Setting up a Reverse Proxy for the Web Proxy Server 4.0.x Agent
Setting the Web Proxy Server 4.0.x Agent dll Path in the System PATH (Windows only)
Although Web Proxy Server 4.0 works in both forward and reverse proxy modes, the Web Proxy Server 4.0 agent supports a Web Proxy Server 4.0 instance in reverse proxy mode only. You can configure Web Proxy Server 4.0 in reverse proxy mode using either of these methods:
Mapping requires defining regular and reverse mappings.
Virtual multi-hosting allows the reverse proxy server to respond to multiple DNS aliases as if a different server was installed in each of the addresses.
Choose one of these methods, depending on the requirements of your deployment. For the specific configuration steps required for each method, see the Sun Java System Web Proxy Server 4.0.10 Administration Guide.
During the agent installation, if you specified the HTTPS protocol, the Web Proxy Server 4.0.x agent should already be configured and ready to communicate using SSL. Before continuing with the following tasks, ensure that the Web Proxy Server 4.0.x instance is configured for SSL.
Configuring Notifications for the Web Proxy Server 4.0.x Agent for SSL
Disabling the Default Trust Behavior of the Web Proxy Server 4.0.x Agent
Installing the OpenSSO Enterprise Root CA Certificate for a Remote Web Proxy Server 4.0.x Instance
The Web Proxy Server 4.0.x instance must be running in SSL mode and receiving notifications.
Add the Web Proxy Server 4.0.x CA root certificate to the OpenSSO Enterprise certificate database.
Mark the CA root certificate as trusted to enable OpenSSO Enterprise to send notifications to the Web Proxy Server 4.0.x instance.
This section applies only if OpenSSO Enterprise is using SSL. By default the Web Proxy Server 4.0.x agent does not perform certificate checking, because the following property in the agent's OpenSSOAgentBootstrap.properties configuration file is set to true:
com.sun.identity.agents.config.trust.server.certs = true
The agent trusts any server certificate sent over SSL by the OpenSSO Enterprise host. If you want the agent to perform certificate checking, follow this task.
Find the agent's OpenSSOAgentBootstrap.properties file. For example:
/opt/web_agents/proxy40_agent/Agent_001/config/OpenSSOAgentBootstrap.properties
In the OpenSSOAgentBootstrap.properties file, set the following property to false:
com.sun.identity.agents.config.trust.server.certs = false
In the OpenSSOAgentBootstrap.properties file, set the following SSL properties, depending on your specific deployment:
com.sun.identity.agents.config.sslcert.dir is the directory containing the certificate database.
com.sun.identity.agents.config.certdb.prefix is the certificate database prefix, if you have multiple certificate databases in the same directory.
com.sun.identity.agents.config.certdb.password is the certificate database password.
com.sun.identity.agents.config.certificate.alias is the alias.
Restart the Web Proxy Server 4.0.x instance.
The root CA certificate that you install on a remote Web Proxy Server 4.0.x instance must be the same one that is installed on the OpenSSO Enterprise host.
For the procedure to install a root CA certificate, see the Sun Java System Web Proxy Server 4.0.10 Administration Guide.
On Windows systems, before you restart the Web Proxy Server 4.0.x instance, set the agent dll path in the system PATH variable. Otherwise, you might get a “Configuration initialization failed” error, indicating that an agent dll file could not be found.
The system PATH variable must include drive:installation-directory\web_agents\proxy40_agent\lib.
For example: c:\v30agents\web_agents\proxy40_agent\lib
After you install the agent, you can change the agent profile password, if required for your deployment.
On the OpenSSO Enterprise server:
On the server where the Web Proxy Server 4.0.x agent is installed:
In the agent profile password file, replace the old password with the new unencrypted password.
Change to the PolicyAgent-base/bin directory.
Encrypt the new password using the agentadmin program. For example:
#./agentadmin --encrypt Agent_002 /tmp/wps4agentpw
Agent_002 is the agent instance whose password you want to encrypt.
passwd is the password file in the /tmp directory.
The agentadmin program returns the new encrypted password. For example:
The encrypted value is: /54GwN432q+MEnfh/AHLMA==
In the agent-instance/config/OpenSSOAgentBootstrap.properties file, set the following property to the new encrypted password from the previous step. For example:
com.sun.am.policy.am.password=/54GwN432q+MEnfh/AHLMA==
Restart the Web Proxy Server 4.0.x instance that is being protected by the policy agent.