Late in 2011, we started a series of tutorials aimed at illustrating how Layer 7’s SecureSpan Gateways can be used to implement various aspects of the OAuth 2.0 specification as a means for controlling access to enterprise APIs. In this fifth OAuth-focused tutorial, we look at how you can integrate existing CA SiteMinder Single Sign-On (SSO) sessions as part of an OAuth handshake.
For situations where a service subscriber already has an SSO experience provided by CA SiteMinder, the SecureSpan Gateway can be leveraged to enable an application to consume the API on behalf of the subscriber, using OAuth. The objective is to maintain the end user’s SSO experience during the handshake while still complying with the OAuth 2.0 specification.
Tutorial 5: Leverage a CA SiteMinder Session in an OAuth 2.0 Handshake