Creating the manager and admin Groups

To Create the host-manager and admin Groups

1. Login to OpenSSO Enterprise Administration Console.

2. Create two new groups: manager and admin, as follows:

   1. Click Access Control, realm-name, Subjects, and then Group.

   2. Click New.

   3. In ID, enter the name of the group. For example: manager or admin

   4. Click OK.

      Repeat these steps for the other group.

3. To test access to the manager and host-manager applications, add several test users to each group.

4. Create a policy with two rules and allow access to the manager and admin groups. For example:

   http://sso-host.example.com:8080/host-manager/*

   http://sso-host.example.com:8080/manager/*

5. If the redirect loop issue is a concern, set the Cookie Encode property to Yes in the OpenSSO Enterprise server:

   1. In the console, click Configuration, Server and Sites, and the OpenSSO Enterprise Server Instance name.

   2. Click Security and then Cookie. By default Encode Cookie is set to No.

   3. Click Inheritance Settings, deselect Encode Cookie, and then click Save.

      You can now change the cookie encoding option.

   4. Click Back to Server Profile.

   5. Set Cookie Encoding to Yes and click Save.

6. Make the following Tomcat 6.0 manager and host-manager application changes:

   1. For the manager application, in the $CATALINA_HOME/webapps/manager/WEB-INF/web.xml, change <role-name>manager</role-name> to:

      <role-name>id=manager,ou=group,dc=opensso,dc=java,dc=net</role-name>

   2. For the host-manager application, in the $CATALINA_HOME/webapps/host-manager/WEB-INF/web.xml, change <role-name>admin</role-name> to:

      <role-name>id=admin,ou=group,dc=opensso,dc=java,dc=net</role-name>

      Note. The dc=opensso,dc=java,dc=net part in the manager and admin role values is used because OpenSSO Enterprise is deployed using the default mode. If you have a custom setup and the DN is different, change the value for your deployment.

7. Restart the OpenSSO Enterprise server.