Configuring Sso Authentication Using Siteminder - Cisco PIX 500 Series Configuration Manual

Chapter 37 Configuring Clientless SSL VPN
The following example commands present various possible combinations of modes and arguments.
All Users, IP Address Range, NTLM
To configure auto-signon for all users of clientless SSL VPN to servers with IP addresses ranging from
10.1.1.0 to 10.1.1.255 using NTLM authentication, for example, enter the following commands:
hostname(config)# webvpn
hostname(config-webvpn)# auto-signon allow ip 10.1.1.1 255.255.255.0 auth-type ntlm
All Users, URI Range, HTTP Basic
To configure auto-signon for all users of clientless SSL VPN, using basic HTTP authentication, to
servers defined by the URI mask https://*.example.com/*, for example, enter the following commands:
hostname(config)# webvpn
hostname(config-webvpn)# auto-signon allow uri https://*.example.com/* auth-type basic
Group, URI Range, HTTP Basic and NTLM
To configure auto-signon for clientless SSL VPN sessions associated with the ExamplePolicy group
policy, using either basic or NTLM authentication, to servers defined by the URI mask
https://*.example.com/*, for example, enter the following commands:
hostname(config)# group-policy ExamplePolicy attributes
hostname(config-group-policy)# webvpn
hostname(config-group-webvpn)# auto-signon allow uri https://*.example.com/* auth-type all
Specific User, IP Address Range, HTTP Basic
To configure auto-signon for a user named Anyuser to servers with IP addresses ranging from 10.1.1.0
to 10.1.1.255 using HTTP Basic authentication, for example, enter the following commands:
hostname(config)# username Anyuser attributes
hostname(config-username)# webvpn
hostname(config-username-webvpn)# auto-signon allow ip 10.1.1.1 255.255.255.0 auth-type
basic

Configuring SSO Authentication Using SiteMinder

This section describes configuring the security appliance to support SSO with SiteMinder. You would
typically choose to implement SSO with SiteMinder if your website security infrastucture already
incorporates SiteMinder. With this method, SSO authentication is separate from AAA and happens once
the AAA process completes. If you want to configure SSO for a user or group for clientless SSL VPN
access, you must first configure a AAA server, such as a RADIUS or LDAP server. You can then set up
SSO support for clientless SSL VPN. This section includes:
•
•
•
Task Overview: Configuring SSO with SiteMinder
This section presents an overview of the tasks necessary to configure SSO with SiteMinder SSO. These
tasks are:
OL-12172-03
Task Overview: Configuring SSO with SiteMinder
Detailed Tasks: Configuring SSO with SiteMinder
Adding the Cisco Authentication Scheme to SiteMinder
Cisco Security Appliance Command Line Configuration Guide
Getting Started
37-9