Specify a name to identify the server within the system.

(Optional) Specify a comma-delimited list of backup policy servers.

Specify the agent name configured on the policy server.

Select a SiteMinder server version.

• 5.5 Policy Servers–Supports version 5.5 and version 6.0. This is the default.
• 6.0 Policy Servers–Supports only version 6.0 of the SiteMinder server API.
• 12.0 Policy Servers–Supports only version 12.0.

Specify a default protected resource. If you do not create sign-in policies, the system uses this default URL to set the user’s protection level for the session. The system also uses this default URL if you select the Automatic Sign-In option. If your users are signing in to the “*” URL (default device sign-in page), enter any URL (“/ive-authentication” is the default) to set the protection level to the default value. If you do create sign-in policies, the device uses those sign-in policies instead of this default URL.

You must enter a forward slash (/) at the beginning of the resource. For example, enter /local-authentication.

Select this option if you want the device to prompt the user for a token instead of a password; that is, if users submit tokens or one-time use passwords to the device.

For example, you can use this option to dynamically prompt for a password or token based on sign-in policies by configuring two instances of the same authentication server. You can use one instance for wireless users who have this option enabled and it prompts the user for a token, and another instance for wired users who have this option disabled and it prompts the user for a password.

This feature is available only on Policy Secure.

SMSESSION cookie settings

Select HTTPS to send cookies securely if other Web agents are set up to accept secure cookies, or HTTP to send cookies nonsecurely.

Select HTTPS to send cookies securely if other Web agents are set up to accept secure cookies, or HTTP to send cookies non-securely.

Select this option to automatically sign in users with a valid SMSESSION cookie. Then, select the authentication realm to which the users are mapped. If you select this option, note that:

• If the protection level associated with a user’s SMSESSION cookie is different from the protection level of the realm, the protection level associated with the cookie is used.
• This option uses SMSESSION cookie, which is already present in the browser to enable single sign-on.
• This option provides a single sign-on experience for users.
• This option enables users to sign in using a standard Siteminder Web Agent that generates an SMSESSION cookie.

When you select this option, you must also configure the following suboptions:

• To assign user roles, use this user authentication realm–Select an authentication realm for automatically signed-in users. The users are mapped to a role based on the role mapping rules defined in the selected realm.
• If Automatic Sign In fails, redirect to–Enter an alternative URL for users who sign in through the automatic sign-In mechanism. The users are redirected to the specified URL if the authentication fails and if there is no redirect response from the SiteMinder policy server. If you leave this field empty, users are prompted to sign back in.

Select this option if you want to post user credentials to a standard Web agent that you have already configured rather than contacting the SiteMinder policy server directly.

If you select this option, the Web agent contacts the policy server to determine the appropriate sign-in page to display to the user.

To configure the system to “act like a browser” that posts credentials to the standard Web agent, you must enter the following information.

• Target–Specify the target URL.
• Protocol–Specify the protocol for communication between the system and the specified Web agent. Select HTTP for non-secure communication. Select HTTPS for secure communication.
• Webagent–Specify the name of the Web agent to obtain SMSESSION cookies. An IP address is not allowed for this field. (Specifying the IP address as the Web agent prevents some browsers from accepting cookies.)
• Port– Specify the port for the protocol. Enter port 80 for HTTP or port 443 for HTTPS.
• Path–Specify the path of the Web agent’s sign-in page. The path must start with a backslash (/) character. In the Web agent sign-in page URL, the path appears after the Web agent.
• Parameters– Specify the post parameters to be sent when a user signs in. Common SiteMinder variables that you can use include _ _USER_ _, _ _PASS_ _, and _ _TARGET_ _. These variables are replaced by the username and password entered by the user on the Web agent’s sign-in page and by the value specified in the Target field. These are the default parameters for login.fcc—if you have made customizations, you may need to change these parameters.

This feature is available only on Connect Secure.

Specify an alternative URL that users are redirected to if the device fails to authorize and no redirect response is received from the SiteMinder policy server. If you leave this field empty, users are prompted to sign back into the device.

If you are using an authorization-only access policy , you must enter an alternative URL in this field regardless of whether the Authorize requests against SiteMinder policy server option is selected. Users are redirected to this URL when an access denied error occurs.

Specify the file extensions corresponding to file types that do not require authorization.

Enter the extensions of each file type that you want to ignore, separating each with a comma. For example, enter .gif, .jpeg, .jpg, .bmp to ignore various image types. You cannot use wildcard characters (such as *, *.*, or .*) to ignore a range of file types.

Select this option to retain the bookmarks and individual preferences regardless of which system you log in to.

Specify the interval at which the system polls the SiteMinder policy server to check for a new key.

Control the maximum number of requests that the policy server connection handles before the system ends the connection. If necessary, tune to increase performance. The default setting is 1000.

Specify that the system should look up user attributes on the policy server immediately after authentication to determine if the user is truly authenticated.

For example, if your SiteMinder server authenticates users based on an LDAP server setting, you can select this option to indicate that the system should authenticate users through the SiteMinder server and then authorize them through the LDAP server before granting them access. If the user fails authentication or authorization, the user is redirected to the page configured on the policy server.

Specify the time period for the system to eliminate the overhead of verifying a user’s SMSESSION cookie each time the user requests the same resource by indicating that the system should consider the cookie valid for a certain period of time.

Specify that the value entered in this field must match the accounting port value entered through the Policy Server Management Console in the Web UI. By default, this field matches the policy server’s default setting of 44441.

Specifies that the value entered in this field must match the authorization port value entered through the Policy Server Management Console. By default, this field matches the policy server’s default setting of 44443.

Compare the request method to the methods listed in this parameter. If a match is found, Web Agent does not create a new or update an existing SMSESSION cookie, nor will it make any updates to the cookie provider for that request.

You can enter multiple methods; use a comma to separate method names.

If Overlook Session for Methods parameter is set but not Overlook Session for URLs, then all requests that match the methods defined in this parameter are processed (SMSESSION cookie creation/update is blocked).

If both Overlook Session for Methods and Overlook Session for URLsparameters are set, both the method and the URL of the request are matched before proceeding. Then, all URLs with specified methods are processed (SMSESSION cookie creation/update is blocked).

SiteMinder caching