有哪些方法可以将 Single Sign On 与 SiteMinder 以及待开发的 java/.Net 定制解决方案集成？
我正在考虑使用 java 或 .NET 构建定制解决方案，并且希望将身份验证层与 SiteMinder 集成。
答：从我目前发现的情况来看，SiteMinder 似乎为外部应用程序提供了某种 API，用于将登录凭据传递给 Siteminder，并且 Siteminder 能够恢复登录凭据是否正确：
=>根据您的经验，您执行此操作时是否存在任何问题？
B. 身份验证后，我设想 SiteMinder 会将登录用户 ID 传递给我要开发的应用程序，该应用程序将搜索数据库以找出与登录用户 ID 关联的角色和功能。这意味着我需要一个数据库表来存储来自 SiteMinder 的用户 ID 列表。
=>有什么方法可以将 siteminder 中的用户 ID 和名称导出到平面文件中吗？我正在考虑设置一个常规数据接口作业，该作业将从 siteminder 中提取用户信息并更新我要开发的应用程序。
I am thinking of building a bespoke solution using either java or .NET and I want to integrate the authentication layer with SiteMinder.
A. From what I have found so far, it seems that SiteMinder provides some kind of APIs for external application to pass the login credentials to Siteminder and Siteminder is able to revert whether the login credentials are correct or not:
=> From your experience, is there any issue when you implement this?
B. After authentication, I envisage SiteMinder would pass the login user ID to my to-be-developed application, which will search the database to find out the roles and functions associated with the login user ID. This means that I would need to have a database table storing the list of user IDs from SiteMinder.
=> Is there any way to export the userIDs and names from siteminder into a flat file? I am thinking of setting up a regular data interface job that will extract user info from siteminder and updating my to-be-developed application.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
如果您不想安装 Web 代理或担心使用 HTTP 标头的安全隐患，您可能需要考虑使用 SAML。 SiteMinder 支持基于 SAML 的用户身份验证，这可能是更容易实施的解决方案。
SAML 是标准 SSO 协议，您应该能够找到许多示例，甚至可能找到可以使用的现成模块。
If you don't want to install a Web Agent or are concerned about the security implications of using HTTP Headers, you might want to look into using SAML. SiteMinder includes support for SAML based user authentication which may be an easier solution to implement.
SAML is a standard SSO protocol, you should be able to find many examples and possibly even a ready built module that can be used.
答：如果您没有义务，我强烈建议您不要使用该 SDK。您的代码与 Siteminder 的联系过于紧密，并且可能会在每次升级 Siteminder 基础设施时中断。在没有其他解决方案时使用SDK。
集成 Siteminder 的更标准方法是在 Web/应用程序服务器上安装 Web 代理/J2EE 代理。 Siteminder 将负责用户的身份验证过程，因此您不必担心密码和向 Siteminder 传递凭据。此身份验证过程对于应用程序来说是完全透明的。
用户通过 Siteminder 身份验证后，Web 代理将向请求添加特定的 HTTP 标头，其中包含用户信息（用户名、电子邮件地址、应用角色、其他信息...）。
应用程序只需在传入的 HTTP 请求中获取并信任这些信息。
B. 您有两种方法可以实现此目的：
来处理它们。
信息。
A. I strongly recommend not to use the SDK if you're not obligated to. Your code will be too tied to Siteminder and might break on every upgrade of the Siteminder infrastructure. The SDK is used when there are no other solutions.
A more standard way to integrate Siteminder would be to install a Web Agent/J2EE Agent on your web/application server. Siteminder will take care of the authentication process of the user, so you don't have to worry about passwords and passing credentials to Siteminder. This authentication process is totally transparent for the application.
Once the user is authenticated by Siteminder, the web agent will add specific HTTP headers to the request with informations on the user (username, email address, applicative roles, other informations...).
The application just has to fetch and trust these informations in the incoming HTTP request.
B. You have two way to achieve this:
to handle them.
informations.
A. 用于创建 SiteMinder 会话的 API，但您需要用户输入凭据
B. SiteMinder 不使用其自己的用户存储库。它被外包给可选的 LDAP 或数据库服务器。因此您无需通过 SiteMinder 即可处理该组件
A. API to create SiteMinder session but you need credential input from user
B. SiteMinder does not use it's own user repository. It is outsourced to optional LDAP or Database servers. So you deal with that component without going thru SiteMinder