Last updated July 31, 2009
The Web Server 7.0 policy agent is a version 3.0 web agent that functions with SunTM OpenSSO Enterprise to protect resources on web servers and web proxy servers deployed on Sun JavaTM System Web Server 7.0.
Contents
For general information about web policy agents, including the new features for version 3.0 agents, see Sun OpenSSO Enterprise Policy Agent 3.0 User’s Guide for Web Agents.
A version 2.2 web agent also exists for Web Server 7.0. However, to use the new version 3.0 agent features, you must deploy the version 3.0 agent described in this guide.
Supported Deployment Containers for the Web Server 7.0 Agent
Compatibility With Access Manager 7.1 and Access Manager 7 2005Q4
The Web Server 7.0 agent is supported on these platforms:
Solaris OS on SPARC platforms, versions 9 and 10 (32–bit/64–bit)
Solaris OS on x86 platforms, versions 9 and 10 (32–bit/64–bit)
Red Hat Enterprise Linux Advanced Server 4.0 and 5.0 (32–bit/64–bit)
Windows 2003, Enterprise Edition (32–bit/64–bit)
Windows 2003, Standard Edition (32–bit/64–bit)
Notes about 32–bit and 64–bit systems:
On 32–bit Solaris SPARC and x86 systems, run Web Server 7.0 web container only in 32–bit mode and install only the 32–bit Web Server 7.0 agent.
On 64–bit Solaris SPARC and x86 systems, run Web Server 7.0 web container only in 64–bit mode and install only the 64–bit Web Server 7.0 agent.
On Windows and Linux systems, run the Web Server 7.0 web container instance in 32–bit mode.
You can deploy the Web Server 7.0 agent on the following deployment containers. The links are to the Web Server documentation collections.
Web Server 7.0 Update 3: http://docs.sun.com/coll/1653.3
Web Server 7.0 Update 2: http://docs.sun.com/coll/1653.2
Web Server 7.0 Update 1: http://docs.sun.com/coll/1653.1
Web Server 7.0: http://docs.sun.com/coll/1308.3
Access Manager 7.1 and Access Manager 7 2005Q4 are compatible with version 3.0 policy agents. However, because Access Manager 7.1 and Access Manager 7 2005Q4 do not support centralized agent configuration, a version 3.0 agent deployed with Access Manager must store its configuration data locally in the OpenSSOAgentBootstrap.properties and OpenSSOAgentConfiguration.properties files. The OpenSSOAgentBootstrap.properties file on the server where the agent is deployed contains the information required for the agent to start and initialize itself.
A version 3.0 agent automatically detects the host server it is accessing. In the case of Access Manager 7.1 or Access Manager 7 2005Q4, a version 3.0 agent will switch to “local” mode and use the properties from the agent's OpenSSOAgentConfiguration.properties file.
OpenSSO Enterprise supports both version 3.0 and version 2.2 agents in the same deployment. The version 2.2 agents, however, must continue to store their configuration data locally in the AMAgent.properties file. And because the version 2.2 agent configuration data is local to the agent, OpenSSO Enterprise centralized agent configuration is not supported for version 2.2 agents. To configure a version 2.2 agent, you must continue to edit the agent's AMAgent.properties file.
For documentation about version 2.2 agents, see http://docs.sun.com/coll/1322.1.
This agent works with the reverse proxy feature built into Sun Java System Web Server 7.0. No separate agent configuration is required. To use the reverse proxy feature, however, ensure that the Web Server 7.0 instance has been upgraded to the most recent release with the latest patches.
Before you install the Web Server 7.0 agent, your deployment must meet these requirements:
A Web Server 7.0 instance must be installed and configured on the platform where you plan to install the agent. For a list of supported platforms, see Supported Platforms for the Web Server 7.0 Agent.
An OpenSSO Enterprise or OpenSSO Express server instance must be installed and accessible to the Web Server 7.0 instance.
The agent installation program requires the Java Runtime Environment (JRE) 1.5 or later. Before you install the agent , set your JAVA_HOME environment variable to point to the JDK installation directory for the JDK version you are using. If you have not set this variable (or if you set it incorrectly), the program will prompt you for the correct path.
Login into the server where you want to install the agent.
Create a directory to unzip the agent distribution file.
Download and unzip the agent distribution file, depending on your platform:
Solaris SPARC systems (32–bit): sjsws_v70_SunOS_sparc_agent_3.zip
Solaris SPARC systems (64–bit): sjsws_v70_SunOS_sparc_64_agent_3.zip
Solaris x86 systems (32–bit): sjsws_v70_SunOS_x86_agent_3.zip
Solaris x86 systems (64–bit): sjsws_v70_SunOS_x86_64_agent_3.zip
Linux systems: sjsws_v70_Linux_agent_3.zip
Windows systems: sjsws_v70_WINNT_agent_3.zip
These distribution files are available from the following sites:
Sun Downloads under Identity Management > Policy Agents: http://www.sun.com/download/index.jsp
OpenSSO project: https://opensso.dev.java.net/public/use/index.html
This agent was developed as part of the OpenSSO project.
The following table shows the files and directories after you unzip the agent distribution file. These files are in the following directory:
AgentHome/web_agents/sjsws_agent, where AgentHome is where you unzipped the agent distribution file.
PolicyAgent-base is the AgentHome/web_agents/sjsws_agent.
For example: /opt/web_agents/sjsws_agent
File or Directory |
Description |
---|---|
README.txt and license.txt |
Readme and license files |
/bin |
agentadmin and agentadmin.bat programs |
/config |
Template, properties, and XML files |
/data |
license.log file. Do not edit this file. |
/etc |
Empty |
/lib |
Required library and JAR files |
/locale |
Required properties files |
/logs |
Log files |
A password file is an ASCII text file with only one line specifying the password in clear text. By using a password file, you are not forced to expose a password at the command line during the agent installation. When you install the Web Server 7.0 agent using the agentadmin program, you are prompted to specify paths to following password files:
An agent profile password file is required for both the agentadmin default and custom installation options.
An agent administrator password file is required only if you use the custom installation option and have the agentadmin program automatically create the agent profile in OpenSSO Enterprise server during the installation.
Create an ASCII text file for the agent profile. For example: ws7agentpw
If you want the agentadmin program to automatically create the agent profile in OpenSSO Enterprise server during the installation, create another password file for the agent administrator. For example: /tmp/agentadminpw
Using a text editor, enter the appropriate password in clear text on the first line in each file.
Secure each password file appropriately, depending on the requirements for your deployment.
A web agent uses an agent profile to communicate with OpenSSO Enterprise server. A version 2.2 web agent can use the default agent profile (UrlAccessAgent). For a version 3.0 agent, however, you must create an agent profile using any of these three methods:
Use the OpenSSO Enterprise Console, as described in Creating an Agent Profile.
Use the ssoadm command-line utility with the create-agent subcommand. For more information about the ssoadm command, see the Sun OpenSSO Enterprise 8.0 Administration Reference.
Choose the “Option to create the agent profile in the server during installation” when you run the agentadmin program.
Login into the OpenSSO Enterprise Administration Console as amAdmin.
Click Access Control, realm-name, Agents, and Web.
Under Agent, click New.
In the Name field, enter the name for the new agent profile.
Enter and confirm the Password.
Important: This password must be the same password that you enter in the agent profile password file that you specify when you run the agentadmin program to install the agent.
In the Configuration field, check the location where the agent configuration properties are stored:
Local: In the OpenSSOAgentConfiguration.properties file on the server where the agent is installed.
Centralized: In the OpenSSO Enterprise server central configuration data repository.
In the Server URL field, enter the OpenSSO Enterprise server URL.
For example: http://openssohost.example.com:8080/opensso
In the Agent URL field, enter the URL for the agent.
For example: http://agenthost.example.com:8090/
Click Create.
The console creates the agent profile and displays the WebAgent page again with a link to the new agent profile.
To do additional configuration for the agent, click this link to display the Edit agent page. For information about the agent configuration fields, see the Console online Help.
If you prefer, you can also use the ssoadm command-line utility to edit the agent profile. For more information, see the Sun OpenSSO Enterprise 8.0 Administration Reference.
An agent administrator can manage agents in OpenSSO Enterprise, including:
Agent management: Use the agent administrator to manage agents either in the OpenSSO Enterprise Console or by executing the ssoadm utility.
Agent installation: If you install the agent using the custom installation option (agentadmin --custom-install) and want to have the installation program create the agent profile, specify the agent administrator (and password file) when you are prompted.
Login to OpenSSO Enterprise Console as amadmin.
Create a new agents administrator group:
Create a new agent administrator user and add the agent administrator user to the agents administrator group:
Click Access Control, realm-name, Subjects, and then User.
Click New and provide the following values:
ID: Name of the agent administrator. For example: agentadminuser
This is the name you will use to login to the OpenSSO Enterprise Console .
First Name (optional), Last Name, and Full Name.
For simplicity, use the same name for each of these values that you specified in the previous step for ID.
Password (and confirmation)
User Status: Active
Click OK.
Click the new agent administrator name.
On the Edit User page, click Group.
Add the agents administrator group from Available to Selected.
Click Save.
Assign read and write access to the agents administrator group:
Login into the OpenSSO Enterprise Console as the new agent administrator. The only available top-level tab is Access Control. Under realm-name, you will see only the Agents tab and sub tabs.
Installing the Web Server 7.0 Agent Using the agentadmin Program
Considering Specific Deployment Scenarios for the Web Server 7.0 Agent
The following table describes the information you will need to provide when you run the agentadmin program to install Web Server 7.0 agent. For some agentadmin prompts, you can accept the default value displayed by the program, if you prefer.
Table 1 Information Required to Install the Web Server 7.0 Agent
Prompt Request |
Description |
---|---|
Sun Java System Web Server Config Directory Path |
Complete path to the directory used by Web Server to store its configuration files. For example: /opt/sun/webserver7/https-agenthost/config |
OpenSSO Enterprise URL |
For example: http://openssohost.example.com:8080/opensso |
Agent URL |
For example: http://agent.example.com:8090 |
Agent Profile Name |
A policy agent communicates with OpenSSO Enterprise server using the name and password in the agent profile. For information, see Creating an Agent Profile. For example: WS7Agent |
Agent Profile Password File |
ASCII text file with only one line specifying the agent profile password. You create the agent profile password file as a pre-installation step. For information, see Creating a Password File. |
Option to create the agent profile The agentadmin program displays the following prompt if the agent profile previously specified for the Agent Profile Name prompt does not already exist in OpenSSO Enterprise: Enter true if the Agent Profile is being created into OpenSSO Enterprise by the installer. Enter false if it will be not be created by installer. |
To have the installation program create the agent profile, enter true. The program then prompts you for:
|
Login into the server where you want to install the agent.
Important: To install the agent, you must have write permission to the files and directories for the Web Server 7.0 instance.
Stop the Web Server 7.0 instance.
Change to the following directory:
PolicyAgent-base/bin
Start the agent installation. For example:
# ./agentadmin --custom-install
On Windows systems, run the agentadmin.bat program.
Enter information as requested by the agentadmin program, or accept the default values displayed by the program.
After you have made your choices, the agentadmin program displays a summary of your responses. For example:
----------------------------------------------- SUMMARY OF YOUR RESPONSES ----------------------------------------------- Sun Java System Web Server Config Directory : /opt/SUNWwbsvr7/https-agenthost/config OpenSSO server URL : http://openssohost.example.com:8080/opensso Agent URL : http://agenthost.example.com:8090 Agent Profile name : WS7Agent Agent Profile Password file name : /tmp/ws7agentpw Agent Profile will be created right now by agent installer : true Agent Administrator : amadmin Agent Administrator's password file name : /tmp/amadminpw Verify your settings above and decide from the choices below. 1. Continue with Installation 2. Back to the last interaction 3. Start Over 4. Exit Please make your selection [1]:
Verify your choices and either continue with the installation (selection 1, the default) , or make any necessary changes.
If you continue, the program installs the agent and displays a summary of the installation. For example:
SUMMARY OF AGENT INSTALLATION ----------------------------- Agent instance name: Agent_001 Agent Bootstrap file location: /opt/web_agents/sjsws_agent/Agent_001/config/OpenSSOAgentBootstrap.properties Agent Configuration Tag file location /opt/web_agents/sjsws_agent/Agent_001/config/OpenSSOAgentConfiguration.properties Agent Audit directory location: /opt/web_agents/sjsws_agent/Agent_001/logs/audit Agent Debug directory location: /opt/web_agents/sjsws_agent/Agent_001/logs/debug Install log file location: /opt/web_agents/sjsws_agent/installer-logs/audit/custom.log Thank you for using Sun OpenSSO Enterprise Policy Agent. INSTALL NOTE: Installer modifies obj.conf file in the config directory you specified. To make agent changes effective do Pull and deploy configuration using Web Server Admin Console or CLI. If there are multiple obj.conf files already present, then manually add agent settings to the required obj.conf files. UNINSTALL NOTE: Uninstall removes agent settings from obj.conf file in the config directory you specified. If there are multiple obj.conf files configured manually in the same config directory, then please remove them manually. For more information, please refer agent documentation.
All files are under the PolicyAgent-base directory.
After the installation finishes successfully, if you wish, check the installation log file in the following directory:
PolicyAgent-base/logs/audit
Restart the Web Server 7.0 instance that is being protected by the policy agent.
************************************************************************ Welcome to the Sun OpenSSO Enterprise Policy Agent for Sun Java System Web Server. ************************************************************************ Enter the complete path to the directory which is used by Sun Java System Web Server to store its configuration Files. This directory uniquely identifies the Sun Java System Web Server instance that is secured by this Agent. [ ? : Help, ! : Exit ] Enter the Sun Java System Web Server Config Directory Path [/var/opt/SUNWwbsvr7/https-agenthost.example.com/config]: /opt/SUNWwbsvr7/https-agenthost/config Enter the URL where the OpenSSO server is running. Please include the deployment URI also as shown below: (http://opensso.sample.com:58080/opensso) [ ? : Help, < : Back, ! : Exit ] OpenSSO server URL: http://openssohost.example.com:8080/opensso Enter the Agent URL as shown below: (http://agent1.sample.com:1234) [ ? : Help, < : Back, ! : Exit ] Agent URL: http://agenthost.example.com:8090 Enter the Agent profile name [ ? : Help, < : Back, ! : Exit ] Enter the Agent Profile name: WS7Agent Enter the path to a file that contains the password to be used for identifying the Agent. [ ? : Help, < : Back, ! : Exit ] Enter the path to the password file: /tmp/ws7agentpw Enter true if the Agent Profile is being created into OpenSSO by the installer. Enter false if it will be not be created by installer. [ ? : Help, < : Back, ! : Exit ] This Agent Profile does not exist in OpenSSO server, will it be created by the installer? (Agent Administrator's name and password are required) [true]: Agent Administrator is the Administrator user that can create, delete or update agent profile. [ ? : Help, < : Back, ! : Exit ] Enter the Agent Administrator's name: amadmin Enter the path to a file that contains the password of Agent Administrator [ ? : Help, < : Back, ! : Exit ] Enter the path to the password file that contains the password of Agent Administrator: /tmp/amadminpw ----------------------------------------------- SUMMARY OF YOUR RESPONSES ----------------------------------------------- Sun Java System Web Server Config Directory : /opt/SUNWwbsvr7/https-agenthost/config OpenSSO server URL : http://openssohost.example.com:8080/opensso Agent URL : http://agenthost.example.com:8090 Agent Profile name : WS7Agent Agent Profile Password file name : /tmp/ws7agentpw Agent Profile will be created right now by agent installer : true Agent Administrator : amadmin Agent Administrator's password file name : /tmp/amadminpw Verify your settings above and decide from the choices below. 1. Continue with Installation 2. Back to the last interaction 3. Start Over 4. Exit Please make your selection [1]: Creating directory layout and configuring Agent file for Agent_001 instance ...DONE. Reading data from file /tmp/ws7agentpw and encrypting it ...DONE. Generating audit log file name ...DONE. Creating tag swapped OpenSSOAgentBootstrap.properties file for instance Agent_001 ...DONE. Creating the Agent Profile WS7Agent ...DONE. Creating a backup for file /opt/SUNWwbsvr7/https-agenthost/config/obj.conf ...DONE. Creating a backup for file /opt/SUNWwbsvr7/https-agenthost/config/magnus.conf ...DONE. Adding Agent parameters to /opt/SUNWwbsvr7/https-agenthost/config/magnus.conf file ...DONE. Adding Agent parameters to /opt/SUNWwbsvr7/https-agenthost/config/obj.conf file ...DONE. SUMMARY OF AGENT INSTALLATION ----------------------------- Agent instance name: Agent_001 Agent Bootstrap file location: /opt/web_agents/sjsws_agent/Agent_001/config/OpenSSOAgentBootstrap.properties Agent Configuration Tag file location /opt/web_agents/sjsws_agent/Agent_001/config/OpenSSOAgentConfiguration.properties Agent Audit directory location: /opt/web_agents/sjsws_agent/Agent_001/logs/audit Agent Debug directory location: /opt/web_agents/sjsws_agent/Agent_001/logs/debug Install log file location: /opt/web_agents/sjsws_agent/installer-logs/audit/custom.log Thank you for using Sun OpenSSO Enterprise Policy Agent. INSTALL NOTE: Installer modifies obj.conf file in the config directory you specified. To make agent changes effective do Pull and deploy configuration using Web Server Admin Console or CLI. If there are multiple obj.conf files already present, then manually add agent settings to the required obj.conf files. UNINSTALL NOTE: Uninstall removes agent settings from obj.conf file in the config directory you specified. If there are multiple obj.conf files configured manually in the same config directory, then please remove them manually. For more information, please refer agent documentation.
Agent Instance Directory: The installation program creates the following directory for each Web Server 7.0 agent instance:
PolicyAgent-base/Agent_nnn
where nnn identifies the agent instance as Agent_001, Agent_002, and so on for each additional agent instance.
Each agent instance directory contains the following subdirectories:
/config contains the configuration files for the agent instance, including OpenSSOAgentBootstrap.properties and OpenSSOAgentConfiguration.properties.
/logs contains the following subdirectories
/audit contains local audit trail for the agent instance.
/debug contains the debug files for the agent instance when the agent runs in debug mode.
Installing the Web Server 7.0 Agent on Multiple Web Server 7.0 Instances
Installing Web Server 7.0 Agent on the OpenSSO Enterprise Host Server
After you install the Web Server 7.0 agent for a specific Web Server 7.0 instance, you can install the agent on another Web Server 7.0 instance by executing the agentadmin program again for that instance.
Installing the Web Server 7.0 agent on the OpenSSO Enterprise host server is not recommended in a production deployment because performance can be degraded.
However, if you do install the agent on the OpenSSO Enterprise host server on the same Web Server 7.0 instance, add the URLs related to OpenSSO Enterprise to the not enforced URL list. If you are installing the agent on a different Web Server 7.0 instance, configuration of the not enforced URL list is not required.
Login into the Administration Console as amAdmin.
Click Access Control, realm-name, Agents, Web, then the name of the agent you want to configure.
The Console displays the Edit page for the agent.
Click Application.
Under Not Enforced URL Processing, add the URLs related to OpenSSO Enterprise to the Not Enforced URLs list.
Click Save.
When you install the Web Server 7.0 agent, the agent installer modifies the Web Server obj.conf configuration file. Whenever changes are made to the Web Server configuration, you should replicate the changes into the Web Server 7.0 Administration server repository.
Log in to the Web Server 7.0 Console as an administrator.
By default, the Common Tasks tab is selected.
Under Configuration Tasks, if the Web Server configuration you are protecting with the agent is not selected, select it from the drop-down list.
Click Edit Configuration.
Click the name of the Web Server configuration you are protecting with the agent.
In the upper right corner of the window, click the Instance Configuration Modified link.
In the Configuration Deployment window, select Pull and deploy configuration from ....
Ensure that the correct Web Server configuration is selected.
Click OK.
After you install the agent, you can change the agent profile password, if required for your deployment.
On the OpenSSO Enterprise server:
On the server where the Web Server 7.0 agent is installed:
In the agent profile password file, replace the old password with the new unencrypted password.
Change to the PolicyAgent-base/bin directory.
Encrypt the new password using the agentadmin program. For example:
#./agentadmin --encrypt Agent_002 /tmp/ws7agentpw
Agent_002 is the agent instance whose password you want to encrypt.
passwd is the password file in the /tmp directory.
The agentadmin program returns the new encrypted password. For example:
The encrypted value is: /54GwN432q+MEnfh/AHLMA==
In the agent-instance/config/OpenSSOAgentBootstrap.properties file, set the following property to the new encrypted password from the previous step. For example:
com.sun.am.policy.am.password=/54GwN432q+MEnfh/AHLMA==
Restart the Web Server 7.0 instance that is being protected by the policy agent.
If you specify the https protocol for the OpenSSO Enterprise server during the Web Server 7.0 agent installation, the agent is automatically configured and ready to communicate to the OpenSSO Enterprise server over Secure Sockets Layer (SSL). However, to ensure that the Web Server 7.0 agent is configured for SSL communication to the server, follow these tasks:
The root CA certificate that you install on the remote Web Server 7.0 instance must be the same certificate that is installed on the OpenSSO Enterprise server.
To install the OpenSSO Enterprise root CA certificate on Web Server 7.0, see the Web Server 7.0 Update 3 documentation: http://docs.sun.com/coll/1653.3
Add the Web Server 7.0 root CA certificate to the OpenSSO Enterprise certificate database.
Mark the root CA certificate as trusted to enable OpenSSO Enterprise to successfully send notifications to the Web Server 7.0 agent.
By default, an agent installed on a remote Web Server 7.0 instance trusts any server certificate presented over SSL by the OpenSSO Enterprise host. The web agent does not check the root CA certificate. If the OpenSSO Enterprise host is SSL-enabled and you want the Web Server 7.0 agent to perform certificate checking, you can disable this behavior.
In the Web Server 7.0 agent's OpenSSOAgentBootstrap.properties file, set the following properties, depending on the requirements for your deployment.
Note: These properties have new names for version 3.0 web agents.
Disable the option to trust server certificate sent over SSL by the OpenSSO Enterprise host:
com.sun.identity.agents.config.trust.server.certs = false
Set the certificate database directory. For example:
com.sun.identity.agents.config.sslcert.dir = /var/opt/SUNWwbsvr7/https-agent-host.example.com/config
If the certificate database directory has multiple certificate databases, set the following property to the prefix of the database you want to use. For example:
com.sun.identity.agents.config.certdb.prefix = https-agent-host.example.com.host-
Set the certificate database password:
com.sun.identity.agents.config.certdb.password = password
Set the certificate database alias:
com.sun.identity.agents.config.certificate.alias = alias-name
Only the Web Server 7.0 agent supports POST data preservation. Other web agents do not support this feature. POST data is submitted to Web Server 7.0 through HTML forms before users log into OpenSSO Enterprise. An HTML page containing the HTML form should be in the not enforced list. By default, POST data preservation is disabled.
Login to the OpenSSO Enterprise Console as amadmin.
Click Access Control, realm-name, Agents, Web, and then the name of the agent you want to configure.
Click Advanced, and then Sun Java System Web Server.
For POST Data Preservation, check Enabled.
For POST Data Entries Cache Period, specify a value in minutes, if you want a value other than the default value of 10.
This value determines the time in minutes that POST data is valid in the Web Server 7.0 cache.
Click Save.
These values are hot-swappable, which means you don't have to restart Web Server 7.0 after you set them. Any changes done in the Console are not reflected in the agent's local configuration file (and vice versa).
By default, OpenSSO Enterprise stores version 3.0 policy agent configuration data (as well as server configuration data) in a centralized data repository. You manage this configuration data using these options:
OpenSSO Enterprise Administration Console
You can manage both version 3.0 J2EE and web agents from the OpenSSO Enterprise Console. Tasks that you can perform include creating, deleting, updating, listing, and displaying agent configurations. Using the Console, you can set properties for an agent that you previously set by editing the agent's AMAgent.properties file.
For more information, refer to the Administration Console online Help.
ssoadm command-line utility
The ssoadm utility is the command-line interface to OpenSSO Enterprise server and is available after you install the tools and utilities in the openssoAdminTools.zip file. The ssoadm utility includes subcommands to manage policy agents, including:
Creating, deleting, updating, listing, and displaying agent configurations
Creating deleting, listing, and displaying agent groups
Adding and removing an agent to and from a group
For information about the ssoadm utility, including the syntax for each subcommand, see the Sun OpenSSO Enterprise 8.0 Administration Reference.
In some scenarios, you might need to deploy a version 3.0 agent using a local configuration. For example, if you deploy the agent with Access Manager 7.1 or Access Manager 7 2005Q4, which do not support centralized agent configuration, local configuration is used by default.
With a local configuration, you manage the version 3.0 agent by editing properties in the agent's local OpenSSOAgentConfiguration.properties file (in the same manner that you edit the AMAgent.properties file for version 2.2 agents).
If you are creating a new agent profile in the OpenSSO Console, set Configuration to Local.
To specify a local configuration for an existing agent profile using a centralized configuration, edit the agent profile in the OpenSSO Console:
Log in to the Console as amadmin.
Click Access Control, realm-name, Agents, Web, and then the name of the agent profile you want to edit.
The Console displays the Edit page for the agent profile.
On the Edit page, check Local for Location of Agent Configuration Repository.
Click Save.
A version 3.0 agent also stores configuration information in the local OpenSSOAgentBootstrap.properties file. The agent uses information in the bootstrap file to start and initialize itself and to communicate with OpenSSO Enterprise server. In most cases, you won't need to edit the bootstrap file; however, if you do edit the file, be careful, or the agent might not function properly.
Undeploy any applications protected by the Web Server 7.0 agent.
Stop the Web Server 7.0 instance, if it is running.
Change to the following directory:
PolicyAgent-base/bin
Issue one of the following commands:
# ./agentadmin --uninstall
or
# ./agentadmin --uninstallAll
The --uninstall removes only one instance of the agent, while the --uninstallAll option prompts you to remove all configured instances of the agent.
The uninstall program prompts you for the Web Server configuration directory path.
Default: /var/opt/SUNWwbsvr7/https-agenthostname/config
The uninstall program displays the path and then asks if you want to continue:
To continue with the uninstallation, select 1 (the default).
************************************************************************ Welcome to the OpenSSO Enterprise Policy Agent for Sun Java System Web Server If the Policy Agent is used with Federation Manager services, User needs to enter information relevant to Federation Manager. ************************************************************************ Enter the complete path to the directory which is used by Sun Java System Web Server to store its configuration Files. This directory uniquely identifies the Sun Java System Web Server instance that is secured by this Agent. [ ? : Help, ! : Exit ] Enter the Sun Java System Web Server Config Directory Path [/var/opt/SUNWwbsvr7/https-agenthost/config]: ----------------------------------------------- SUMMARY OF YOUR RESPONSES ----------------------------------------------- Sun Java System Web Server Config Directory : /var/opt/SUNWwbsvr7/https-agenthost/config Verify your settings above and decide from the choices below. 1. Continue with Uninstallation 2. Back to the last interaction 3. Start Over 4. Exit Please make your selection [1]: |
The /config directory is removed from the agent instance directory, but the /logs directory still exists.
The uninstall program creates an uninstall log file in the PolicyAgent-base/logs/audit directory.
The agent instance directory is not automatically removed. For example, if you uninstall the agent for Agent_001, a subsequent agent installation creates the Agent_002 instance directory. To remove an agent instance directory, you must manually remove the directory.
The version 3.0 agentadmin program includes the new --migrate option to migrate a version 2.2 agent to version 3.0. After you migrate a version 2.2 agent, the agent can use the new version 3.0 agent features.
The migration process migrates the agent's binary files, updates the agent's deployment container configuration, and converts the agent's AMAgent.properties file to the new version 3.0 OpenSSOAgentBootstrap.properties and OpenSSOAgentConfiguration.properties files.
Migrating a version 2.2 agent involves these general steps:
On the server where the version 2.2 agent is installed, run the version 3.0 agentadmin program with the --migrate option.
To get the version 3.0 agentadmin program, you must download the version 3.0 agent that corresponds to the version 2.2 agent you are migrating. For example, if you are migrating the version 2.2 Web Server 7.0 agent, download the version 3.0 Web Server 7.0 agent.
On the OpenSSO Enterprise server, run the ssoadm utility to create the new version 3.0 agent configuration in the centralized agent configuration repository.
Therefore, the ssoadm utility must be installed from the openssoAdminTools.zip file on the OpenSSO Enterprise server. For information, see “Installing the OpenSSO Enterprise Utilities and Scripts” in the Sun OpenSSO Enterprise 8.0 Installation and Configuration Guide.
The agentadmin program creates a new deployment directory for the migrated agent, starting with Agent_001. The program does not modify the version 2.2 agent deployment directory files, in case you need these files after you migrate.
The following procedure, the migrated version 3.0 agent instance uses a new agent profile name, which is WS7v3Agent in the examples. The old version 2.2 and new version 3.0 agent profile passwords are the same. If you need to change the password for the new version 3.0 agent profile, see Changing the Password for an Agent Profile (Optional).
Login to the server where the version 2.2 agent is installed.
To migrate the agent, you must have write permission to the version 2.2 agent's deployment container files and directories.
Stop the Web Server 7.0 instance for the version 2.2 agent.
Create a directory to download and unzip the version 3.0 agent. For example: v30agent
Download and unzip the version 3.0 agent that corresponds to the version 2.2 agent you are migrating.
The version 3.0 agents are available from the OpenSSO project site: https://opensso.dev.java.net/public/use/index.html
Change to the version 3.0 agent's /bin directory.
For example, if you downloaded and unzipped the version 3.0 Web Server 7.0 agent in the v30agent directory:
cd /v30agent/web_agents/sjsws_agent/bin
Run the version 3.0 agentadmin program with the --migrate option. For example:
./agentadmin --migrate
When the agentadmin program prompts you, enter the path to the version 2.2 agent's deployment directory. For example:
... Enter the migrated agent's deployment directory: /opt/web_agents/sjsws_agent ...
In this example, /opt is the directory where you downloaded and upzipped the version 2.2 agent.
The agentadmin program migrates the version 2.2 agent.
Copy the Agent_nnn/config/OpenSSOAgentConfiguration.properties file to the /bin directory where ssoadm is installed on the OpenSSO Enterprise server.
In OpenSSOAgentConfiguration.properties, add the un-encrypted version 2.2 agent profile password at the end of the file, as follows:
userpassword=v2.2–agent-profile-password
On OpenSSO Enterprise server, create a password file for the OpenSSO Enterprise administrator (amadmin).
This password file is an ASCII text file with only one line specifying the amadmin password in plain text. For example: /tmp/amadminpw
On OpenSSO Enterprise server, run ssoadm to create a new agent configuration in the OpenSSO Enterprise centralized agent configuration repository. For example:
cd tools_zip_root/opensso/bin ./ssoadm create-agent -b WS7v3Agent -t WebAgent -u amadmin -f /tmp/amadminpw -D ./OpenSSOAgentConfiguration.properties
In this example:
tools_zip_root is the directory where you unzipped openssoAdminTools.zip.
WS7v3Agent is the version 3.0 agent configuration name.
WebAgent is the agent type for J2EE agents.
/tmp/amadminpw is the path to the amadmin password file.
Caution: After you run ssoadm, you might want to delete OpenSSOAgentConfiguration.properties from the /bin directory. This file contains sensitive information, including as the agent profile password, and the original file is maintained on the server where the agent is installed.
Restart the Web Server 7.0 instance for the migrated agent.
After you migrate the agent, you can manage the new 3.0 agent configuration using the OpenSSO Enterprise Administration Console or the ssoadm utility, as described in Managing the Web Server 7.0 Agent.
You can find additional useful information and resources at the following locations:
Sun Services: http://www.sun.com/service/consulting/
Sun Software Products: http://wwws.sun.com/software/
Sun Support Resources http://sunsolve.sun.com/
Sun Developer Network (SDN): http://developers.sun.com/
Sun Developer Services: http://www.sun.com/developers/support/
To obtain accessibility features that have been released since the publishing of this media, consult Section 508 product assessments available from Sun upon request to determine which versions are best suited for deploying accessible solutions.
For information about Sun's commitment to accessibility, visit http://sun.com/access.
Third-party URLs are referenced in this document and provide additional, related information.
Sun is not responsible for the availability of third-party Web sites mentioned in this document. Sun does not endorse and is not responsible or liable for any content, advertising, products, or other materials that are available on or through such sites or resources. Sun will not be responsible or liable for any actual or alleged damage or loss caused by or in connection with the use of or reliance on any such content, goods, or services that are available on or through such sites or resources.
If you have questions or issues with OpenSSO Enterprise, contact Sun as follows:
Sun Support Resources (SunSolve) services at http://sunsolve.sun.com/.
This site has links to the Knowledge Base, Online Support Center, and ProductTracker, as well as to maintenance programs and support contact numbers.
The telephone dispatch number associated with your maintenance contract
So that we can best assist you in resolving problems, please have the following information available when you contact support:
If you are requesting help for a problem, please include the following information:
Description of the problem, including when the problem occurs and its impact on your operation
Machine type, operating system version, web container and version, JDK version, and OpenSSO Enterprise version, including any patches or other software that might be affecting the problem
Steps to reproduce the problem
Any error logs or core dumps
Sun is interested in improving its documentation and welcomes your comments and suggestions. To share your comments, go to http://docs.sun.com/ and click Feedback. In the online form, provide the full document title and part number. The part number is a 7-digit or 9-digit number that can be found on the title page or in the document's URL. For example, the title of this guide is Sun OpenSSO Enterprise Policy Agent 3.0 Guide for Sun Java System Web Server 7.0, and the part number is 820-4579.
Part Number |
Date |
Description |
---|---|---|
820-4579–11 |
July 31, 2009 |
Clarified the information in Managing a Version 3.0 Agent With a Local Configuration. |
820-4579–10 |
November 11, 2008 |
Initial release. |
820-4579-05 |
July 15, 2008 |
Early Access (EA) release draft. |