Set up for scenario 5, Process overview of scenario 5 – Google Search Appliance Managing Search for Controlled-Access Content User Manual
Page 78

Google Search Appliance: Managing Search for Controlled-Access Content
78
Set Up for Scenario 5
In scenario 5, the sample URL’s server is configured as a cookie cracker, meaning that it can provide
silent authentication and a verified identity for the credential group that is associated with the sample
URL. A 200 response from the sample URL includes the X-Username and/or X-Groups HTTP response
headers.
For scenario 5, set up a cookie authentication rule by specifying a Sample URL.
Because a cookie is provided to the browser when the user logs into the portal, you do not need to
check When sample URL fails, expect the sample page to redirect to a form, and log in to that
form or specify a Redirect URL.
Process Overview of Scenario 5
The following diagram provides an overview of the cookie authentication process in scenario 5. For
explanations of the numbers in the process, see the steps following the diagram.
1.
The user logs in to a system in the enterprise that is connected to the SSO system, such as a portal.
2.
The system authenticates the user and send a cookie to the browser.
3.
When the user requests a secure search, the browser sends a GET message with the cookie to the
search appliance.
4.
The search appliance checks its own session cookie to find out if authentication was previously
completed.
The search appliance sets a session cookie the first time a browser requests a secure search.
5.
If the search appliance’s session cookie is still valid, the authentication phase is complete.
If the search appliance’s session cookie is not valid, the search appliance checks the content server
by using the sample URL to detect if the cookie from the portal is correct.
6.
If the sample URL check is successful, the content server generates a 200 response that includes a
response HTTP header with X-Username:value and/or X-Groups:value and sends it to the search
appliance.
7.
value
becomes a verified identity for the credential group that is associated with the sample URL
and authentication is complete.