test

Technical Note: Host Name Changes in a Sun Java System Access Manager 7.1 WAR Deployment

Changing the Host Machine Name or Domain in Access Manager Deployed in a Federation Environment

If the host machine name or domain is configured in an instance of Access Manager that acts as an identity provider or service provider in a federation environment, the following changes also need to be made, depending upon the federation protocol used.

You only need to change the hosted or remote entities that contain a host machine name or domain that has changed, For example, if the host name of machine A has changed, you need to change the metadata for all entities hosted on machine A. If the metadata for those entities hosted on machine A was imported to machine B, you also need to change the remote metadata (for A) on machine B.

Tip –

By default, saml2meta, the command line utility used in this section, uses the top-level realm as input when the --realm option is not defined. If you are making changes to a sub-realm, use the --realm option with a value of /sub-realm-name.

ProcedureTo Make Changes for SAML v2

If the host machine name or domain is configured in an instance of Access Manager that acts as an identity provider or service provider in a SAML v2 environment, use this procedure. As Access Manager has no console support for SAML v2, changes to the URLs configured in the metadata files need to be made on the command-line on both the identity provider and the service provider sides.

  1. Run the following command to export the standard and extended metadata from the identity provider machine.


    # /opt/SUNWam/saml2/bin/saml2meta export 
  --runasdn amadmin --password passwd-for-amadmin 
  --realm realm-name --entityid "IDP-OLD-FQDN" 
  --metadata /tmp/metadata.xml --extended /tmp/ext_metadata.xml
    Tip –

    If you receive the following exception:

    com.iplanet.sso.SSOException: Invalid sessionid 
  formatjava.lang.IllegalArgumentException: 
Invalid server id in session id com.iplanet.services.naming.
  ServerEntryNotFoundException: Cannot find server.
   at com.iplanet.sso.providers.dpro.SSOProviderImpl.
    createSSOToken(SSOProviderImpl.java:177)
   at com.iplanet.sso.SSOTokenManager.createSSOToken(SSOTokenManager.java:305)
   at com.sun.identity.authentication.AuthContext.getSSOToken(AuthContext.java:1070)

    append the following line to AMConfig.properties, restart Access Manager, and run the saml2meta export again.

    com.iplanet.am.naming.ignoreNamingService=true

  2. Run the following command to delete the standard and extended metadata just exported from the identity provider machine.


    # /opt/SUNWam/saml2/bin/saml2meta delete 
  --runasdn amadmin --password passwd-for-amadmin 
  --realm realm-name --entityid "IDP-OLD-FQDN"

Descriptor and config for entity "IDP-OLD-FQDN" was deleted successfully.

  3. Change all occurrences of "IDP-OLD-FQDN" to "IDP-NEW-FQDN" in the exported files, /tmp/metadata.xml and /tmp/ext_metadata.xml.

  4. Run the following command to import the modified metadata files to the identity provider.


    # /opt/SUNWam/saml2/bin/saml2meta import 
  --runasdn amadmin --password passwd-for-amadmin 
  --realm realm-name --entityid "IDP-OLD-FQDN"
  --metadata /tmp/metadata.xml --extended /tmp/ext_metadata.xml

File "/tmp/metadata.xml" was imported successfully. 
File "/tmp/ext_metadata.xml" was imported successfully.

  5. Run the following command to export the standard and extended metadata from the service provider machine.


    # /opt/SUNWam/saml2/bin/saml2meta -i /var/opt/SUNWam/fm/war_staging export 
  --runasdn amadmin --password passwd-for-amadmin 
  --entityid "IDP-OLD-FQDN" 
  --metadata /tmp/metadata.xml --extended /tmp/ext_metadata.xml

Entity descriptor was exported to file "/tmp/metadata.xml" successfully.
Entity config was exported to file "/tmp/ext_metadata.xml" successfully.

  6. Run the following command to delete the standard and extended metadata from the service provider machine.


    # /opt/SUNWam/saml2/bin/saml2meta -i /var/opt/SUNWam/fm/war_staging delete 
  --runasdn amadmin --password passwd-for-amadmin 
  --entityid "IDP-OLD-FQDN"

Descriptor and config for entity "IDP-OLD-FQDN" was deleted successfully.

  7. Change all occurrences of "IDP-OLD-FQDN" to "IDP-NEW-FQDN" in the files exported from the service provider machine, /tmp/metadata.xml and /tmp/ext_metadata.xml.

  8. Run the following command to import the modified metadata files to the service provider.


    # /opt/SUNWam/saml2/bin/saml2meta -i /var/opt/SUNWam/fm/war_staging import 
  --runasdn amadmin --password passwd-for-amadmin 
  --metadata /tmp/metadata.xml --extended /tmp/ext_metadata.xml

File "/tmp/metadata.xml" was imported successfully. 
File "/tmp/ext_metadata.xml" was imported successfully.

ProcedureTo Make Changes for the Liberty Alliance Project Identity Federation Framework

If the host machine name or domain is configured in an instance of Access Manager that acts as an identity provider or service provider in a Liberty Alliance Project Identity Federation Framework (Liberty ID-FF) environment, use this procedure to make changes to the following:

  1. Login to the Access Manager console as amadmin.

  2. Change the entity descriptor files.

    1. Click the Federation tab.

    2. Click the Entities tab.

    3. Change the host machine name in the appropriate General, Identity Provider and Service Provider attributes for entries in the Entities table.

    4. Click Save to save the changes.

  3. Make changes to the Discovery Service.

    1. From the Access Manager console home page, click the Web Services tab.

    2. Click Discovery Service.

    3. Change the host name in the Provider ID URL.

    4. Click the Provider ID under Classes for ResourceID Mapper Plug-in.

    5. Change the host machine name in the Provider ID attribute and click Save.

    6. Click the configured Service Type entry name under Resource Offerings for Bootstrapping.

    7. Change the host machine name in the Provider ID attribute and click Save.

    8. Click Edit for the entry under Service Description.

    9. Change the host machine name in the value of the End Point URL attribute.

    10. Click Save to save the changes.

  4. Make changes to the Liberty Personal Profile Service.

    1. Under Web Services, click Personal Profile.

    2. Change the host machine name in the value of the Provider ID attribute.

    3. Click Save to save the changes.

  5. Log out of the Access Manager console.

ProcedureTo Make Changes for SAML v1

If the host machine name or domain is configured in an instance of Access Manager that acts as an identity provider or service provider in a SAML v1 environment, use this procedure to make the appropriate changes.

  1. Login to the Access Manager console as amadmin.

  2. Click the Federation tab.

  3. Click the SAML tab.

  4. Click the Instance ID of the relevant entry under Site Identifier.

  5. Change the host machine name in the value of the Instance ID and Issuer Name attributes.

  6. Click Save to save the changes.

  7. Click Save on the SAML Profile page.

  8. Click the Instance ID of the relevant entry under Trusted Partners, if applicable.

  9. Change the host machine name in the URL endpoints of the relevant entries in the list of Trusted Partners.

  10. Click Save to save the changes.

  11. Click Save on the SAML Profile page.

  12. Log out of the Access Manager console.