Setup Advanced Password Services (APS) in Siteminder to redirect user on auth event with Expired Password?

Products

• SITEMINDER

Issue/Introduction

The steps to enable APS redirect to a specific URL upon user Authentication event with Expired password.

Environment

Component: SMPLC : SITEMINDER -POLICY SERVER
Version: Applicable to all the supported releases

Resolution

To redirect the user to a specific URL upon password Expiration, please follow the below steps 

** 1) It is required to create for each realm protecting the accessed resource the following.


## IN EVERY REALM IN EVERY POLICY DOMAIN, please check the boxes
## labelled "Enable Authentication Events" and "Enable Authorization
## Events". If these boxes are not checked, SiteMinder will not perform
## redirections, even if the rest of the settings are correct. Note
## that there is ONE EXCEPTION: the "Change Password" realm should NOT
## have these events enabled, otherwise users will end up in an 
## infinite loop when attempting to change their passwords.

## The Response for OnAuthReject must have a single response of type
## OnReject-Redirect. This should be an Active Expression using the
## following values (these values are case-sensitive):
##      Library     = smaps
##      Function    = SmApsRedirect
##      Parameters  = (see below)


So create a Rule with action as "Authentication Event"  and Actions as --> OnAuthReject

Once done, create a Policy OnAuthRejectPolicy and add the Rule above to it.

Create a Response as follows --> OnReject-Redirect -->  Active Expression --> Library = smaps, Function = SmApsRedirect (no need to have Parameters populated, just leave it empty) 




** 2) Change the "APS.cfg" to have the following 

NOTE --> Change the path in the below to match the environment 

Define UNPROTECTED_PATH     https://app.example.com/PasswordExpiry.htm  --> This is the URL that the user will be redirected to when Expired password is triggered. 

This can be any URL including a custom page hosted on the server that has link to password change page. 

Expired Redirect=<UNPROTECTED PATH>


** 3) Restart the Policy Server 

** 4) Trigger a flow where the user's password is expired and will get redirected to the URL defined in Step 2 above.

------

Administrators can also configure the environment to send an email to the user at the same time to notify them that their password has expired. To do so, please the following KB Document.

Setup Advanced Password Services in Siteminder (APS) to send email for Expired Password