User's Manual

Configuring the SiteMinder Policy Server

A SiteMinder administrator must configure the policy server to enable SSO to Hyperion

products.

The configuration process:

● Setting up protection for the Web resources of Hyperion products.

● Configuring a response that adds a custom HTTP header to make the user login name

available to Hyperion applications. The header must include the parameter

HYPLOGIN and

must contain the login name of the authenticated user.

See the “Responses and Response Groups” topic in the Netegrity Policy Design Guide for detailed

information. For example, if you use

cn from an LDAP–enabled user directory as the login name

attribute in the configuration file, the

HYPLOGIN parameter should carry the value of the cn

attribute, which is the login name of the authenticated user. SiteMinder administrators can also

configure the header to

SM_USERLOGINNAME (SMUSER for SiteMinder version 6), the user name

specified by the user during logon.

Configuring the SiteMinder Web Agent

The Web agent is installed on a Web server that intercepts requests for Hyperion application

Web resources, such as JSPs, ASPs, and HTML files on the application server. If these Web

resources are protected, the Web agent issues a challenge to unauthenticated users. When a user

is authenticated, the policy server adds

HYPLOGIN, which carries the login name of the

authenticated user. Thereafter, the HTTP request is passed on to the Web resources of the

Hyperion application, and the login name is extracted from headers.

SiteMinder supports SSO across Hyperion products running on heterogeneous Web server

platforms. If Hyperion products use different Web servers, you must ensure that the SiteMinder

cookie can be passed among Web servers within the same domain. You do this by specifying the

appropriate Hyperion application domain as the value of the

Cookiedomain property in the

WebAgent.conf file of each Web server.

See the “Configuring Web Agents” chapter in the Netegrity SiteMinder Agent Guide.

Note:

Because Shared Services uses basic authentication to protect its content, the Web server that

intercepts requests to Shared Services should enable basic authentication to support SSO with

SiteMinder.

Enabling SiteMinder Authentication in Shared Services

Integration with SiteMinder requires that you enable SiteMinder Authentication in Shared

Services. This can be done from User Management Console or by editing the

CSS.xml file. This

file is located in

HSS_Home

>/config. For example:

C:\Hyperion\deployments\WebLogic9\SharedServices9\config (Windows)

Setting Up SSO from SiteMinder