How to check where in the application code Siteminder is used?

Question

I am migration application from siteminder to shibboleth. So I have to check the application code where all siteminder is used in the code and where I need to make changes. I am new to siteminder and Shibboleth. I need a way to check where siteminder authentication is being used in my application code part. My application is PHP bases application and uses IIS server where siteminder is installed.

Answer 1

Usually for webapplication there is no code required for siteminder protection. You setup policies at police decision point, which is your siteminder policy server and your police enforcement point is your webagent which sits on webserver. The only code you might see in your application is where you app reads the response headers. But that will not give you understanding of which application is protected by siteminder.

Your best bet would be to check the policy server. If you have too many domains and apps than you are out of luck. If your policy server is database and you have understanding of siteminder db schema, you may be able to run some complex join queries to produce the report. I have done that in past with success. If you don't know the db schema or your policy server db is ldap, then you may be able to use api to produce some reports.

But net-net, it's not applications that gives you this information. You will get this information only from policy server or policy store.

I see why you are asking this question the way you are asking. Shibolleth and Siteminder does not work the same way. Shibboleth is policy decision point and you have to write a connector in your app to read the policy decision from shibolleth and enforce it in your app. That is not how siteminder works. Not atleast the standard apps. If you have SAML or OpenID with siteminder then it's different story. Either way, policy server is the place to look into.

Recently I migrated from siteminder 6.x to 12.8 with close to 4000 urls and 400 applications. First thing you need to do is to produce a report from policy server about what is protecting which urls.