Product overview · 2 min read
SiteMinder overview
Neutral overview. Twobo Technologies is not affiliated with, sponsored by or a reseller for Broadcom or any other vendor. Product names belong to their owners; check the vendor's own documentation for current editions and licensing.
Short answer
SiteMinder is a long-established web access management product, formerly CA SiteMinder and CA Single Sign-On and now Symantec SiteMinder under Broadcom, which protects web applications through a central policy server and agents or an access gateway, provides SSO sessions across them, and supports federation standards such as SAML.
Key takeaways
- Architecture: policy server plus web agents in web servers, or a proxy-style access gateway.
- The product line moved from CA Technologies to Broadcom when Broadcom acquired CA in 2018.
- Many organizations modernize by fronting legacy apps with OIDC or SAML and retiring agents over time.
Before federation protocols were everywhere, enterprises protected their web applications with web access management. SiteMinder was one of the best-known products, and many large organizations still run it.
How does SiteMinder work?
A central policy server holds policies and authenticates users; agents in web servers, or an access gateway in front of them, enforce those policies on every request.
- A user requests a protected page.
- The agent checks for a valid SiteMinder session cookie.
- Without one, the user is sent to sign in; the policy server authenticates them against a directory.
- The policy server returns a session; the agent sets the cookie and forwards identity headers to the application.
- Later requests are checked against policies, often cached at the agent.
Where does federation come in?
SiteMinder's federation features let it act as a SAML identity provider or service provider, connecting its sessions to external partners and SaaS.
Test assertions it issues with the SAML Decoder.
Who sells it now?
Broadcom, as Symantec SiteMinder.
Netegrity created SiteMinder; CA acquired Netegrity in 2004, renamed the product CA Single Sign-On for a period, and Broadcom acquired CA Technologies in 2018. Broadcom's documentation and support site are the reference for current versions.
How do organizations modernize from web access management?
By putting standards-based federation in front of applications and retiring header-based integration gradually.
- New applications integrate with OpenID Connect or SAML directly.
- Legacy header-based apps go behind an access gateway or identity-aware proxy that speaks OIDC to the IdP and headers to the app.
- Agents are retired as applications move.
The federation guide and platform selection guide cover the target state.
Questions
Is SiteMinder still supported?
Yes. Broadcom sells and supports it as Symantec SiteMinder and publishes release and end-of-life schedules for specific versions on its support site.
What is web access management?
A category of products that enforce authentication and coarse authorization in front of web applications, usually with agents or a proxy and a central policy server, and provide single sign-on through a shared session cookie.