protection option to Protected or Unprotected. 6. Leave all other fields on the Resource, Session, and Advanced tabs as default. 3.3 Define Rules for the Realms Now you must define the rules in table 3 for the Protected Realm created for the WebAgent. To do this, right-click each protected Realm that was created above and select "Create Rule under Realm". 19

Table 3. Rule definitions Rule 1 (see figure 14) Rule 2 (see figure 15) *Name: GetPost Rule *Name: OnAuthAccept Rule Realm: (Whatever realm you are working with) Realm: (Whatever realm you are working with) Resource: * Resource: * Action: Web Agent actions -> Action: Authentication events -> OnAuthAccept Get,Post,Put,Delete When this Rule fires: Allow Access When this Rule fires: Allow Access Enable or Disable this Rule: Enabled Enable or Disable this Rule: Enabled Figure 14. Example Rule 1 20

Figure 15. Example Rule 2 Note that no rules are required for the ASA's Realm. 3.4 Create a Policy for the Domain Now define a Policy to control the domain (Policy for Web Agent, for example): 1. Right-click Policies, under the domain that was created above, and select "Create Policy"; you should see the dialog box shown in figure 16. 21

Figure 16. Policy Properties dialog 2. Enter a unique name for the object in the *Name field. 3. Click the Add/Remove button and, from the dialog that follows, add the Users/Groups/Organizations that will be allowed access to your Lotus Connections environment. In figure 16 above, the entire Organization has been added so all users under this Organization in the LDAP will be allowed access. 4. Select the Rules tab (see figure 17). 22

Figure 17. Rules tab 5. Click the Add/Remove Rules button, to get the window shown in figure 18, and add the rules you created above. 6. Click OK to save the Policy. Figure 18. Available Rules window 23

4 Install and configure SiteMinder WebAgent SiteMinder Web Agent is installed on the Lotus Connections HTTP server. It controls access to Web content and delivers a user's security context, managed by etrust SiteMinder, directly to any Web application being accessed by the user. For Web servers, the Web agent integrates through each Web server s extension API, intercepts all requests for resources (URLs), and determines whether each resource is protected by etrust SiteMinder. NOTE: These instructions are based on SiteMinder WebAgent v6qmr5-cr011. For other versions, refer to the SiteMinder Web Agent s documentation. 4.1 Install the SiteMinder WebAgent To install the WebAgent: 1. Launch the Installation panel and accept the License Agreements. 2. Read the Important Information and click Next. 3. Choose the Install Directory. 4. In the Choose Shortcut Folder screen, you can keep the default setting of SiteMinder (see figure 19). Figure 19. Choose Shortcut Folder screen 5. Review the Install information. 6. Install the WebAgent and restart the system to complete the installation. 7. After restart, choose Programs > SiteMinder > Web Agent Configuration Wizard to 24

launch the Host Registration panel. 8. Choose Yes to continue the Host Registration. 9. Fill in the Admin User Name, Admin Password, and confirm Admin Password fields (see figure 20). Figure 20. Admin Registration screen 10. In the Trusted Host Name and Configuration Object screen (see figure 21) enter the name in the Trusted Host Name field (here we use lccn60-1wa) that will be registered on the SiteMinder Policy Server during the setup procedure. Figure 21. Trusted Host Name and Configuration Object screen 25

11. In the Host Configuration Object field, enter the name (here it s Host_lccn60-1WA) created on the SiteMinder Policy Server. Click Next. 12. On the next screen, enter the SiteMinder Policy Server IP address in the IP Address field, click the Add button, and click Next (see figure 22). Figure 22. Policy Server IP Address screen 13. Select the Web server(s) you wish to configure as Web Agents (see figure 23). Figure 23.Select Web Servers screen 26

14. On the Agent Configuration Object screen (see figure 24), enter the Agent Configuration Object that was created on the Policy Server (here it s lccn60-1wa_conf). Figure 24. Agent Configuration Object screen 15. Choose your SSL Authentication method and click Next. 16. Choose No, I don t want to configure Self Registration and click Next. 17. Review the Web Server Configuration Summary, click Install to continue, and then click Done to finish the installation. 4.2 Configure the SiteMinder WebAgent There are two methods to configure the SiteMinder Web Agent; central agent configuration and local agent configuration. If you are using central agent configuration, configure the settings on the Policy Server; otherwise, the configuration settings can be configured via the LocalConfig.conf file, which resides in the <IHS_INSTALL_LOC>/conf folder. Add SiteMinder cookie setting 1. To do this, set the proper CookieDomain value according to your environment: # CookieDomain specified the domain SMSESSION cookie belongs to CookieDomain="your-domain" 2. Ensure that the CookieDomain value conforms to RFC2109: host minus domain may not contain any dots. For example, assuming the server host name is saturn.cn.ibm.com, the proper domain name should be.cn.ibm.com: 27

CookieDomain=".cn.ibm.com" 3. Set RequireCookies="NO". If you are using on ramps, for instance, Hanover, Office plugin, or Portlet, you must set the RequireCookies setting to NO, so that SiteMinder Web Agent doesn t expect the SMCHALLENGE cookie for basic authentication. 4.2.2 Configuring SiteMinder logout Use these steps to configure the SiteMinder logout: 1. Set LogOffUri to enable SiteMinder logoff. When the Web Agent performs a full logoff, it removes the session cookie from a user s browser. The session cookie is also removed from the local cookie domain and cookie provider domain, which you specify for SSO environments. After clearing the cookies, the Web agent calls the Policy Server and instructs it to remove any session information. At this point, the user is completely logged off. You can use any Lotus Connection feature to serve logout. For example, if Activities is used to serve logout, you must set the LogOffUri settings to Activities logout URI LogOffUri="/activities/service/html/ibm_security_logout". Here is the full list of logout URI for all Lotus Connections features: # LogOffUri="/activities/service/html/ibm_security_logout" # LogOffUri="/blogs/ibm_security_logout" # LogOffUri="/communities/communities/ibm_security_logout" # LogOffUri="/dogear/ibm_security_logout" # LogOffUri="/profiles/ibm_security_logout" # LogOffUri="/homepage/web/ibm_security_logout" 2. Redirect logout request to SiteMinder LogOffUri. Since only one feature is chosen to serve logout, if a user logs out in another feature, the HTTP server needs to redirect the logout request to SiteMinder LogOffUri, to complete the full logout. To do this, you must enable URL rewrite rules. The rewrite rules can be configured in the IBM HTTP server configurations file named httpd.conf that resides in the <IHS_INSTALL_LOC>/conf folder. RewriteEngine On RewriteCond %{REQUEST_URI} /(.*)/ibm_security_logout(.*) RewriteCond %{QUERY_STRING}!=logoutExitPage=<your_logout_url> RewriteRule /(.*)/ibm_security_logout(.*) <LogOffUri>?l ogoutexitpage=<your_logout_url> [noescape,l,r] where <LogOffUri> is the URL that you selected in step 1. The client's browsers will be 28

sent to <your_logout_url> after logging out of Lotus Connections. This URL could be your corporate home page or the Lotus Connections login page. Note that you must add these rules to both the HTTP and HTTPS entries. For instance, if Activities is chosen to serve logout and your corporate home page is http://www.acme.com, the rewrite rule will look like the following: RewriteEngine On RewriteCond %{REQUEST_URI} /(.*)/ibm_security_logout(.*) RewriteCond %{QUERY_STRING}!=logoutExitPage=http://www.acme.com RewriteRule /(.*)/ibm_security_logout(.*) /activities/service/html/ibm_security_logout?l ogoutexitpage=http://www.acme.com [noescape,l,r] This means that all logout requests from Lotus Connections features are served by the Activities feature, and users are all logged out via a unified logoutexitpage as specified in RewriteRule. NOTE: Multiple LogOffUri is not officially supported in SiteMinder, though it proves to work during our tests. We DO NOT recommend using multiple LogOffUri in SiteMinder configurations, but if you choose to do so, simply set the following settings in your LocalConfig.conf file: LogOffUri="/activities/service/html/ibm_security_logout" LogOffUri="/blogs/ibm_security_logout" LogOffUri="/communities/communities/ibm_security_logout" LogOffUri="/dogear/ibm_security_logout" LogOffUri="/profiles/ibm_security_logout" LogOffUri="/homepage/web/ibm_security_logout" 4.2.3 Create rewrite rules to map Blogs URLs In Lotus Connections, there are a couple of feeds in Blogs that cause SiteMinder issues, namely, the following: /blogs/(.*)/feed/entries/atom /blogs/(.*)/feed/comments/atom /blogs/(.*)/feed/tags/atom /blogs/(.*)/api where the (.*) is replaced by the user s login name because SiteMinder cannot handle wildcards. To protect these URLs correctly, the following URL rewrite rules must be enabled in the IBM HTTP Server configurations file httpd.conf that resides in the <IHS_INSTALL_LOC>/conf folder. With the URL rewrite rules, the correct authentication is applied: 29

RewriteRule ^/blogs/(.*)/feed/entries/atom(.*) /blogs/roller-ui/rendering/feed/$1/entries/atom/ [R,L] RewriteRule ^/blogs/(.*)/feed/comments/atom(.*) /blogs/roller-ui/rendering/feed/$1/comments/atom/ [R,L] RewriteRule ^/blogs/(.*)/feed/tags/atom(.*) /blogs/roller-ui/rendering/feed/$1/tags/atom/ [R,L] RewriteCond %{REQUEST_URI}!^/blogs/roller-ui/rendering/(.*) NOTE: Be sure to enable the URL rewrite rules for both HTTP and HTTPS. 5 Install and configure SiteMinder ASA SiteMinder ASA is installed on WebSphere Application Server to secure more fine-grained objects such as servlets, JavaServer Pages (JSPs), or Enterprise Java Bean (EJB) components, which could comprise a full-fledged distributed application. Note that this paper is based on SiteMinder ASA 6.0 Agent for WebSphere Application Server with CR0006 Hotfix. For other versions, please refer to the SiteMinder Web Agent s documentation. 5.1 Install SiteMinder ASA NOTE: In a clustered environment, the SiteMinder ASA should be installed on WebSphere Application Server. Also, before the installation, ensure the correct JCE policy files are copied to the WebSphere Application Server because the Agent must use Java Unlimited Cryptography, or else Host Registration will fail. Now, follow these steps: 1. Launch the installation wizard and accept the License Agreement. 2. Choose the Install location. If Install Directory does not exist, click Yes, Continue to create a new one. 3. Choose the folder in which WebSphere Application Server 6.0 (or other version) is installed. 4. Click Install, and choose Yes, create trusted host to create trusted host. 5. Enter the Host Registration information (see figure 25): Policy Server IP Address: The IP Address of your SiteMinder Policy Server. SM Admin Username: Can be obtained from the Administrator of you SiteMinder Policy Server. SM Admin Password: Can be obtained from the Administrator of you SiteMinder Policy Server. Host Name: The name of the Host you want to register. Host Config Object: Created on the Policy Server. 30

Figure 25. Host Registration screen 6. In the next screen (see figure 26), enter the name for the Agent configuration object name (this is created on the Policy Server). 7. Restart the system to complete the installation. Figure 26.Agent Configuration screen 31

5.2 Configure the ASA for WebSphere Application Server 1. Copy the smagent.properties file from the ASA installation \conf folder over to the WebSphere Application Server profile properties folder, for example, c:\program files\ibm\websphere\appserver\appsvr01\properties. 2. Ensure that your system PATH includes a path the ASA's bin directory (typically c:\smwasasa\bin). 3. Start the WebSphere Administration Console, if not already running, and do the following: a. Select Security > Secure administration, applications, and infrastructure. b. Expand Web Security and click Trust Association. c. Put a check next to Enable Trust Association and click Apply. d. Click Interceptors and delete those you don t require. e. On the Interceptors page, click New. f. Enter the following SiteMinder ASA class name next to Interceptor Classname and click Apply: com.netegrity.siteminder.websphere.auth.smtrustassociationinterceptor g. Save the changes to the master configuration by clicking Save on the next two screens. h. Log out of the Administration Console. 6 Update AJAX proxy configurations To support access to the SiteMinder protected URL through the Ajax proxy, the proxy must be configured to pass along the SiteMinder authentication token. The following declaration should be added to pass SMSESSION cookie: <proxy:cookies> <proxy:cookie>jsessionid</proxy:cookie> <proxy:cookie>smsession</proxy:cookie> </proxy:cookies> 1. To make this change to the proxy configuration file (proxy-config.xml; see table 4 below to determine whether a feature uses this file), open a command window and start the wsadmin command line tool. 2. Then use the following commands to access the Connections configuration and check out the proxy configuration file: execfile("connectionsconfig.py") LCConfigService.checkOutProxyConfig("<working-directory>", "<cell-name>") where <working-directory> is a temporary directory of your choice and <cell-name> is the name of the cell where the Connections feature using the global proxy file is located. 32

3. Edit the file in the working directory to add the SMSESSIONID as described above and then check in the file, using the following command: LCConfigService.checkInProxyConfig("<working-directory>", "<cell-name>") You can find the proxy configuration file for each feature in table 4. Table 4. Proxy configuration file location for each Connections feature 7 Enable SiteMinder for Lotus Connections Finally, after all the configurations are set property, you are ready to enable SiteMinder for your Lotus Connections environment. To do this, follow these steps: 1. In the Local WebAgent Configuration file (WebAgent.conf) of the SiteMinder WebAgent that has been configured with your HTTP server, set the EnableWebAgent parameter to "YES". 2. In the Local WebAgent Configuration file (called ASAAgent-Assertion.conf and typically located in c:\smwasasa\conf) of the SiteMinder ASA that has been configured with your server, set the EnableWebAgent parameter to "YES". 3. Restart all HTTP servers and WebSphere Application Server. 8 Troubleshooting Let s now identify some common issues and how to address them. Issue: Web Agent registration fails on Microsoft Windows 2000. Solution: This is an Operation System special case. For Microsoft Windows 2000, edit the Registry as follows, so the SiteMinder Web Agent can get the HTTP Server s installpath to finish its registration (see figure 27): Name: installpath (1) Type: REG_SZ Data: equal to the Data of variable "installpath" 33

Figure 27. Registry Editor Issue: SiteMinder login pages show up in email notifications. Lotus Connection retrieves email notification templates via HTTP from deployed servers, thus the notification template s URL should be set as Unprotected in the SiteMinder configuration. The notification templates don t contain any sensitive data. Solution: Check the URLs listed in Section 3.3 and make sure they are configured as Unprotected. Issue: User cannot log in when WPI or WCI is enabled. When WPI or WCI is enabled, Lotus Connections will use WPI/WCI to get user or group information. However, WPI/WCI itself works independently of the J2EE Web container and is not able to pass along SiteMinder security tokens. Therefore the URL serves for WPI/WCI need to be set as Unprotected in the SiteMinder configuration. In Lotus Connections, direct access to these two URL will be rejected if there is no Lightweight Third-Party Authentication (LTPA) token provided. Solution: Check the URL /profiles/dsx for WPI and /communities/dsx for WCI and ensure they are configured as Unprotected. Issue: Microsoft Office plug-in doesn t work with SiteMinder environment. When the SiteMinder RequireCookies configuration parameter is set to YES, the SiteMinder agent is expecting to see the SMCHALLENGE cookie when doing basic authentication. But the Office plug-in is not able to accept that cookie, which the SiteMinder agent returns along with an HTTP 401 response. Solution: For the Office plug-in to work with SiteMinder, make sure the RequireCookies parameter is set to NO. 34

Issue: A Lotus Connections feature fails to load feed data from other features. In Connections features, there are widgets that load feed data from other features, and the AjaxProxy is used to proxy the feed load request to avoid cross-site scripting issues. Solution: To work with the SiteMinder environment, the AjaxProxy must be configured to pass along SiteMinder security token SMSESSION. Thus, correct the AjaxProxy configuration for the problematic feature, as described in Section 6 above. Issue: Blogs page footer is replaced by SiteMinder login page. Blogs includes the use page footer via HTTP from the deployed server, and the backend has no knowledge of the SiteMinder security token, thus the footer URL must be configured as Unprotected. This issue is expected to be fixed in a subsequent release. Solution: Check the SiteMinder configuration and set /blogs/nav/footer.html as Unprotected. Issue: The Navigation Bar fails to show the logged-in user s name and instead displays the Logout link when viewed with Microsoft Internet Explorer. The Blogs and Dogear Connections features may exhibit this behavior if there are too many cookies or if the overall cookie size exceeds 4,096 bytes. This can be exacerbated by the presence of the SMSESSION cookie and the WebSphere LTPA cookies. More details on this IE limitation may be found here: http://support.microsoft.com/kb/306070. Solution: Reduce the number of cookies in use. One possible approach is to ensure WebSphere is not configured for backward compatibility for LTPA (remove the use of LtpaToken and only use LtpaToken2). For further details, refer to the IBM WebSphere Application Server information center. Issue: There is no Delete Action available when a user creates the Rules in SiteMinder. Solution: The SiteMinder WebAgent has only the Get, Post, and Put Actions available by default. To add the Delete Action, follow these steps: 1. Log in to the SiteMinder Administration Console. 2. Click the View menu and select the Agent Types menu option. 3. Select the Agent Types option that is now available in the Systems pane. 4. Double-click the Web Agent in the Agent Type list. 5. In the Agent Type Properties dialog box that appears, click the Create button. 6. Type Delete in the New Agent Action dialog, and click OK. 7. Click OK again; the new Action will be saved and available now in the Rules dialog. 35

9 Conclusion This paper has provided detailed instructions on how to integrate Netegrity SiteMinder 6.0 with Lotus Connections, focusing on the special configurations for different components of Lotus Connections on both the Policy Server side and Agent side. 10 Resources Lotus Connections developerworks product page Lotus Connections documentation page CA SiteMinder Web Access Manager WebSphere Application Server information center 11 About the authors Xin BJ Xu is a Software Engineer from the Lotus Connections System Verification Test (SVT) team at IBM China Software Development Lab in Beijing. You can reach him at xuxinbj@cn.ibm.com. Xiao Feng Yu is a Staff Software Engineer with rich Web solutions experience, working at the IBM China Software Development Lab in Shanghai. You can reach him at yuxiaof@cn.ibm.com. Patrick Curtin, an expert in the SiteMinder area, is a WPLC Test Infrastructure Engineer from IBM Software Group in Dublin, Ireland. You can reach him at PCURTIN@ie.ibm.com. Trademarks Domino, IBM, Lotus, and WebSphere are trademarks or registered trademarks of IBM Corporation in the United States, other countries, or both. Windows and Windows 2000 are registered trademarks of Microsoft Corporation in the United States, other countries, or both. Java and all Java-based trademarks and logos are trademarks or registered trademarks of Sun Microsystems, Inc. in the United States, other countries, or both. Other company, product, and service names may be trademarks or service marks of others. 36