How to expose REST services to support Siteminder authentication & authorization  ?

For username+password you can send them in via Require HTTP Basic or via a POST parameter username+password extracted via XPath. For certificates, I've only used it getting the creds via the "Require TLS client cert auth" for direct connections, it follows similar basic logic to below but X509 as the authenticate and maps to an X509 protected auth scheme in SiteMinder; that way it uses that cred instead of expecting a password; but I imagine you could get a cert via a parameter in order to pass through too.

Can't upload a full policy, but here's a password example logic that might help get started if nobody else has a full policy they can just upload.

Password

• **Pre-req: Agent (e.g., MyAgent) and application object setup in SiteMinder that enforces password log in on the component (e.g., /password)
• Require TLS with client cert auth 
  • At minimum you need to require TLS, but up to you if you'd need client cert auth to use the service or not. 
• Authorize client cert making the call
  • To ensure not just any person can POST user creds to the endpoint.
• Validate form POST for your security reqs (invalid chars, expected params only, etc)
• Set variable ssozone As String to appzone (from SiteMinder whatever you need your SSO Zone to be if you're not using default SM)
• Set variable for agentname as String to MyAgent (set this to the agent mapped to the password component)
• Set variable for resource as String (set this to the resource protected by component /password)
• Set variable for username submitted As String to ${request.http.parameter.username}
• Set variable for password submitted As String ${request.http.parameter.password}
• Set variable for xpathform As Message to <form/>
• ${xpathform}: Require XPath Credential: login = $username, password = $password
  • Right click, choose "SelectTarget Message" and update to Other Context Variable and set to xpathform
• Request: Check Protected Resource Against CA SSO
  • Agent = agentname
  • Protected Resource = resource
  • Action = POST
• ${xpathform}: Authenticate Against CA SSO
  • Right click, choose "SelectTarget Message" and update to Other Context Variable and set to xpathform
  • Properties:
    • Use Last Credentials
    • Supported Credential Types: Username Password
    • SSO Token: Create SSO Token and SSO Zone Name = ${ssozone}
• Request Authorize via CA SSO
  • Properties: User SSO Token from CA Single Sign-On context
• Return Template Response to Requestor
  • Put your response here. Can  use a variable or whatever. So like if I built a JSON response in some fashion would go here with Response Content type = application/json and Response Body = JSON Response variable or manually inputed
    • E.g.,
      {
          "ssotoken" : "${siteminder.smcontext.ssotoken",
          "ssozone" : "${siteminder.smcontext.attributes.ATTR_SSOZONE}",
          "maxtime" :  "${siteminder.smcontext.attributes.ATTR_MAXSESSIONTIMEOUT}",
          "userdn" : "${siteminder.smcontext.attributes.MYAPP_USERDN}", <-- this would be header setup as a response header in SM
          "upn" : "${siteminder.smcontext.attributes.MYAPP_UPN}"   <-- this would be header setup as a response header in SM
      }

Of course you'd want to adjust that to your setup and however you want to make appropriate variables, other security checks (IP whitelist, rate limiting, etc), authentication to the service itself, and anything else ya might need.