test

Deployment Example 1: Access Manager 7.1 Load Balancing, Distributed Authentication UI, and Session Failover

8.3 Installing and Configuring the Distributed Authentication User Interface 2

Use the following list of procedures as a checklist for installing and configuring the Distributed Authentication User Interface 2.

  1. To Create a Non-Root User on the Distributed Authentication User Interface 2 Host

  2. To Install Sun Java System Web Server for Distributed Authentication User Interface 2

  3. To Configure the WAR for Distributed Authentication User Interface 2

  4. To Deploy the Distributed Authentication User Interface 2 WAR

  5. To Import the Access Manager Load Balancer Certificate Authority Root Certificate into the Distributed Authentication User Interface 2

  6. To Verify that Authentication Through the Distributed Authentication User Interface 2 is Successful

ProcedureTo Create a Non-Root User on the Distributed Authentication User Interface 2 Host

Create a non-root user with the roleadd command in the Solaris Operating Environment on the Distributed Authentication User Interface (AuthenticationUI–2) host machine

  1. As a root user, log in to the AuthenticationUI–2 host machine.

  2. Use roleadd to create a new user.


    # roleadd -s /sbin/sh -m -g staff -d /export/da71adm da71adm

  3. (Optional) Verify that the user was created.


    # cat /etc/passwd

root:x:0:0:Super-User:/:/sbin/sh
daemon:x:1:1::/:
...
nobody4:x:65534:SunOS 4.x NFS Anonymous Access User:/:
da71adm:x:215933:10::/export/da71adm:/sbin/sh

  4. (Optional) Verify that the user's directory was created.


    # cd /export/da71adm
# ls

local.cshrc    local.profile    local.login

  5. (Optional) Create a password for the non-root user.


    # passwd da71adm 
New Password: 6a714dm
Re-ener new Pasword:6a714dm

passwd: password successfully changed for da71adm
    Note –

    If you do not perform this step, you will not be able to switch user (su) when logged in as the non-root user.

ProcedureTo Install Sun Java System Web Server for Distributed Authentication User Interface 2

Before You Begin

  1. On the AuthenticationUI–2 host machine, install required patches if necessary.

    In this case, the Release Notes indicate that based on the hardware and operating system being used, patch 118855-36 and patch 119964–08 are required.

    1. Run patchadd to see if the patches are already installed.


      # patchadd -p | grep 118855-36

      No results are returned which indicates that the patch is not yet installed on the system.


      # patchadd -p | grep 119964-08

      No results are returned which indicates that the patch is not yet installed on the system.

    2. Make a directory for downloading the patches you need and change into it.


      # mkdir /export/patches
# cd /export/patches

    3. Download the patches.

      You can search for patches directly at http://sunsolve.sun.com. Navigate to the PatchFinder page, enter the patch number, click Find Patch, and download the appropriate patch.

      Note –

      Signed patches are downloaded as JAR files. Unsigned patches are downloaded as ZIP files.

    4. Unzip the patch files.


      # unzip 118855–36.zip
# unzip 119964-08.zip

    5. Run patchadd to install the patches.


      # patchadd /export/patches/118855-36
# patchadd /export/patches/119964-08
      Tip –

      You can use the -M option to install all patches at once. See the patchadd man page for more information.

    6. After installation is complete, run patchadd to verify that each patch was added successfully.


      # patchadd -p | grep 118855–36

      In this example, a series of patch numbers are displayed, and the patch 118855–36 is present.


      # patchadd -p | grep 119964-08

      In this example, a series of patch numbers are displayed, and the patch 119964-08 is present.

  2. Create a directory into which you can download the Web Server bits and change into it.


    # mkdir /export/WS7
# cd /export/WS7

  3. Download the Sun Java System Web Server 7.0 software from http://www.sun.com/download/products.xml?id=45ad781d.

    Follow the instructions on the Sun Microsystems Product Downloads web site for downloading the software.

  4. Unpack the software package.


    # gunzip sjsws-7_0-solaris-amd64.tar.gz
# tar xvf sjsws-7_0-solaris-amd64.tar

  5. Run setup.


    # cd /export/WS7
# ./setup --console

  6. When prompted, provide the following information.


    You are running the installation program 
for the Sun Java System Web Server 7.0.
...
The installation program pauses as questions 
are presented so you can read the 
information and make your choice.  
When you are ready to continue, press Enter.

    Press Enter. 

    Continue to press Enter when prompted. 

    		 

    Have you read the Software License 
Agreement and do you accept all the terms?

    Enter yes.

    		 

    Sun Java System Web Server 7.0 
Installation Directory [/sun/webserver7]

    Enter /opt/SUNWwbsvr 


    Specified directory /opt/SUNWwbsvr 
does not exist.  Create Directory? [Yes/No]

    Enter yes.

    		 

    Select Type of Installation

1. Express
2. Custom
3. Exit
What would you like to do? [1]

    Enter 2.

    		 

    Component Selection

1. Server Core
2. Server Core 64-biy Binaries
3. Administration Command Line Interface
4. Sample Applications
5. Language Pack
Enter the comma-separated list [1,2,3,4,5]

    Enter 1,3,5.

    		 

    Java Configuration
1. Install Java Standard Edition 1.5.0_09
2. Reuse existing Java SE 1.5.0_09 or greater
3. Exit
What would you like to do? [1]

    Enter 1.

    		 

    Administrative Options
1. Create an Administration Server and a 
   Web Server Instance
2. Create an Administration Node
Enter your option. [1]

    Enter 1.

    		 

    Start servers during system startup. [yes/no]

    Enter no.

    		 

    Host Name [AuthenticationUI-2.example.com]

    Accept the default value. 

    		 

    SSL Port [8989]

    Accept the default value. 

    		 

    Create a non-SSL Port? [yes/no]

    Enter no.

    		 

    Runtime User ID [root]

    Enter da71adm.

    		 

    Administrator User Name [admin]

    Accept the default value. 

    		 

    Administrator Password:

    Enter web4dmin.

    		 

    Retype Password:

    Enter web4dmin.

    		 

    Server Name [AuthenticationUI-2.example.com]

    Accept the default value. 

    		 

    Http Port [8080]

    Enter 1080.

    		 

    Document Root Directory [/opt/SUNWwbsvr/
https-AuthenticationUI-2.example.com/docs]

    Accept the default value. 

    		 

    Ready To Install
1. Install Now
2. Start Over
3. Exit Installation
What would you like to do?

    Enter 1.

    When installation is complete, the following message is displayed:


    Installation Successful.

  7. To verify that Web Server was installed with the non-root user, examine the permissions.


    # cd /opt/SUNWwbsvr/admin-server
# ls -al

total 16
drwxr-xr-x   8 root     root         512 Jul 19 10:36 .
drwxr-xr-x  11 da71adm  staff        512 Jul 19 10:36 ..
drwxr-xr-x   2 root     root         512 Jul 19 10:36 bin
drwx------   2 da71adm  staff        512 Jul 19 10:36 config
drwx------   3 da71adm  staff        512 Jul 19 11:09 config-store
drwx------   3 da71adm  staff        512 Jul 19 10:40 generated
drwxr-xr-x   2 da71adm  staff        512 Jul 19 10:40 logs
drwx------   2 da71adm  staff        512 Jul 19 10:36 sessions

    The appropriate files and directories are owned by da71adm.

  8. Start the Web Server administration server.


    # su da71adm
# cd /opt/SUNWwbsvr/admin-server/bin
# ./startserv

  9. To verify that the non-root user was able to start Web Server, access https://AuthenticationUI-2.example.com:8989 from a web browser.

    1. Log in to the Web Server console as the administrator.

      User Name:

      admin

      Password:

      web4dmin

      The Web Server administration console opens.

    2. Log out of the console and close the browser.

  10. Log out of the AuthenticationUI–2 host machine.

ProcedureTo Configure the WAR for Distributed Authentication User Interface 2

This procedure configures the amauthdistui.war that will be used for deployment in To Deploy the Distributed Authentication User Interface 2 WAR.

  1. As a root user, log in to the AuthenticationUI–2 host machine.

  2. Switch to the non-root user.


    # su da71adm

  3. Change to the directory into which you will copy amDistAuth.zip.


    # cd /export/da71adm

    amDistAuth.zip contains the files you need to install the Distributed Authentication User Interface. It is included in the Access Manager software downloaded in 6.2 Deploying and Configuring Access Manager 1 and Access Manager 2.

  4. Copy amDistAuth.zip from the AccessManager–1 host machine.


    # cd /export/da71adm
# ftp AccessManager-1.example.com

Connected to AccessManager-1.example.com
220 AccessManager-1.example.com FTP server ready.
Name (AccessManager-1.example.com:username):username
Password: ********
...
Using binary mode to transfer files
ftp> cd /export/AM71/applications
CWD command successful
ftp> mget amDistAuth.zip?
mget amDistAuth.zip? y
200 PORT command successful
ftp> bye

  5. List the contents of /export/da71adm to verify that amDistAuth.zip was transferred and is owned by the non-root user.


    # ls -al

total 26496
drwxr-xr-x   5 da71adm  staff        512 Jul 19 20:59 .
drwxr-xr-x   7 root     sys          512 Jul 20 10:13 ..
-rw-r--r--   1 da71adm  staff        144 Jul 19 19:53 .profile
drwx------   3 da71adm  staff        512 Jul 19 20:41 .sunw
-rw-r--r--   1 da71adm  staff    6747654 Jul 19 20:43 amDistAuth.zip

  6. Unzip amDistAuth.zip.


    # unzip amDistAuth.zip

  7. List the contents again to verify the unzip.


    # ls -al

total 26496
drwxr-xr-x   5 da71adm  staff        512 Jul 19 20:59 .
drwxr-xr-x   7 root     sys          512 Jul 20 10:13 ..
-rw-r--r--   1 da71adm  staff        144 Jul 19 19:53 .profile
drwx------   3 da71adm  staff        512 Jul 19 20:41 .sunw
-rw-r--r--   1 da71adm  staff        572 Jul 19 20:59 .wadmtruststore
-rw-r--r--   1 da71adm  staff    6772566 Jul 19 20:56 amauthdistui.war
-rw-r--r--   1 da71adm  staff    6747654 Jul 19 20:43 amDistAuth.zip
drwxr-xr-x   2 da71adm  staff        512 Jul 19 20:52 lib
-rw-r--r--   1 da71adm  staff        136 Jul 19 19:53 local.cshrc
-rw-r--r--   1 da71adm  staff        157 Jul 19 19:53 local.login
-rw-r--r--   1 da71adm  staff        174 Jul 19 19:53 local.profile
-rw-r--r--   1 da71adm  staff      10038 Mar 19 15:33 README.distAuthUI
-rw-r--r--   1 da71adm  staff       1865 Mar 19 15:31 setup.bat
-rw-r--r--   1 da71adm  staff       1865 Mar 19 15:31 setup.sh
drwxr-xr-x   3 da71adm  staff        512 Jun 25 20:13 WEB-INF

  8. Change permissions on setup.sh, the Distributed Authentication User Interface configuration script.


    # chmod +x setup.sh

    This gives the non-root user permission to run the script that configures the Distributed Authentication User Interface WAR for its deployment.

  9. Run setup.sh.


    # ./setup.sh
    Caution – Caution –

    If using a shell other than sh, you must modify the setup script before running it.

    1. Open setup.sh in a text editor.

    2. Add #!/bin/sh as the first line of the file.

    3. Save and close the file.

    4. Run the script.

  10. Provide the following information.


    Debug directory (make sure this
directory exists):

    Enter /tmp/distAuth 


    Application username:

    Enter authuiadmin 


    Application password:

    Enter 4uthu14dmin 


    Protocol of the server:

    Enter http 


    Host name of the server:

    Enter LoadBalancer-3.example.com 


    Port of the server:

    Enter 7070 


    Server's deploymen URI:

    Enter amserver 


    Naming URL (hit enter to accept default 
value, http://LoadBalancer-3.example.com:7070/
amserver/namingservice)

    Press Enter to accept the default value. 

    		 

    Protocol of the distauth server:

    Enter http 


    Host name of the distauth server:

    Enter AuthenticationUI-2.example.com 


    Port of the distaut server:

    Enter 1080 


    Distauth Server's deployment URI:

    Enter distAuth 


    Notification URL (hit enter to accept default 
value, http://AuthenticationUI-2.example.com:1080/
distAuth/notificationservice)

    Press Enter to accept the default value. 

    After running the script, amauthdistui.war is updated with the above values. The next step is To Deploy the Distributed Authentication User Interface 2 WAR.

ProcedureTo Deploy the Distributed Authentication User Interface 2 WAR

Before You Begin

This procedure assumes you just completed To Configure the WAR for Distributed Authentication User Interface 2 and are still logged into the AuthenticationUI–2 host machine as the non-root user.

  1. Start the Web Server administration server.


    # cd /opt/SUNWwbsvr/admin-server/bin
# ./startserv

  2. Add the Distributed Authentication User Interface WAR.


    # cd /opt/SUNWwbsvr/bin
# ./wadm add-webapp --user=admin --host=AuthenticationUI-2.example.com
  --port=8989 --config=AuthenticationUI-2.example.com 
  --vs=AuthenticationUI-2.example.com 
  --uri=/distAuth /export/da71adm/amauthdistui.war

Please enter admin-user-password:web4dmin
...
Do you trust the above certificate? [y|n] y

CLI201 Command 'add-webapp' ran successfully

  3. Deploy the Distributed Authentication User Interface WAR.


    # ./wadm deploy-config --user=admin --host=AuthenticationUI-2.example.com 
  --port=8989 AuthenticationUI-2.example.com
Please enter admin-user-password: web4dmin

CLI201 Command 'deploy-config' ran successfully

  4. Restart the Web Server AuthenticationUI-2 instance.


    # cd /opt/SUNWwbsvr/https-AuthenticationUI-2.example.com/bin
# ./stopserv; ./startserv

  5. Verify that the distAuth web module is loaded.


    # cd /opt/SUNWwbsvr/https-AuthenticationUI-2.example.com/
  web-app/AuthenticationUI-2.example.com
# ls -al

total 6
drwxr-xr-x   3 da71adm  staff        512 Jul 19 21:00 .
drwxr-xr-x   3 da71adm  staff        512 Jul 19 21:00 ..
drwxr-xr-x   8 da71adm  staff        512 Jul 19 21:00 distAuth

  6. Log out of the AuthenticationUI–2 host machine.

ProcedureTo Import the Access Manager Load Balancer Certificate Authority Root Certificate into the Distributed Authentication User Interface 2

Import a Certificate Authority (CA) root certificate that enables the Distributed Authentication User Interface to trust the SSL certificate from the Access Manager Load Balancer 3, and establish trust with the certificate chain that is formed from the CA to the certificate.

  1. As a root user, log in to the AuthenticationUI–2 host machine.

  2. Copy the CA root certificate into a directory.

    Use the same root certificate installed in To Import a Certificate Authority Root Certificate on the Access Manager Load Balancer. In this example, the file is /export/software/ca.cer.

  3. Import the CA root certificate into the Java keystore.


    # /opt/SUNWwbsvr/jdk/jre/bin/keytool -import -trustcacerts 
  -alias OpenSSLTestCA -file /export/software/ca.cer 
  -keystore /opt/SUNWwbsvr/jdk/jre/lib/security/cacerts 
  -storepass password

Owner: EMAILADDRESS=nobody@nowhere.com, CN=OpenSSLTestCA, OU=Sun, 
O=Sun,L=Santa Clara, ST=California C=US
Issuer: EMAILADDRESS=nobody@nowhere.com, CN=OpenSSLTestCA, OU=Sun, 
O=Sun,L=Santa Clara, ST=California C=US
Serial number: 97dba0aa26db6386
Valid from: Tue Apr 18 07:66:19 PDT 2006 until: Tue Jan 13 06:55:19 
PST 2009
Certificate fingerprints:
				MD5: 9f:57:ED:B2:F2:88:B6:E8:0F:1E:08:72:CF:70:32:06
     SHA1: 31:26:46:15:C5:12:5D:29:46:2A:60:A1:E5:9E:26:64:36:80:E4:70

Trust this certificate: [no] yes

Certificate was added to keystore.

  4. Verify that the CA root certificate was imported into the keystore.


    # /opt/SUNWwbsvr/jdk/jre/bin/keytool -list 
  -keystore /opt/SUNWwbsvr/jdk/jre/lib/security/cacerts 
  -storepass password | grep -i open

openssltestca, Nov 8, 2006, trustedCertEntry

  5. Restart the Web Server AuthenticationUI-2 instance.


    # cd /opt/SUNWwbsvr/https-AuthenticationUI-2.example.com/bin
# ./stopserv

server has been shutdown

# ./startserv

Sun Java System Web Server 7.0 B12/04/2006 07:59
info: CORE5076: Using [Java HotSpot(TM) Server VM, 
Version 1.5.0_09] from [Sun Microsystems Inc.]
info: WEB0100: Loading web module in virtual server 
[AuthenticationUI-2.example.com] at [/distAuth]
info: HTTP3072: http-listener-1: http://AuthenticationUI-2.
example.com:1080 ready to accept requests
info: CORE3274: successful server startup

  6. Log out of the AuthenticationUI–2 host machine.

ProcedureTo Verify that Authentication Through the Distributed Authentication User Interface 2 is Successful

Find a host that has direct network connectivity to Distributed Authentication User Interface 2 and the external facing load balancer of the Access Manager servers. One natural place is the AuthenticationUI–2 host machine itself.

  1. As a root user, log into the AuthenticationUI–2 host machine.

  2. Modify AMConfig.properties.

    1. Change to the classes directory.


      # cd /opt/SUNWwbsvr/https-AuthenticationUI-2.example.com/
  web-app/AuthenticationUI-2.example.com/distAuth/WEB-INF/classes
      Tip –

      Backup AMConfig.properties before you modify it.

    2. Set the values of the properties as follows.

      com.iplanet.am.naming.url=https://LoadBalancer-3.
  example.com:9443/amserver/namingservice
com.iplanet.am.server.protocol=https
com.iplanet.am.server.port=9443

    3. Save the file and close it.

  3. Restart the AuthenticationUI-2 host machine.


    # cd /opt/SUNWwbsvr/https-AuthenticationUI-2.example.com/bin
# ./stopserv; ./startserv

  4. Access http://AuthenticationUI-2.example.com:1080/distAuth/UI/Login?goto= http://LoadBalancer-3.example.com:7070 from a web browser.

  5. Log in to the Access Manager console as the administrator.

    Username

    amadmin

    Password

    4m4dmin1

    After successful authentication, you should be redirected to the index page for the Web Server in which Access Manager is deployed.

  6. Log out of the Access Manager console.