Post-Installation of Agent for SAP Enterprise Portal 7.0/Web Application Server 7.0: SAP Web Application Server 7.0

Perform the tasks in this section if you are configuring Agent for SAP Enterprise Portal 7.0/Web Application Server 7.0 on SAP Web Application Server 7.0. This section includes a variety of short configuration tasks that are required for the agent to work on this specific deployment container. Complete all the tasks described in this section before performing the applicable tasks described in Conditional Post-Installation Steps for J2EE Agents in Policy Agent 2.2.

To Install the Agent Filter for the Deployed Application on SAP Web Application Server 7.0

The agent filter can be installed by modifying the deployment descriptor of the application to be protected. The following steps explain how to install the agent filter for the application you want the agent to protect:

1. To install the agent filter, ensure that the application is not currently deployed on SAP Enterprise Portal 7.0/Web Application Server 7.0.

   If it is currently deployed, remove it before proceeding any further.

2. Create the necessary backups before proceeding to modify these descriptors.

   Since you will modify the deployment descriptor in the next step, creating backup files at this point is important.

3. Edit the application's web.xml descriptor as follows:

   1. Set the <DOCTYPE> element as shown in the following code example:

      <!DOCTYPE web-app version="2.4" xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">

      SAP Enterprise Portal 7.0/Web Application Server 7.0 supports the Java Servlet Specification version 2.4.

      Note that Servlet API version 2.4 is fully backward compatible with version 2.3. Therefore, all existing servlets should work without modification or recompilation.

   2. Edit the application's web.xml descriptor.

      Add the <filter> elements in the deployment descriptor. Do this by specifying the <filter>, <filter-mapping>, and <dispatcher> elements immediately following the description element of the <web-app> element in the descriptor web.xml. The following code example displays a sample web.xml descriptor with the <filter>, <filter-mapping>, and <dispatcher> elements added.

      <web-app> .. .. <filter> <filter-name>Agent</filter-name> <filter-class> com.sun.identity.agents.filter.AmAgentFilter </filter-class> </filter> <filter-mapping> <filter-name>Agent</filter-name> <url-pattern>/*</url-pattern> <dispatcher>REQUEST</dispatcher> <dispatcher>INCLUDE</dispatcher> <dispatcher>FORWARD</dispatcher> <dispatcher>ERROR</dispatcher> </filter-mapping> .. .. </web-app>

   If you want to protect your application with J2EE declarative security, refer to the PolicyAgentBase/sampleapp directory to learn how to build and deploy an application. The sampleapp directory is by no means a full fledged J2EE application. Rather it is a simple application that provides you with a quick reference to application specific deployment descriptors and various deployment modes of a J2EE agent. Once you successfully deploy sampleapp and test all of its features, you can use it as a reference to other applications that will be protected by the J2EE agent.

   Once the web.xml deployment descriptor is modified to reflect the new <DOCTYPE> and <filter> elements, the agent filter is added to the application. You can now redeploy your application on SAP Enterprise Portal 7.0/Web Application Server 7.0.

   ---

   Note –

   Ensure that role-to-principal mappings in container specific deployment descriptors are replaced with Access Manager roles or principals. You can retrieve Access Manager roles or principals for Access Manager 7 by issuing the agentadmin --getUuid command. For more information on the agentadmin --getUuid command, see agentadmin --getUuid.

   You can also retrieve the universal ID for the user (UUID) using Access Manager 7 Console to browse the user profile.

   ---

To Add a Reference From Protected Application to the New AmSAPAgent2.2 Library for SAP Web Application Server 7.0

This is one of the post-installation tasks required when Agent for SAP Enterprise Portal 7.0/Web Application Server 7.0 has been installed on SAP Web Application Server 7.0.

This task description explains how to add a library reference from the sap.com/app-context application to the newly deployed AmSAPAgent2.2 library.

Use the command line for this task.

1. Telnet to the J2EE telnet port by issuing a command such as the following:

   $ telnet j2ee-engine-host instance-telnet-port

   j2ee-engine-host

   represents the machine that hosts the SAP Web Application Server 7.0 instance.

   instance-telnet-port

   represents the port number of the telnet administration service of the SAP Enterprise Portal 7.0/Web Application Server 7.0 instance.

   The following example demonstrates the format of the telnet command to issue:

   telnet saphost.example.com 50008

   After you issue a command similar to the preceding command, a message such as the following appears:

   Telnet Administration 
           [SAP J2EE Engine]
   
           Login:
           Password:

2. Log in using Administrator as the user and the corresponding Administrator password.

3. Issue the following command:

   $ jump 0

   A message such as the following appears:

   You jumped on node 56457550

4. Issue the following command:

   $ add deploy

5. Issue the following command:

   $ CHANGE_REF -m sap.com/app-context library:AmSAPAgent2.2

   The following message appears:

   The reference between application sap.com/app-context and 
   library:AmSAPAgent2.2 was made!

To Provide Access to the New Login Module for SAP Web Application Server 7.0

This is one of the post-installation tasks required when Agent for SAP Enterprise Portal 7.0/Web Application Server 7.0 has been installed on SAP Web Application Server 7.0.

This task description explains how to add the new login module to the J2EE engine list of login modules.

1. (Conditional) If the SAP Web Application Server 7.0 is not running, start it now.

2. Start the Visual Administration tool.

   The following example provides the path to the Visual Administration tool on UNIX systems:

   /usr/sap/SID/instanceName/j2ee/admin/go

   SID

   represents the SAP system ID.

   instanceName

   represents the SAP Web Application Server 7.0 instance.

3. Log in to the Visual Administration tool.

   For a graphical representation of the Visual Administration tool as described in the steps that follow in this task, see Figure 4–12.

4. Select the Security Provider service.

5. Select the User Management tab.

6. Switch to the edit mode by clicking the pencil icon in the far left corner of the right panel.

7. Click Manage Security Stores

8. Click Add Login Module.

   A dialog box appears.

9. Click OK.

10. In the Class Name text field, enter the following:

    com.sun.identity.agents.sap.v70.AmSAPWASLoginModule

11. In the Display Name text field, enter the following:

    AmSAPWASLoginModule

12. Click OK.

    Figure 4–12 SAP Visual Administrator: New Login Module for SAP Web Application Server 7.0

    
    

To Configure Applications to Use the New Login Module for SAP Web Application Server 7.0

This is one of the post-installation tasks required when Agent for SAP Enterprise Portal 7.0/Web Application Server 7.0 has been installed on SAP Web Application Server 7.0.

This task description explains how to use the new login module that you just added to the J2EE engine list of login modules.

Before You Begin

If necessary, start and log in to the Visual Administration tool as detailed in the preceding task description.

1. Select the Security Provider service.

2. Select the User Management tab.

3. In the Components list, select the application you want to configure.

4. In the right pane, remove BasicPasswordLoginModule.

   1. Select BasicPasswordLoginModule.

   2. Click Remove

5. Ensure that no other authentication template is being used at this point.

6. Click Add New.

7. From the list of modules, select AmSAPWASLoginModule.

8. Save the configuration.