We will install BEA WebLogic Server and a J2EE policy agent on the Protected Resource 1 host machine (pr-1) and on the Protected Resource 2 host machine (pr-2). The policy agents are then configured to access Load Balancer 2. Use the following list of procedures as a checklist for completing the task.
8.1.1 Installing and Configuring the J2EE Container and J2EE Policy Agent on Protected Resource 1
8.1.2 Installing and Configuring the J2EE Container and J2EE Policy Agent on Protected Resource 2
8.1.6 Configuring the J2EE Policy Agents to Access the Distributed Authentication User Interface
Download the BEA WebLogic Server bits to the pr-1 host machine and install the application server. Additionally, download, install and configure the appropriate J2EE policy agent. Use the following list of procedures as a checklist for completing this task.
To Install BEA WebLogic Server as J2EE Container 1 on Protected Resource 1
To Configure BEA WebLogic Server as J2EE Container 1 on Protected Resource 1
To Import the Certificate Authority Root Certificate into Application Server 1
BEA WebLogic Server is the application server used as the J2EE container on Protected Resource 1.
As a root user, log into the pr-1 host machine.
Ensure that your system is properly patched.
Refer to the BEA web site to make sure that your system has the recommended patches.
Create a directory into which you can download the WebLogic Server bits and change into it.
# mkdir /export/BEAWL10 # cd /export/BEAWL10 |
Download the WebLogic Server bits from http://commerce.bea.com/.
For this deployment, we download the Solaris version.
# ls -al total 294548 drwxr-xr-x 2 root root 512 Aug 7 13:23 . drwxr-xr-x 3 root sys 512 Aug 7 13:16 .. -rw-r--r-- 1 root root 656834948 Aug 7 13:24 server100_solaris32.bin |
Run the installer.
# ./server100_solaris32.bin |
When prompted, do the following:
|
Click Next. |
|
|
Select Yes and click Next. |
|
|
Type /usr/local/bea and click Next. |
|
|
Click Next. |
|
|
Click Next. |
|
|
Type /usr/local/bea/weblogic10 and click Next. |
|
|
Deselect Run Quickstart and click Done. |
Verify that the application was correctly installed.
# cd /usr/local/bea # ls -al total 90 drwxr-xr-x 7 root root 512 Jul 15 11:59 . drwxr-xr-x 4 root root 512 Jul 15 11:58 .. -rwxr-xr-x 1 root root 826 Jul 15 11:59 UpdateLicense.sh -rw-r--r-- 1 root root 14 Jul 15 11:59 beahomelist drwxr-xr-x 6 root root 512 Jul 15 11:59 jdk150_06 -rw-r--r-- 1 root root 12447 Jul 15 11:59 license.bea drwxr-xr-x 2 root root 512 Jul 15 11:59 logs drwxr-xr-x 6 root root 6656 Jul 15 11:58 modules -rw-r--r-- 1 root root 15194 Jul 15 11:59 registry.dat -rw-r--r-- 1 root root 1077 Jul 15 11:59 registry.xml drwxr-xr-x 4 root root 512 Jul 15 12:01 utils drwxr-xr-x 10 root root 512 Jul 15 11:59 weblogic10 |
After installing the bits, WebLogic Server must be configured.
This procedure assumes you have just completed To Install BEA WebLogic Server as J2EE Container 1 on Protected Resource 1 and are still logged into the host machine as the root user.
Run the WebLogic Server configuration script.
# cd /usr/local/bea/weblogic10/common/bin # ./config.sh |
When prompted, do the following:
Start the WebLogic administration server.
# cd /usr/local/bea/user_projects/domains/pr-1 # ./startWebLogic.sh |
When prompted, type the following credentials.
weblogic
bea10admin
Run the netstat command to verify that the port is open and listening.
# netstat -an | grep 7001 XXX.XX.XX.101.7001 *.* 0 0 49152 0 LISTEN XXX.X.X.1.7001 *.* 0 0 49152 0 LISTEN |
You can also access the administration console by pointing a web browser to http://pr-1.example.com:7001/console.
Change to the AdminServer directory.
# cd /usr/local/bea/user_projects/domains/pr-1/servers/AdminServer |
Create a security directory and change into it.
# mkdir security # cd security |
Create a boot.properties file for the WebLogic Server administration server administrator credentials.
The administration server administrative user and password are stored in boot.properties. Application Server 1 uses this information during startup. WebLogic Server encrypts the file, so there is no security risk even if you enter the user name and password in clear text.
# cat > boot.properties username=weblogic password=bea10admin Hit Control D to terminate the command ^D |
Restart WebLogic to encrypt the username and password in boot.properties.
# cd /usr/local/bea/user_projects/domains/pr-1/bin # ./stopWebLogic.sh # ./startWebLogic.sh |
Start the managed servers.
# cd /usr/local/bea/user_projects/domains/pr-1/bin # ./startManagedWebLogic.sh ApplicationServer-1 t3://localhost:7001 |
You will be prompted for the administrative user credentials.
weblogic
bea10admin
Change to the ApplicationServer-1 directory.
# cd /usr/local/bea/user_projects/domains/pr-1/ servers/ApplicationServer-1 |
Create a security directory and change into it.
# mkdir security # cd security |
Create a boot.properties file for the WebLogic Server managed server administrator credentials.
The managed server administrative user and password are stored in boot.properties. The Application Server 1 managed server uses this information during startup. WebLogic Server encrypts the file, so there is no security risk even if you enter the user name and password in clear text.
# cat > boot.properties username=weblogic password=bea10admin Hit Control D to terminate the command ^D |
Restart the managed server.
# cd /usr/local/bea/user_projects/domains/ pr-1/bin # ./stopManagedWebLogic.sh ApplicationServer-1 t3://localhost:7001 # ./startManagedWebLogic.sh ApplicationServer-1 t3://localhost:7001 |
Run the netstat command to verify that the port is open and listening.
# netstat -an | grep 1081 XXX.XX.XX.101.1081 *.* 0 0 49152 0 LISTEN XXX.X.X.1.1081 *.* 0 0 49152 0 LISTEN |
Access http://pr-1.example.com:7001/console from a web browser.
Login to the BEA WebLogic Server as the administrator.
weblogic
bea10admin
Click servers under Domain Structure —>Environment.
On the Summary of Servers page, verify that both AdminServer (admin) and ApplicationServer-1 are running and OK.
Log out of the console.
Log out of the pr–1 host machine.
The Certificate Authority (CA) root certificate enables the J2EE policy agent to trust the certificate from the OpenSSO Enterprise Load Balancer 2, and to establish trust with the certificate chain that is formed from the CA to the certificate.
Copy the same CA root certificate used in To Install a CA Root Certificate to the OpenSSO Enterprise Load Balancer to the /export/software directory on the pr-1 host machine.
As a root user, log into the pr–1 host machine.
Change to the directory where cacerts, the certificate store is located.
# cd /usr/local/bea/jdk150_06/jre/lib/security. |
Backup cacerts before modifying it.
Import ca.cer, the CA root certificate.
# /usr/local/bea/jdk150_06/bin/keytool -import -trustcacerts -alias OpenSSLTestCA -file /export/software/ca.cer -keystore /usr/local/bea/jdk150_06/jre/lib/security/cacerts -storepass changeit Owner: EMAILADDRESS=nobody@nowhere.com, CN=OpenSSLTestCA, OU=Sun, O=Sun,L=Santa Clara, ST=California C=US Issuer: EMAILADDRESS=nobody@nowhere.com, CN=OpenSSLTestCA, OU=Sun, O=Sun,L=Santa Clara, ST=California C=US Serial number: 97dba0aa26db6386 Valid from: Tue Apr 18 07:66:19 PDT 2006 until: Tue Jan 13 06:55:19 PST 2009 Certificate fingerprints: MD5: 9f:57:ED:B2:F2:88:B6:E8:0F:1E:08:72:CF:70:32:06 SHA1: 31:26:46:15:C5:12:5D:29:46:2A:60:A1:E5:9E:26:64:36:80:E4:70 Trust this certificate: [no] yes Certificate was added to keystore. |
Verify that ca.cer was successfully imported.
# /usr/local/bea/jdk150_06/bin/keytool -list -keystore /usr/local/bea/jdk150_06/jre/lib/security/cacerts -storepass changeit | grep -i openssl OpenSSLTestCA, Sep 15, 2008, trustedCertEntry, |
Log out of the pr–1 host machine.
Set JAVA_HOME to /usr/local/bea/jdk150_06.
As a root user, log into the pr-1 host machine.
Stop the WebLogic Server 1 administration server and the WebLogic Server 1 managed instance.
# cd /usr/local/bea/user_projects/domains/pr-1/bin # ./stopManagedWebLogic.sh ApplicationServer-1 t3://localhost:7001 # ./stopWebLogic.sh |
Create a directory into which you will download the J2EE Policy Agent bits and change into it.
# mkdir /export/J2EEPA1 # cd /export/J2EEPA1 |
Create a text file that contains a password for the Agent Profile created during installation.
The J2EE Policy Agent installer requires this.
# cat > agent.pwd j2eeagent1 Hit Control D to terminate the command ^D |
Create a text file that contains the Agent Administrator password.
This text file should contain the password of the OpenSSO Enterprise administrator (by default, amadmin).
# cat > agentadm.pwd ossoadmin Hit Control D to terminate the command ^D |
Download the J2EE policy agent bits for WebLogic Server from http://www.sun.com/download/index.jsp.
# ls -al total 18824 drwxr-xr-x 2 root root 512 Jul 17 16:02 . drwxr-xr-x 8 root root 512 Jul 17 15:58 .. -rw-r--r-- 1 root root 11 Jul 17 15:59 agent.pwd -rw-r--r-- 1 root root 9 Jul 17 16:01 agentadm.pwd -rw-r--r-- 1 root root 9623704 Jul 17 16:02 weblogic_v10_agent_3.zip |
Unpack the J2EE policy agent bits.
# unzip weblogic_v10_agent_3.zip |
Run the J2EE policy agent installer.
# cd /export/J2EEPA1/j2ee_agents/weblogic_v10_agent/bin # chmod 755 agentadmin # ./agentadmin --custom-install |
When prompted, provide the following information.
The following information is to configure the J2EE Policy Agent against the OpenSSO Enterprise secure port.
|
Press Enter to continue. Continue to press Enter until you reach the end of the License Agreement and the installer's Welcome page is displayed. |
|
|
Enter /usr/local/bea/user_projects/domains/pr-1/bin/startwebLogic.sh |
|
|
Enter the name of the WebLogic Server instance secured by the agent ApplicationServer-1 |
|
|
Enter /usr/local/bea/weblogic10. |
|
|
Enter the URL where OpenSSO Enterprise is running (including the URI): https://lb-2.example.com:1081/opensso |
|
|
Accept the default value. |
|
|
Enter the URL where the policy agent is running (including the URI): http://pr-1.example.com:1081/agentapp |
|
|
Accept the default value. |
|
|
j2eeagent-1 |
|
|
Enter the path to a file that contains the password to be used for identifying the policy agent: /export/J2EEPA1/agent.pwd. Note – A warning message is displayed regarding the existence of the agent profile. |
|
|
Accept the default value to create the Agent Profile during installation. |
|
|
Enter amadmin |
|
|
Enter /export/J2EEPA1/agentadm.pwd |
|
|
Accept the default value. |
|
|
Accept the default value. |
When the installer is finished, a new file is in the bin directory called setAgentEnv_ApplicationServer-1.sh.
Modify the startup script setDomainEnv.sh to reference setAgentEnv_ApplicationServer-1.sh with the following sub procedure.
Backup setDomainEnv.sh before you modify it.
Change permissions for setAgentEnv_ApplicationServer-1.sh.
# chmod 755 setAgentEnv_ApplicationServer-1.sh |
Start the WebLogic Server administration server and managed instance.
# ./startWebLogic.sh & # ./startManagedWebLogic.sh ApplicationSever-1 t3://localhost:7001 |
Watch for startup errors.
Verify that the J2EE Policy Agent 1 was successfully created on the server using the following sub procedure.
Access https://osso-1.example.com:1081/opensso/console from a web browser.
Log in to the OpenSSO Enterprise console as the administrator.
amadmin
ossoadmin
Under the Access Control tab, click / (Top Level Realm).
Click the Agents tab.
Click the J2EE tab.
j2eeagent-1 is displayed under the Agent table.
Click j2eeagent-1.
The j2eeagent-1 properties page is displayed.
Log out of the OpenSSO Enterprise console and close the browser.
Remove the password files.
# cd /export/J2EEPA1 # rm agent.pwd # rm agentadm.pwd |
Log out of the pr-1 host machine.
The agent application is a housekeeping application bundled with the binaries and used by the agent for notifications and other internal functionality. This application must be deployed to the agent-protected web container using the same URI that was supplied during the agent installation process. For example, during the installation process, if you entered /agentapp as the deployment URI for the agent application, use that same context path in this procedure.
Access http://pr-1.example.com:7001/console from a web browser.
Log in to the WebLogic Server console as the administrator.
weblogic
bea10admin
Under Domain Structure, click Deployments.
On the Summary of Deployments page, in the Change Center, click Lock & Edit.
Under Deployments, click Install.
On the Install Application Assistant page, click the pr-1.example.com link.
In the field named Location: pr-1.example.com, click the root directory.
Navigate to /export/J2EEPA1/j2ee_agents/weblogic_v10_agent/etc, the application directory.
Select agentapp.war and click Next.
In the Install Application Assistant page, choose Install this deployment as an application and click Next.
In the list of Servers, mark the checkbox for ApplicationServer-1 and click Next.
In the Optional Settings page, click Next.
Click Finish.
On the Settings for agentapp page, click Save.
In the Change Center, click Activate Changes.
This procedure assumes that you have just completed To Deploy the J2EE Policy Agent 1 Application and are still logged in to the WebLogic Server console as the administrator.
In the WebLogic Server console, on the Settings for agentapp page, click Deployments.
On the Summary of Deployments page, mark the agentapp checkbox and click Start > Servicing all requests.
On the Start Application Assistant page, click Yes.
If you encounter a JavaScriptTM error, start the WebLogic Server instance and perform the steps again.
This procedure assumes that you have just completed To Start the J2EE Policy Agent 1 Application and are still logged in to the WebLogic Server console as the administrator.
In the WebLogic Server console, on the Summary of Deployments page, under Domain Structure, click Security Realms.
On the Summary of Security Realms page, click Lock & Edit.
Click the myrealm link.
On the Settings for myrealm page, click the Providers tab.
Under Authentication Providers, click New.
On the Create a New Authentication Provider page, provide the following information and click OK.
Agent-1
Select AgentAuthenticator from the drop down list.
Agent-1 is now included in the list of Authentication Providers.
In the list of Authentication Providers, click Agent-1.
In the Settings for Authentication Providers page, verify that the Control Flag is set to OPTIONAL.
In the navigation tree near the top of the page, click Providers.
In the list of Authentication Providers, click DefaultAuthenticator.
In the Settings for DefaultAuthenticator page, set the Control Flag to OPTIONAL and click Save.
In the navigation tree near the top of the page, click Providers again.
In the Change Center, click Activate Changes.
If indicated by the console, restart the servers with the following sub procedure.
Log out of the WebLogic Server console.
As a root user, log into the pr–1 host machine.
Restart the administration server and the managed instance.
# cd /usr/local/bea/user_projects/domains/pr-1/bin # ./stopManagedWebLogic.sh ApplicationServer-1 t3://localhost:7001 # ./stopWebLogic.sh # ./startWebLogic.sh # ./startManagedWebLogic.sh ApplicationServer-1 t3://localhost:7001 |
Log out of the pr–1 host machine.
Access Application Server 1 at http://pr-1.example.com:7001/console.
Log in to the WebLogic Server console as the administrator.
weblogic
bea10admin
On the Change Center, click Lock & Edit.
Under Domain Structure, click Deployments.
Under Deployments, click Install.
On the Install Application Assistant page, click the pr-1.example.com link.
In the list for Location: pr-1.example.com, click the root directory.
Navigate to the application directory (/export/J2EEPA1/j2ee_agents/weblogic_v10_agent/sampleapp/dist), select agentsample.ear and click Next.
In the Install Application Assistant page, choose Install this deployment as an application and click Next.
In the list of Servers, mark the checkbox for ApplicationServer-1 and click Next.
On the Optional Settings page, click Next to accept the default settings.
On the Review Your Choices page, click Finish.
The Target Summary section indicates that the module agentsample will be installed on the target ApplicationServer-1.
On the Settings for agentsample page, click Save.
On the Settings for agentsample page, click Activate Changes.
Under Domain Structure, click Deployments.
In the Deployments list, mark the checkbox for agentsample and click Start > Servicing All Requests.
On the Start Application Assistant page, click Yes.
The state of the deployment changes from Prepared to Active.
Log out of the Application Server 1 console.
The J2EE policy agent can operate in local or centralized mode. The centralized option was selected during the custom installation of the agent. Centralized agent configuration stores agent configuration data in a data store managed by OpenSSO Enterprise. In this deployment, J2EE policy agents are configured in centralized mode meaning that any configuration changes must be made using the OpenSSO Enterprise server. For more information, see Centralized Agent Configuration in Sun OpenSSO Enterprise 8.0 Technical Overview.
Access https://osso-1.example.com:1081/opensso/console from a web browser.
Log in to the OpenSSO Enterprise console as the administrator.
amadmin
ossoadmin
Under the Access Control tab, click / (Top Level Realm).
Click the Agents tab.
Click the J2EE tab.
j2eeagent-1 is displayed under the Agent table.
Click j2eeagent-1.
The j2eeagent-1 properties page is displayed.
Click the Miscellaneous tab.
The Miscellaneous properties page is displayed.
Provide the user name of the Application Server administrator in the Bypass Principal List and click Add.
Enter weblogic to ensure that the administrator will be authenticated against WebLogic itself and not OpenSSO Enterprise.
Click Save.
Exit the console and close the browser.
Download the BEA WebLogic Server bits to the pr-2 host machine and install the application server. Additionally, download, install and configure the appropriate J2EE policy agent. Use the following list of procedures as a checklist for completing this task.
To Install BEA WebLogic Server as J2EE Container 2 on Protected Resource 2
To Configure BEA WebLogic Server as J2EE Container 2 on Protected Resource 2
To Import the Certificate Authority Root Certificate into Application Server 2
BEA WebLogic Server is the application server used as the J2EE container on Protected Resource 2.
As a root user, log into the pr-2 host machine.
Ensure that your system is properly patched.
Refer to the BEA web site to make sure that your system has the recommended patches.
Create a directory into which you can download the WebLogic Server bits and change into it.
# mkdir /export/BEAWL10 # cd /export/BEAWL10 |
Download the WebLogic Server bits from http://commerce.bea.com/.
For this deployment, we download the Solaris version.
# ls -al total 294548 drwxr-xr-x 2 root root 512 Aug 7 13:23 . drwxr-xr-x 3 root sys 512 Aug 7 13:16 .. -rw-r--r-- 1 root root 656834948 Aug 7 13:24 server100_solaris32.bin |
Run the installer.
# ./server100_solaris32.bin |
When prompted, do the following:
|
Click Next. |
|
|
Select Yes and click Next. |
|
|
Type /usr/local/bea and click Next. |
|
|
Click Next. |
|
|
Click Next. |
|
|
Type /usr/local/bea/weblogic10 and click Next. |
|
|
Deselect Run Quickstart and click Done. |
Verify that the application was correctly installed.
# cd /usr/local/bea # ls -al total 90 drwxr-xr-x 7 root root 512 Jul 15 11:59 . drwxr-xr-x 4 root root 512 Jul 15 11:58 .. -rwxr-xr-x 1 root root 826 Jul 15 11:59 UpdateLicense.sh -rw-r--r-- 1 root root 14 Jul 15 11:59 beahomelist drwxr-xr-x 6 root root 512 Jul 15 11:59 jdk150_06 -rw-r--r-- 1 root root 12447 Jul 15 11:59 license.bea drwxr-xr-x 2 root root 512 Jul 15 11:59 logs drwxr-xr-x 6 root root 6656 Jul 15 11:58 modules -rw-r--r-- 1 root root 15194 Jul 15 11:59 registry.dat -rw-r--r-- 1 root root 1077 Jul 15 11:59 registry.xml drwxr-xr-x 4 root root 512 Jul 15 12:01 utils drwxr-xr-x 10 root root 512 Jul 15 11:59 weblogic10 |
After installing the bits, WebLogic Server must be configured.
This procedure assumes you have just completed To Install BEA WebLogic Server as J2EE Container 2 on Protected Resource 2 and are still logged into the host machine as the root user.
Run the WebLogic Server configuration script.
# cd /usr/local/bea/weblogic10/common/bin # ./config.sh |
When prompted, do the following:
|
Click Next. |
|
|
Click Next. |
|
|
Enter the following and click Next.
|
|
|
Click Next. |
|
|
Select yes and click Next. |
|
|
Accept the default values and click Next. |
|
|
Select Add, enter the following values, and click Next.
|
|
|
Accept the default values and click Next. |
|
|
Select the Unix Machine tab, then select Add, type pr-2 and click Next. |
|
|
From the left panel select AdminServer and ApplicationServer-2. From the right panel select pr-2. Click --> and then click Next. |
|
|
Click Next. |
|
|
Add the following and click Create.
|
|
|
Click Done. |
Start the WebLogic administration server.
# cd /usr/local/bea/user_projects/domains/pr-2 # ./startWebLogic.sh |
When prompted, type the following credentials.
weblogic
bea10admin
Run the netstat command to verify that the port is open and listening.
# netstat -an | grep 7001 XXX.XX.XX.101.7001 *.* 0 0 49152 0 LISTEN XXX.X.X.1.7001 *.* 0 0 49152 0 LISTEN |
You can also access the administration console by pointing a web browser to http://pr-2.example.com:7001/console.
Change to the AdminServer directory.
# cd /usr/local/bea/user_projects/domains/pr-2/servers/AdminServer |
Create a security directory and change into it.
# mkdir security # cd security |
Create a boot.properties file for the WebLogic Server administration server administrator credentials.
The administration server administrative user and password are stored in boot.properties. Application Server 2 uses this information during startup. WebLogic Server encrypts the file, so there is no security risk even if you enter the user name and password in clear text.
# cat > boot.properties username=weblogic password=bea10admin Hit Control D to terminate the command ^D |
Restart WebLogic to encrypt the username and password in boot.properties.
# cd /usr/local/bea/user_projects/domains/pr-2/bin # ./stopWebLogic.sh # ./startWebLogic.sh |
Start the managed servers.
# cd /usr/local/bea/user_projects/domains/pr-2/bin # ./startManagedWebLogic.sh ApplicationServer-2 t3://localhost:7001 |
You will be prompted for the administrative user credentials.
weblogic
bea10admin
Change to the ApplicationServer-2 directory.
# cd /usr/local/bea/user_projects/domains/pr-2/ servers/ApplicationServer-2 |
Create a security directory and change into it.
# mkdir security # cd security |
Create a boot.properties file for the WebLogic Server managed server administrator credentials.
The managed server administrative user and password are stored in boot.properties. The Application Server 2 managed server uses this information during startup. WebLogic Server encrypts the file, so there is no security risk even if you enter the user name and password in clear text.
# cat > boot.properties username=weblogic password=bea10admin Hit Control D to terminate the command ^D |
Restart the managed server.
# cd /usr/local/bea/user_projects/domains/ pr-2/bin # ./stopManagedWebLogic.sh ApplicationServer-2 t3://localhost:7001 # ./startManagedWebLogic.sh ApplicationServer-2 t3://localhost:7001 |
Run the netstat command to verify that the port is open and listening.
# netstat -an | grep 1081 XXX.XX.XX.101.1081 *.* 0 0 49152 0 LISTEN XXX.X.X.1.1081 *.* 0 0 49152 0 LISTEN |
Access http://pr-2.example.com:7001/console from a web browser.
Login to the BEA WebLogic Server as the administrator.
weblogic
bea10admin
Click servers under Domain Structure —>Environment.
On the Summary of Servers page, verify that both AdminServer (admin) and ApplicationServer-2 are running and OK.
Log out of the console.
Log out of the pr–2 host machine.
The CA root certificate enables the J2EE policy agent to trust the certificate from the OpenSSO Enterprise Load Balancer 2, and to establish trust with the certificate chain that is formed from the CA to the certificate.
Copy the same CA root certificate used in To Install a CA Root Certificate to the OpenSSO Enterprise Load Balancer to the /export/software directory on the pr-2 host machine.
As a root user, log into the pr–2 host machine.
Change to the directory where the cacerts certificate store is located.
# cd /usr/local/bea/jdk150_06/jre/lib/security. |
Backup cacerts before modifying it.
Import ca.cer, the CA root certificate.
# /usr/local/bea/jdk150_06/bin/keytool -import -trustcacerts -alias OpenSSLTestCA -file /export/software/ca.cer -keystore /usr/local/bea/jdk150_06/jre/lib/security/cacerts -storepass changeit Owner: EMAILADDRESS=nobody@nowhere.com, CN=OpenSSLTestCA, OU=Sun, O=Sun,L=Santa Clara, ST=California C=US Issuer: EMAILADDRESS=nobody@nowhere.com, CN=OpenSSLTestCA, OU=Sun, O=Sun,L=Santa Clara, ST=California C=US Serial number: 97dba0aa26db6386 Valid from: Tue Apr 18 07:66:19 PDT 2006 until: Tue Jan 13 06:55:19 PST 2009 Certificate fingerprints: MD5: 9f:57:ED:B2:F2:88:B6:E8:0F:1E:08:72:CF:70:32:06 SHA1: 31:26:46:15:C5:12:5D:29:46:2A:60:A1:E5:9E:26:64:36:80:E4:70 Trust this certificate: [no] yes Certificate was added to keystore. |
Verify that ca.cer was successfully imported.
# /usr/local/bea/jdk150_06/bin/keytool -list -keystore /usr/local/bea/jdk150_06/jre/lib/security/cacerts -storepass changeit | grep -i openssl OpenSSLTestCA, Sep 15, 2008, trustedCertEntry, |
Log out of the pr–2 host machine.
Set JAVA_HOME to /usr/local/bea/jdk150_06.
As a root user, log into the pr-2 host machine.
Stop the WebLogic Server 2 administration server and the WebLogic Server 2 managed server.
# cd /usr/local/bea/user_projects/domains/pr-2/bin # ./stopManagedWebLogic.sh ApplicationServer-2 t3://localhost:7001 # ./stopWebLogic.sh |
Create a directory into which you will download the J2EE policy agent bits and change into it.
# mkdir /export/J2EEPA2 # cd /export/J2EEPA2 |
Create a text file that contains a password for the Agent Profile created during installation.
The J2EE Policy Agent installer requires this.
# cat > agent.pwd j2eeagent2 Hit Control D to terminate the command ^D |
Create a text file that contains the Agent Administrator password.
This text file should contain the password of the OpenSSO Enterprise administrator (by default, amadmin).
# cat > agentadm.pwd ossoadmin Hit Control D to terminate the command ^D |
Download the J2EE policy agent bits for WebLogic Server from http://www.sun.com/download/index.jsp.
# ls -al total 18824 drwxr-xr-x 2 root root 512 Jul 17 16:02 . drwxr-xr-x 8 root root 512 Jul 17 15:58 .. -rw-r--r-- 1 root root 11 Jul 17 15:59 agent.pwd -rw-r--r-- 1 root root 9 Jul 17 16:01 agentadm.pwd -rw-r--r-- 1 root root 9623704 Jul 17 16:02 weblogic_v10_agent_3.zip |
Unpack the J2EE policy agent bits.
# unzip weblogic_v10_agent_3.zip |
Run the J2EE policy agent installer.
# cd /export/J2EEPA2/j2ee_agents/weblogic_v10_agent/bin # chmod 755 agentadmin # ./agentadmin --custom-install |
When prompted, provide the following information.
The following information is to configure the J2EE Policy Agent against the OpenSSO Enterprise secure port.
|
Press Enter to continue. Continue to press Enter until you reach the end of the License Agreement and the installer's Welcome page is displayed. |
|
|
Enter /usr/local/bea/user_projects/domains/pr-2/bin/startwebLogic.sh |
|
|
Enter the name of the WebLogic Server instance secured by the agent ApplicationServer-2 |
|
|
Enter /usr/local/bea/weblogic10. |
|
|
Enter the URL where OpenSSO Enterprise is running (including the URI): https://lb-2.example.com:1081/opensso |
|
|
Accept the default value. |
|
|
Enter the URL where the policy agent is running (including the URI): http://pr-2.example.com:1081/agentapp |
|
|
Accept the default value. |
|
|
j2eeagent-2 |
|
|
Enter the path to a file that contains the password to be used for identifying the policy agent: /export/J2EEPA2/agent.pwd. Note – A warning message is displayed regarding the existence of the agent profile. |
|
|
Accept the default value to create the Agent Profile during installation. |
|
|
Enter amadmin |
|
|
Enter /export/J2EEPA2/agentadm.pwd |
|
|
Accept the default value. |
|
|
Accept the default value. |
When the installer is finished, a new file is in the bin directory called setAgentEnv_ApplicationServer-2.sh.
Modify the startup script setDomainEnv.sh to reference setAgentEnv_ApplicationServer-2.sh using the following sub procedure.
Backup setDomainEnv.sh before you modify it.
Change permissions for setAgentEnv_ApplicationServer-2.sh.
# chmod 755 setAgentEnv_ApplicationServer-2.sh |
Start the WebLogic Server administration server and managed instance.
# ./startWebLogic.sh & # ./startManagedWebLogic.sh ApplicationSever-2 t3://localhost:7001 |
Watch for startup errors.
Verify that the J2EE Policy Agent 2 was successfully created on the server using the following sub-procedure.
Access https://osso-1.example.com:1081/opensso/console from a web browser.
Log in to the OpenSSO Enterprise console as the administrator.
amadmin
ossoadmin
Under the Access Control tab, click / (Top Level Realm).
Click the Agents tab.
Click the J2EE tab.
j2eeagent-2 is displayed under the Agent table.
Click j2eeagent-2.
The j2eeagent-2 properties page is displayed.
Log out of the OpenSSO Enterprise console and close the browser.
Remove the password files.
# cd /export/J2EEPA2 # rm agent.pwd # rm agentadm.pwd |
Log out of the pr-2 host machine.
The agent application is a housekeeping application bundled with the binaries and used by the agent for notifications and other internal functionality. This application must be deployed to the agent-protected web container using the same URI that was supplied during the agent installation process. For example, during the installation process, if you entered /agentapp as the deployment URI for the agent application, use that same context path in this procedure.
Access http://pr-2.example.com:7001/console from a web browser.
Log in to the WebLogic Server console as the administrator.
weblogic
bea10admin
Under Domain Structure, click Deployments.
On the Summary of Deployments page, in the Change Center, click Lock & Edit.
Under Deployments, click Install.
On the Install Application Assistant page, click the pr-2.example.com link.
In the field named Location: pr-2.example.com, click the root directory.
Navigate to /export/J2EEPA2/j2ee_agents/weblogic_v10_agent/etc, the application directory.
Select agentapp.war and click Next.
In the Install Application Assistant page, choose Install this deployment as an application and click Next.
In the list of Servers, mark the checkbox for ApplicationServer-2 and click Next.
In the Optional Settings page, click Next.
Click Finish.
On the Settings for agentapp page, click Save.
In the Change Center, click Activate Changes.
This procedure assumes that you have just completed To Deploy the J2EE Policy Agent 2 Application and are still logged in to the WebLogic Server console as the administrator.
In the WebLogic Server console, on the Settings for agentapp page, click Deployments.
On the Summary of Deployments page, mark the agentapp checkbox and click Start > Servicing all requests.
On the Start Application Assistant page, click Yes.
If you encounter a JavaScript error, start the WebLogic Server instance and perform the steps again.
This procedure assumes that you have just completed To Start the J2EE Policy Agent 2 Application and are still logged in to the WebLogic Server console as the administrator.
In the WebLogic Server console, on the Summary of Deployments page, under Domain Structure, click Security Realms.
On the Summary of Security Realms page, click Lock & Edit.
Click the myrealm link.
On the Settings for myrealm page, click the Providers tab.
Under Authentication Providers, click New.
On the Create a New Authentication Provider page, provide the following information and click OK.
Agent-2
Select AgentAuthenticator from the drop down list.
Agent-2 is now included in the list of Authentication Providers.
In the list of Authentication Providers, click Agent-2.
In the Settings for Authentication Providers page, verify that the Control Flag is set to OPTIONAL.
In the navigation tree near the top of the page, click Providers.
In the list of Authentication Providers, click DefaultAuthenticator.
In the Settings for DefaultAuthenticator page, set the Control Flag to OPTIONAL and click Save.
In the navigation tree near the top of the page, click Providers again.
In the Change Center, click Activate Changes.
If indicated by the console, restart the servers.
Log out of the WebLogic Server console.
As a root user, log into the pr–2 host machine.
Restart the administration server and the managed instance.
# cd /usr/local/bea/user_projects/domains/pr-2/bin # ./stopManagedWebLogic.sh ApplicationServer-2 t3://localhost:7001 # ./stopWebLogic.sh # ./startWebLogic.sh # ./startManagedWebLogic.sh ApplicationServer-2 t3://localhost:7001 |
Log out of the pr–2 host machine.
Access Application Server 2 at http://pr-2.example.com:7001/console.
Log in to the WebLogic Server console as the administrator.
weblogic
bea10admin
On the Change Center, click Lock & Edit.
Under Domain Structure, click Deployments.
Under Deployments, click Install.
On the Install Application Assistant page, click the pr-2.example.com link.
In the list for Location: pr-2.example.com, click the root directory.
Navigate to the application directory (/export/J2EEPA2/j2ee_agents/weblogic_v10_agent/sampleapp/dist), select agentsample.ear and click Next.
In the Install Application Assistant page, choose Install this deployment as an application and click Next.
In the list of Servers, mark the checkbox for ApplicationServer-2 and click Next.
On the Optional Settings page, click Next to accept the default settings.
On the Review Your Choices page, click Finish.
The Target Summary section indicates that the module agentsample will be installed on the target ApplicationServer-2.
On the Settings for agentsample page, click Save.
On the Settings for agentsample page, click Activate Changes.
Under Domain Structure, click Deployments.
In the Deployments list, mark the checkbox for agentsample and click Start > Servicing All Requests.
On the Start Application Assistant page, click Yes.
The state of the deployment changes from Prepared to Active.
Log out of the Application Server 2 console.
The J2EE policy agent can operate in local or centralized mode. The centralized option was selected during the custom installation of the agent. Centralized agent configuration stores agent configuration data in a data store managed by OpenSSO Enterprise. In this deployment, J2EE policy agents are configured in centralized mode meaning that any configuration changes must be made using the OpenSSO Enterprise server. For more information, see Centralized Agent Configuration in Sun OpenSSO Enterprise 8.0 Technical Overview.
Access https://osso-1.example.com:1081/opensso/console from a web browser.
Log in to the OpenSSO Enterprise console as the administrator.
amadmin
ossoadmin
Under the Access Control tab, click / (Top Level Realm).
Click the Agents tab.
Click the J2EE tab.
j2eeagent-2 is displayed under the Agent table.
Click j2eeagent-2.
The j2eeagent-2 properties page is displayed.
Click the Miscellaneous tab.
The Miscellaneous properties page is displayed.
Provide the user name of the Application Server administrator in the Bypass Principal List and click Add.
Enter weblogic to ensure that the administrator will be authenticated against WebLogic itself and not OpenSSO Enterprise.
Click Save.
Exit the console and close the browser.
A group represents a collection of users with a common function, feature or interest. The groups created with this procedure will be replicated to OpenSSO Enterprise 2 and used in 8.1.4 Setting Up a Test for the J2EE Policy Agent 1 and 8.1.5 Setting Up a Test for the J2EE Policy Agent 2.
Access https://osso-1.example.com:1081/opensso/console from a web browser.
Log in to the OpenSSO Enterprise console as the administrator.
amadmin
ossoadmin
Under the Access Control tab, click / (Top Level Realm).
Click the Subjects tab.
Click the Group tab.
The Group page is displayed.
Create a manager group using the following sub procedure.
Click New on the Group page.
The New Group properties page is displayed.
Enter Manager-Group as the ID and click OK.
The Group page is displayed.
Click Manager-Group in the list.
Click the User tab.
The test users are displayed.
Select Test User 1 from the list and click Add.
Click Save.
Click Back to Subjects.
Create an employee group using the following sub procedure.
Click New on the Group page.
The New Group properties page is displayed.
Enter Employee-Group as the ID and click OK.
The Group page is displayed.
Click Employee-Group in the list.
Click the User tab.
The test users are displayed.
Select Test User 2 from the list and click Add.
Click Save.
Click Back to Subjects.
Log out of the OpenSSO Enterprise console.
The BEA Policy Agent comes with a sample application that was deployed in To Deploy the J2EE Policy Agent 1 Sample Application and To Deploy the J2EE Policy Agent 2 Sample Application. The application was created to help test policies and will be used for that purpose in this section. Use the following list as a checklist for this task.
To Create a Test Policy in the OpenSSO Enterprise Root Realm
To Configure OpenSSO Enterprise Properties for the J2EE Policy Agent 1 Sample Application
For more information on the sample application, see readme.txt in the /export/J2EEPA1/j2ee_agents/weblogic_v10_agent/sampleapp directory.
Access https://osso-1.example.com:1081/opensso/console from a web browser.
Log in to the OpenSSO Enterprise console as the administrator.
amadmin
ossoadmin
Under the Access Control tab, click / (Top Level Realm).
Click the Policies tab.
The Policies page is displayed.
Click New Policy.
Enter URL Policy for Application Server-1 in the Name field.
Under Rules, click New.
On the resulting page, select URL Policy Agent (with Resource Name) and click Next.
On the resulting page, provide the following information and click Finish.
agentsample
http://pr-1.example.com:1081/agentsample/*
Make sure the hostname is typed in lowercase.
Mark this check box and verify that Allow is selected.
Mark this check box and verify that Allow is selected.
The rule agentsample is now added to the list of Rules.
Under Subjects, click New.
On the resulting page, select Access Manager Identity Subject and click Next.
On the resulting page, provide the following information and click Search.
agentsampleGroup
Select Group.
Manager-Group and Employee-Group are displayed in the Available list.
Select Manager-Group and Employee-Group and click Add.
Manager-Group and Employee-Group are displayed in the Selected list.
Click Finish.
Click OK.
The new policy is displayed in the list of policies.
Click Back to Access Control.
Log out of the OpenSSO Enterprise console.
Access https://osso-1.example.com:1081/opensso/console from a web browser.
Log in to the OpenSSO Enterprise console as the administrator.
amadmin
ossoadmin
Under the Access Control tab, click / (Top Level Realm).
Click the Agents tab.
Click the J2EE tab.
j2eeagent-1 is displayed under the Agent table.
Click j2eeagent-1.
The j2eeagent-1 properties page is displayed.
Click the Application tab.
The Application properties page is displayed.
Provide the following information.
Enter the following and click Add.
/agentsample/authentication/login.html
Enter each of the following and click Add.
/agentsample/public/*
/agentsample/images/*
/agentsample/styles/*
/agentsample/index.html
/agentsample
Enter each of the following and click Add.
Map Key: agentsample
Corresponding Map Value: /agentsample/authentication/accessdenied.html
Click Save.
The j2eeagent-1 properties page is displayed.
Map the attributes from the OpenSSO Enterprise embedded data store to those used by the Application Server with the following sub procedure.
From the j2eeagent-1 properties page, click Back to Main Page.
Click the Subjects tab.
Click the Group tab.
Click Employee-Group in the list of Groups.
Copy and save id=Employee-Group,ou=group,dc=opensso,dc=java,dc=net, the value of the Universal ID attribute.
Click Back to Subjects.
You are returned to the Group tab.
Click Manager-Group in the list of Groups.
Copy and save id=Manager-Group,ou=group,dc=opensso,dc=java,dc=net, the value of the Universal ID attribute.
Click Back to Subjects.
Click the Agents tab.
Click the J2EE tab.
j2eeagent-1 is displayed under the Agent table.
Click j2eeagent-1.
The j2eeagent-1 properties page is displayed.
Click the Application tab.
The Application properties page is displayed.
Provide the identifiers previously saved as the manager and employee map keys and corresponding map values for Privileged Attribute Mapping and click Save.
Map Key: [id=Manager-Group,ou=group,dc=opensso,dc=java,dc=net] Corresponding Map Value: am_manager_role |
Map Key: [id=Employee-Group,ou=group,dc=opensso,dc=java,dc=net] Corresponding Map Value: am_employee_role |
Log out of the OpenSSO Enterprise console.
Use these steps to access the agent sample application and test policies against it.
Access http://pr-1.example.com:1081/agentsample/index.html, the sample application URL, from a web browser.
The Sample Application welcome page is displayed.
Click the J2EE Declarative Security link.
On the resulting page, click Invoke the Protected Servlet.
You are redirected to the OpenSSO Enterprise login page.
Log in to OpenSSO Enterprise as testuser1.
testuser1
password
If you can successfully log in as testuser1 and the J2EE Policy Agent Sample Application page is displayed, the first part of the test has succeeded and authentication is working as expected.
Click the J2EE Declarative Security link again.
On the resulting page, click Invoke the Protected Servlet.
If the Success Invocation message is displayed, the second part of the test has succeeded as the sample policy for the manager role has been enforced as expected.
Click the J2EE Declarative Security link to return.
On the resulting page, click Invoke the Protected EJB via an Unprotected Servlet.
If the Failed Invocation message is displayed, the third part of the test has succeeded as the sample policy for the employee role has been enforced as expected.
Close the browser.
In a new browser session, access http://pr-1.example.com:1081/agentsample/index.html, the sample application URL, again.
The Sample Application welcome page is displayed.
Click the J2EE Declarative Security link.
On the resulting page, click Invoke the Protected EJB via an Unprotected Servlet.
You are redirected to the OpenSSO Enterprise login page.
Log in to OpenSSO Enterprise as testuser2.
testuser2
password
The Failed Invocation message is displayed. This is a known issue.
Click the J2EE Declarative Security link.
On the resulting page, click Invoke the Protected EJB via an Unprotected Servlet.
The Successful Invocation message is displayed as the sample policy for the employee role has been enforced as expected.
Click the J2EE Declarative Security link to return.
On the resulting page, click Invoke the Protected Servlet.
If the Access to Requested Resource Denied message is displayed, this part of the test has succeeded as the sample policy for the manager role has been enforced as expected.
Close the browser.
The BEA Policy Agent comes with a sample application that was deployed in To Deploy the J2EE Policy Agent 1 Sample Application and To Deploy the J2EE Policy Agent 2 Sample Application. The application was created to help test policies and will be used for that purpose in this section. Use the following list as a checklist for this task.
To Create a Test Policy in the OpenSSO Enterprise Root Realm
To Configure OpenSSO Enterprise Properties for the J2EE Policy Agent 2 Sample Application
For more information on the sample application, see readme.txt in the /export/J2EEPA2/j2ee_agents/weblogic_v10_agent/sampleapp directory.
Access https://osso-1.example.com:1081/opensso/console from a web browser.
Log in to the OpenSSO Enterprise console as the administrator.
amadmin
ossoadmin
Under the Access Control tab, click / (Top Level Realm).
Click the Policies tab.
The Policies page is displayed.
Click New Policy.
Enter URL Policy for Application Server-2 in the Name field.
Under Rules, click New.
On the resulting page, select URL Policy Agent (with Resource Name) and click Next.
On the resulting page, provide the following information and click Finish.
agentsample
http://pr-2.example.com:1081/agentsample/*
Make sure the hostname is typed in lowercase.
Mark this check box and verify that Allow is selected.
Mark this check box and verify that Allow is selected.
The rule agentsample is now added to the list of Rules.
Under Subjects, click New.
On the resulting page, select Access Manager Identity Subject and click Next.
On the resulting page, provide the following information and click Search.
agentsampleGroup
Select Group.
Manager-Group and Employee-Group are displayed in the Available list.
Select Manager-Group and Employee-Group and click Add.
Manager-Group and Employee-Group are displayed in the Selected list.
Click Finish.
Click OK.
The new policy is displayed in the list of policies.
Click Back to Access Control.
Log out of the OpenSSO Enterprise console.
Access https://osso-1.example.com:1081/opensso/console from a web browser.
Log in to the OpenSSO Enterprise console as the administrator.
amadmin
ossoadmin
Under the Access Control tab, click / (Top Level Realm).
Click the Agents tab.
Click the J2EE tab.
j2eeagent-2 is displayed under the Agent table.
Click j2eeagent-2.
The j2eeagent-2 properties page is displayed.
Click the Application tab.
The Application properties page is displayed.
Provide the following information.
Enter the following and click Add.
/agentsample/authentication/login.html
Enter each of the following and click Add.
/agentsample/public/*
/agentsample/images/*
/agentsample/styles/*
/agentsample/index.html
/agentsample
Enter each of the following and click Add.
Map Key: agentsample
Corresponding Map Value: /agentsample/authentication/accessdenied.html
Click Save.
The j2eeagent-2 properties page is displayed.
Map the attributes from the OpenSSO Enterprise embedded data store to those used by the Application Server with the following sub procedure.
From the j2eeagent-2 properties page, click Back to Main Page.
Click the Subjects tab.
Click the Group tab.
Click Employee-Group in the list of Groups.
Copy and save id=Employee-Group,ou=group,dc=opensso,dc=java,dc=net, the value of the Universal ID attribute.
Click Back to Subjects.
You are returned to the Group tab.
Click Manager-Group in the list of Groups.
Copy and save id=Manager-Group,ou=group,dc=opensso,dc=java,dc=net, the value of the Universal ID attribute.
Click Back to Subjects.
Click the Agents tab.
Click the J2EE tab.
j2eeagent-2 is displayed under the Agent table.
Click j2eeagent-2.
The j2eeagent-2 properties page is displayed.
Click the Application tab.
The Application properties page is displayed.
Provide the identifiers previously saved as the manager and employee map keys and corresponding map values for Privileged Attribute Mapping and click Save.
Map Key: [id=Manager-Group,ou=group,dc=opensso,dc=java,dc=net] Corresponding Map Value: am_manager_role |
Map Key: [id=Employee-Group,ou=group,dc=opensso,dc=java,dc=net] Corresponding Map Value: am_employee_role |
Log out of the OpenSSO Enterprise console.
Use these steps to access the agent sample application and test policies against it.
Access http://pr-2.example.com:1081/agentsample/index.html, the sample application URL, from a web browser.
The Sample Application welcome page is displayed.
Click the J2EE Declarative Security link.
On the resulting page, click Invoke the Protected Servlet.
You are redirected to the OpenSSO Enterprise login page.
Log in to OpenSSO Enterprise as testuser1.
testuser1
password
If you can successfully log in as testuser1 and the J2EE Policy Agent Sample Application page is displayed, the first part of the test has succeeded and authentication is working as expected.
Click the J2EE Declarative Security link again.
On the resulting page, click Invoke the Protected Servlet.
If the Success Invocation message is displayed, the second part of the test has succeeded as the sample policy for the manager role has been enforced as expected.
Click the J2EE Declarative Security link to return.
On the resulting page, click Invoke the Protected EJB via an Unprotected Servlet.
If the Failed Invocation message is displayed, the third part of the test has succeeded as the sample policy for the employee role has been enforced as expected.
Close the browser.
In a new browser session, access http://pr-2.example.com:1081/agentsample/index.html, the sample application URL, again.
The Sample Application welcome page is displayed.
Click the J2EE Declarative Security link.
On the resulting page, click Invoke the Protected EJB via an Unprotected Servlet.
You are redirected to the OpenSSO Enterprise login page.
Log in to OpenSSO Enterprise as testuser2.
testuser2
password
The Failed Invocation message is displayed. This is a known issue.
Click the J2EE Declarative Security link.
On the resulting page, click Invoke the Protected EJB via an Unprotected Servlet.
The Successful Invocation message is displayed as the sample policy for the employee role has been enforced as expected.
Click the J2EE Declarative Security link to return.
On the resulting page, click Invoke the Protected Servlet.
If the Access to Requested Resource Denied message is displayed, this part of the test has succeeded as the sample policy for the manager role has been enforced as expected.
Close the browser.
Configure the J2EE policy agent to point to the secure port of the Distributed Authentication User Interface Load Balancer 3. Use the following list as a checklist to complete this task.
To Configure the J2EE Policy Agent 1 to Access the Distributed Authentication User Interface
To Configure the J2EE Policy Agent 2 to Access the Distributed Authentication User Interface
Access https://osso-1.example.com:1081/opensso/console from a web browser.
Log in to the OpenSSO Enterprise console as the administrator.
amadmin
ossoadmin
Under the Access Control tab, click / (Top Level Realm).
Click the Agents tab.
Click the J2EE tab.
j2eeagent-1 is displayed under the Agent table.
Click j2eeagent-1.
The j2eeagent-1 properties page is displayed.
Click the OpenSSO Services tab.
The Services properties page is displayed.
Make the following changes to the OpenSSO Login URL property value and click Save.
Select https://lb-2.example.com:1081/opensso/UI/Login and click Remove.
Enter https://lb-3.example.com:1443/distAuth/UI/Login and click Add.
Log out of the OpenSSO Enterprise console.
Verify that the agent is configured properly using the following sub procedure.
Access http://pr-1.example.com:1081/agentsample/index.html, the sample application URL, from a web browser.
The Sample Application Welcome page is displayed.
Click the J2EE Declarative Security link.
On the resulting page, click Invoke the Protected Servlet.
You are redirected to the Distributed Authentication User Interface at https://lb-3.example.com:1443/distAuth/UI/Login.
(Optional) Double-click the gold lock in the lower left corner of the browser.
In the Properties page, you see the certificate for lb-3.example.com.
Log in to OpenSSO Enterprise as testuser1.
testuser1
password
If you can successfully log in as testuser1 and the J2EE Policy Agent Sample Application page is displayed, user authentication worked through the Distributed Authentication User Interface and the agent is configured properly.
Close the browser.
Access https://osso-1.example.com:1081/opensso/console from a web browser.
Log in to the OpenSSO Enterprise console as the administrator.
amadmin
ossoadmin
Under the Access Control tab, click / (Top Level Realm).
Click the Agents tab.
Click the J2EE tab.
j2eeagent-2 is displayed under the Agent table.
Click j2eeagent-2.
The j2eeagent-2 properties page is displayed.
Click the OpenSSO Services tab.
The Services properties page is displayed.
Make the following changes to the OpenSSO Login URL value and click Save.
Select https://lb-2.example.com:1081/opensso/UI/Login and click Remove.
Enter https://lb-3.example.com:1443/distAuth/UI/Login and click Add.
Log out of the OpenSSO Enterprise console.
Verify that the agent is configured properly using the following sub procedure.
Access http://pr-2.example.com:1081/agentsample/index.html, the sample application URL, from a web browser.
The Sample Application Welcome page is displayed.
Click the J2EE Declarative Security link.
On the resulting page, click Invoke the Protected Servlet.
You are redirected to the Distributed Authentication User Interface at https://lb-3.example.com:1443/distAuth/UI/Login.
(Optional) Double-click the gold lock in the lower left corner of the browser.
In the Properties page, you see the certificate for lb-3.example.com.
Log in to OpenSSO Enterprise as testuser1.
testuser1
password
If you can successfully log in as testuser1 and the J2EE Policy Agent Sample Application page is displayed, user authentication worked through the Distributed Authentication User Interface and the agent is configured properly.
Close the browser.