# SiteMinder Authorization

## Contents
Overview Prerequisites Configuration

## Overview
CA SiteMinder can authenticate end-users and authorize them to access protected Web resources. The Enterprise Gateway can interact directly with SiteMinder by asking it to make authorization decisions on behalf of end-users that have successfully authenticated to Enterprise Gateway. The Enterprise Gateway then enforces the decisions made by SiteMinder. Important Note: A SiteMinder authentication filter must be configured before a SiteMinder authorization filter is created. In other words, end-users must authenticate to SiteMinder before they can be authorized.
## Prerequisites
CA SiteMinder integration requires CA SiteMinder SDK version 12.0-sp1-cr005 or later. Enterprise Gateway When adding third-party binaries to the Enterprise Gateway, you must perform the following steps: Add the binary files as follows: Add `.jar` files to the `InstallDir/ext/lib` directory. Add `.dll` files to the `InstallDir\win32\lib` directory. Add `.so` files to the `InstallDir/platform/lib` directory. Restart the Enterprise Gateway. Policy Studio When adding third-party binaries to the Policy Studio, you must perform the following steps: Add `.jar` files to the `InstallDir/plugins/thirdparty.runtime.dependencies_6.0.3` directory. Restart the Policy Studio.
## Configuration
Configure the following fields on the SiteMinder Authorization filter: Name: Enter an appropriate name for the filter. Attributes: If the end-user is successfully authorized, the attributes listed here are returned to the Enterprise Gateway and stored in the `attribute.lookup.list` message attribute. They can then be used by subsequent filters in a policy to make decisions on their values. Alternatively, they can be inserted into a SAML attribute assertion so that the target service can apply some business logic based on their values (for example, if role is CEO, escalate the request, and so on). Select the Retrieve attributes from CA SiteMinder checkbox, and click the Add button to specify an attribute to fetch from SiteMinder. If you select the Retrieve attributes from CA SiteMinder checkbox, and do not specify attribute names to be retrieved, all attributes returned by SiteMinder are added to the `attribute.lookup.list` message attribute.