SiteMinder : Use of SM_SSO_ZONE_NAME with ASA Agent on WebLogic

Products

• CA Single Sign On Secure Proxy Server (SiteMinder)
• CA Single Sign On SOA Security Manager (SiteMinder)
• CA Single Sign-On

Issue/Introduction

Setting the ASA Agent for WebLogic.The SMSESSION cookie prefix using the "SM_SSO_ZONE_NAME" JVM parameters.

Environment

ASA Agent 12.0 for WebLogic

Resolution

The SM_SSO_ZONE_NAME can be changed by setting a Java System Property in the WebLogic startup script. The value of the property is prefixed to Session to form the cookie name. To change the SM_SSO_ZONE_NAME you will need to Delete the provider then restore it after rebooting
WebLogic:

1. Log in to the WebLogic Console;

2. On the left panel, click on Security Realms, then select the realm;

3. Click on Providers tab, then click on SMIdentityAsserter;

4. Go to Provider Specific and record User Name Mapper Attribute string, and SMIdentity Asserter Config File name, for use when you restore the provider;

5. Go back to Providers tab, select SMIdentityAsserter, then click

   "Delete" and save it;

6. Shutdown WebLogic server and edit the WebLogic start script. Add JVM option -DSM_SSO_ZONE_NAME=<EXAMPLE>;

Note : Zone name should be updated as needed.

7. Now start WebLogic and login to the Console;

8. On the left panel, click on Security Realms, then select the realm;

9. Click on Providers tab, click new;

   a. In the Name, give SMIdentityAsserter;
  
   b. In Type drop down list, choose SiteMinderIdentityAsserter. Then
      click OK;
  
   c. In Common tab, click on >> button, then both XYSESSION and X.509
      would be moved to the right list;
  
   d. Click on Provider Specific tab, fill User Name Mapper Attribute
      string and SMIdentity Asserter Config File with previously recorded
      value.