SAML Single Sign On Scenarios

There are two main categories of scenarios:

• SP-Initiated: A user attempts to access a protected resource from the service provider
• IdP-Initiated: A user logged on and access the IdP and then access a protected resource from the service provider.

The second case is the one I mentioned earlier as portal.
Here is a web site with a comprehensive list of scenarios.

Siebel Data Security 2

Three types of data security in Siebel:

1. Restrict the access to the data only to the owner.
2. Assign a team to the records. Allow the team members view the records
3. Assign an organization to the records.

For case 1 ad 2, you can grant the access to a user or to a position.

A position is a job title associated with an organization. A manager position can have sub-ordinate positions to form a manager hierarchy. A position can report to a single position.

A position in Siebel is almost the same as the position in E-Business Suite HR. However, they are created for different purposes. The position in EBS HR is mainly for head count budgeting and many EBS HR apps deployments do not use the feature. Using position for security has a major benefit is to keep the data security rule independent from the individuals.

Siebel Data Security 1

Siebel apps uses assigning "responsibility" and "position" to control the secure access for users.

• Responsibilities determines a collection of views the user can see.
• Position determines what data the user can access. Position is the base for row security. A position represents an assigned job title within an organization. It determines a set of records the user can see. An example is North America VP of Sales.

The definition of Responsibility is very similar to the "Responsibility" in E-Business Suite (EBS). It is the base for "function security" using the E-Business Suite term. However, EBS responsibility may determine "data security". Each responsibility can be restricted to access only a single operating unit.