SiteMinder LDAP User DN Lookup overwritten by a change to Identity Manager (IDM) configuration

Products

• CA Single Sign On Federation (SiteMinder)
• SITEMINDER

Issue/Introduction

You have SM and IDM integrated.  You have discovered that on any change to the IDM configuration (i.e., importing Directory.xml to extend the schema), this somehow overwrites SiteMinder's LDAP User DN Lookup  directory configuration, breaking authentication and authorization for every integrated application until the settings can be manually reset.

How can it be that a change to an external system overwrites SiteMinder settings? 

Environment

• Release : 12.8
• Component : SITEMINDER -POLICY SERVER

Cause

• When an IDM Environment is imported into SiteMinder, an IDM User Directory Definition is created for use with the IDM Environment with a "Description:" of "DO NOT REMOVE - For use by Identity Manager".
• This User Directory Definition should ONLY be used for the IDM integration. This User Directory Definition created by the IDM Import process should not be used in your SiteMinder Domains for your SiteMinder Policies.
• If the IDM Environment is modified with regards to the User Directory configuration, and SiteMinder is updated with this IDM Environment change, it will affect all SiteMinder Domains and Policies that were bound to this IDM Directory Definition.

Resolution

1. Create a separate User Directory Definition for use with the SiteMinder Policies
2. Update the Domains and Policies to use this new Directory Definition.
3. You could create a new User Directory Definition in SiteMinder for your User Policies, and then use the REST API's to script the updates to the Policy Store to switch to the new User Directory for your Domains and Policies.

Refer to the "REST API Reference Documentation"