title: Integrating Spring Security with SiteMinder
body: <p>How do you integrate Spring Security with SiteMinder to receive a User and Role?</p>
  
  <p>I have a project setup with Spring Security 'in-memory' and I want to use convert it to accept SiteMinder header with User and Roles. If SiteMinder will send the role of the user (ROLE_READ,ROLE_WRITE) and have the Service layer grant access. How do you convert the in-memory to use SiteMinder?</p>
  
  <p><b>In-Memory User Roles</b></p>
  
  <p>List of users and roles for in-memory</p>
  
  <pre><code>&lt;authentication-manager&gt;
      &lt;authentication-provider&gt;
          &lt;user-service&gt;
              &lt;user name="test" password="test" authorities="ROLE_READ" /&gt;
              &lt;user name="admin" password="admin" authorities="ROLE_READ,ROLE_WRITE" /&gt;
          &lt;/user-service&gt;
      &lt;/authentication-provider&gt;
  &lt;/authentication-manager&gt;
  </code></pre>
  
  <p><B>Service Layer Protection</B></p>
  
  <p>Here the service methods are protected with specific roles</p>
  
  <pre><code>&lt;beans:bean id="testService" class="com.stackoverflow.test" scope="request"&gt;
      &lt;security:intercept-methods&gt;
          &lt;security:protect access="ROLE_WRITE" method="do*"/&gt;
          &lt;security:protect access="ROLE_READ" method="find*"/&gt;
      &lt;/security:intercept-methods&gt;
  &lt;/beans:bean&gt;
  </code></pre>
  
  <p>This source (<a href="https://stackoverflow.com/questions/22844236/spring-security-java-config-for-siteminder">Spring Security Java Config for Siteminder</a>) looks promising but its always assigned role RoleEmployee.</p>