« Back to LDAP

CA SiteMinder Integration

Introduction #

Computer Associate’s (CA) SiteMinder is a centralized web access management system that enables user authentication and single sign-on, policy-based authorization, identity federation, and auditing of access to Web applications and portals.

Liferay has out of box SiteMinder integration as of version 5.1.2. The integration is based on CAS integration and only supports authenticating with screenName. It also knows how to properly terminate SiteMinder session. SiteMinder is usually connected to a LDAP so this integration is also able to import users from LDAP.

Enabling SiteMinder Integration #

You can enable it either throught portal-ext.properties or UI just like with CAS or OpenSSO.

To enable it through portal-ext.properties just add following sniplet


    1. SiteMinder
  1. Set this to true to enable CA SiteMinder single sign on. If set to true,
  2. then the property "auto.login.hooks" must contain a reference to the class
  3. com.liferay.portal.security.auth.SiteMinderAutoLogin and the
  4. "logout.events.post" must have a reference to
  5. com.liferay.portal.events.SiteMinderLogoutAction for logout to work.


  1. A user may be authenticated from SiteMinder and not yet exist in the
  2. portal. Set this to true to automatically import users from LDAP if they
  3. do not exist in the portal.


  1. Set this to the name of the user header that SiteMinder passes to the
  2. portal.


Enabling through UI just go to Enterprise Admin portlet to Settings -> Authentication -> SiteMinder

SiteMinder integration pre 5.1.2 #

SiteMinder integration does not exist prior to Liferay 5.1.2 release but it is quite easy to create yourself. You can find some information about that from Integration with Siteminder SSO.

1 Attachment
Average (1 Vote)
The average rating is 1.0 stars out of 5.
Threaded Replies Author Date
Nice post. But I'd like to see some... cao wei February 17, 2014 5:49 PM

Nice post.
But I'd like to see some comments/advise on the security.
com.liferay.portal.security.auth.SiteMinderAutoLogin simply looked into the http header, if SM_USER is provide, it assumes this is a request from a login user.
Which means anyone can access any page as an administrator by put admin's user name in the http header, this is a big security flaw right?
How i can ensure the security?
Posted on 2/17/14 5:49 PM.