SSOGEN / Identity providers / SiteMinder SSO With SSOGEN
Integration
SiteMinder SSO With SSOGEN
SiteMinder SSO with SSOGEN is possible when your SiteMinder deployment acts as a SAML 2.0 identity provider, and the same checklist as any SAML provider applies.
SiteMinder SSO with SSOGEN works when SiteMinder can answer SAML 2.0 requests. People who already sign in through SiteMinder keep that sign-in and reach every application SSOGEN protects, including Oracle E-Business Suite, PeopleSoft and JD Edwards behind the SSOGEN Web Agent.
SSOGEN is the service provider and SiteMinder’s federation services are the identity provider.
Your SiteMinder policy store needs no other change for SSOGEN to accept the reply.
This page gives the provider-neutral checklist. The full wizard is in the SAML guide.
What SiteMinder has to send
| Requirement | Detail |
|---|---|
| Signed assertion | SSOGEN always requires it and verifies it against the signing certificate in the metadata |
| Stable NameID | The username is built from it, so a value that changes creates a second account |
| Email attribute | Mapped on the Mapping step by the exact attribute name |
| HTTP-POST for the ACS | The reply goes to SSOGEN’s ACS URL |
| Single-entity metadata | One entity, an https redirect sign-in endpoint and a signing certificate |
Setting it up
- In SSOGEN start Add SAML Provider and copy the SP entity ID, ACS URL and SP metadata URL.
- At SiteMinder, register SSOGEN as a service provider with those values.
- Give SSOGEN the identity provider metadata by Metadata URL, upload or paste.
- Run Mapping, Create provider, Validate and Test, then Try signing in in one browser.
- Activate once the result page shows “It works.”
SiteMinder usually runs inside a private network, so plan to upload the metadata file. SSOGEN rejects a Metadata URL that points at a private address.
What to read on the test result
The result page shows the NameID, the attributes SiteMinder sent and the attributes SSOGEN would keep.
- Email or name is empty. Copy the exact attribute names into the Mapping step.
- The sign-in finished in a different browser. If it finished in a different browser than the one that started the test, run it again in one browser.
| Message | Fix |
|---|---|
| The assertion was addressed to a different service provider | The audience must be the SP entity ID |
| The response came back to a different ACS URL | Use SSOGEN’s ACS URL exactly |
| The assertion is outside its validity window | Correct the clocks; a few minutes are allowed |
| This assertion had already been used | Start the test again and avoid the Back button |
When certificates change and when people sign out
An identity provider replaces its signing certificate periodically. People keep signing in with the old configuration until you activate the new one.
- You gave a Metadata URL. Fetch it again on the provider’s edit page, save a revision, then Validate, Test and Activate.
- You gave a file. Upload the new file the same way.
For sign-out, turn on Also sign out of this provider and choose the IdP SLO URL from the metadata or a custom address.
Without it, signing out of SSOGEN can leave the SiteMinder session open, and the next page signs the person back in.
Set the Post-logout URL to a full https address if you want people to land somewhere other than SSOGEN’s signed-out page.
Questions people ask
Can I keep SiteMinder and add SSOGEN?
Yes, if SiteMinder acts as a SAML identity provider. SSOGEN signs people in through it the same way it does through any SAML provider.
What if SiteMinder is not available as SAML?
SSOGEN is also a complete identity provider with local accounts, a directory, SAML and OpenID Connect, so a third-party provider is optional.
Where to go next
- Checklist. Use the SAML checklist.
- Providers. Compare providers on the hub, or read the identity providers guide.
- Comparison. A row-by-row view of the two products is in SiteMinder vs SSOGEN.
SSOGEN has run in production since 2016. Get trial access to see SiteMinder SSO with your own applications.