Why does Siteminder webagent for IIS7 require the CGI role to be added (as documented)?

Products

• CA Single Sign On Secure Proxy Server (SiteMinder)
• CA Single Sign On SOA Security Manager (SiteMinder)
• CA Single Sign-On

Issue/Introduction

Description:

For security reasons, Customer would like to avoid activating CGI at all but currently as documented in the Web agent Installation Guide for R12-SP3-

"Before operating a SiteMinder Web Agent on an IIS 7.5 web server, you must configure the web server to use the role services that are required by the SiteMinder Web Agent".

And if the IIS is not configured to use CGI ROLE Services then the Web Agent installation fails with the following Error In Install Logs-

======================
"A fatal error has occurred:
.CGI Module(s) are not installed during IIS 7.0 installation.
ASP.NET, ISAPI Extensions, ISAPI Filters and CGI modules are required in IIS 7.0 during Web Agent configuration"
======================

Solution:

It requires CGI roles to be added for the CGI password services which is the OOTB functionality/feature provided by agent. Customer can remove this if they don't want CGI based password services and instead if they can use FCC based password services.

Environment

Release:
Component: SMIIS