test

Sun Java System Federation Manager 7.0 User's Guide

Configuring Federation Manager for Sun Java System Policy Agents

Federation Manager supports both types of Sun Java System Policy Agents 2.2: web agents and J2EE agents. They can be deployed to work with Federation Manager in any web container on which the agents are supported although they will only work in SSO only mode. No policy or access control is supported.

With respect to passing attributes to an application using agents, there are some limitations. Agents can not retrieve user attributes stored directly in Federation Manager as the user management functionality is not enabled. Either of the following options will alleviate this issue.

  1. User attributes can be passed from identity providers and delivered to service providers (using Federation Manager) in SAML assertions. Federation Manager can mark the attributes as session attributes that policy agents will consume and pass to the applications.

  2. Implement a post authentication and/or federation adapter SPI for the service provider (using Federation Manager) to read user attributes and set them as session attributes. The policy agent will consume the session attributes and pass them to the applications.

The following steps must be taken in order for Sun Java System Policy Agents 2.2 to work correctly with Federation Manager. On the agent side, you must do the following:

  1. When installing the agent, specify /fm for the following URI: Primary Server Deployment URI [/amserver] = /fm

  2. After installation, modify the following values in the AMAgents.properties file:

    • com.sun.am.policy.agents.config.do_sso_only = true

    • com.sun.am.policy.agents.config.profile.attribute.fetch.mode=NONE

    • com.sun.am.policy.agents.config.response.attribute.fetch.mode=NONE

  3. Restart the agent.

On the Federation Manager side, you must do the following:

  1. Encrypt the shared secret password using the ampassword utility.

  2. Modify the com.iplanet.am.service.secret property in AMConfig.properties by specifying the encrypted password as the value for the property.

  3. Restart Federation Manager.