If I remember correctly, the old way of the CEM plugin to work was to actually create double load on the Siteminder servers. This has been fixed now if I remember correctly, as the key is kept in TIMs memory for decrypting the Siteminder cookie (this is from old memories, I don't have my archives anymore alas ...).
Anyone we could ask for details on that?