How to healthcheck SiteMinder Web Agent

Products

• SITEMINDER
• CA Single Sign On Agents (SiteMinder)
• CA Single Sign On Secure Proxy Server (SiteMinder)
• CA Single Sign-On

Issue/Introduction

This is a generic idea on how to perform a healthcheck against siteminder web agent integrated web servers.

Resolution

There is a difference between checking whether the web server is running vs whether it is functional.

And there is a limitation when checking the logs to determine the web server status because there is a chance no request may land on that web server.

 

There can be many ways but one way is to setup an isolated userstore/domain/realm/rule/response/policy for the healthcheck purpose.

For example, you can create an "OU=HealthCheck" under your LDAP userstore's RootDN and create a test user.

Create a User Directory object in AdminUI such as "OU=HealthCheck,O=example" as BaseDN so only the test user can be found.

Create a Domain and associate only this userstore, create realm and etc.

Authentication can be Basic or HTML authentication which is easy to use for health checks.

Then from the health check server send a request to that protected realm so IsProtected/IsAuthenticated/IsAuthorized calls can be performed.

For example, send "GET /healthcheck/" with Authorization header if Basic Authentication is used. Or do "POST /siteminderagent/forms/login.fcc?TARGET=/healthcheck/" with user credentials.

This confirms whether the agent is functional.