SAP Sourcing and CA Siteminder configuration

[isaac_ariza_cruz]

Hello experts,

We have followed the directions specified in document http://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/b03f5cc3-5e1b-3010-6c84-c54202d5c... with exception of Section 2 as we are using Siteminder.

However, we are facing the following issue:

1. When user accesses CLM (https://XXXXXX/sourcing90/fsbuyer/portal/login) they are forwarded to to Siteminder login screen.
2. User logs in
3. User is redirected back to CLM (https://XXXXXX/sourcing90/fsbuyer/portal/login) but is asked to login again using CLM screen.

Any idea regarding what could be happening? OR what additional configuration needs to be done?

We think somewhere between Siteminder and CLM there is some information getting lost and hence the system is asking us to log in again. Do you have any clue regarding what is happening?

Thanks in advance for your time and support.

Best regards,

Isaac

[Former Member · Accepted solution]

Hello Isaac,

See if you can find any clues from the below link:

Regards,

Vignesh

[isaac_ariza_cruz · Accepted solution]

Hi Vignesh,

thanks for your answer. Already checking it.

However, let me include the following information: checking system logs we have discovered that following issue is registered in the system when this issue is raised:

     Logon policies are disabled#

     Flag        Initialize  Login      Commit     Abort      Details 1.

We have forwarded it to the customer's Siteminder team and this is what they have answered us:

Siteminder team cannot say for sure what is happening at SAP side.

As far as federation goes this is the flow.

User access URL at SAP side --> Sap redirects to IDP for authentication (At this point Ping Federate at our end accepts it) --> Ping federate delegates authentication service to Siteminder  (You get logon prompts here) --> after auth request goes back to Ping federate --> Ping federate redirects URL to TargetURL with SAML data.

So you see authentication part is handled by IDP and finally SAML data is sent to SAP. SAP doesn't need to do any authentication of user. SAP has to trust SAML data from IDP and let user access it.

This is whole concept of  federation (IDP-SP). 

Siteminder doesn't need to handle sap token etc.. SAP is talking to Ping federation only. Ping uses Siteminder for authentication.

Any idea taking into account that information?

Thanks a lot again and best regards,

Isaac