- Book Information
- Preface
- Part I Command Line Interface Reference
- Chapter 1 ssoadm Command Line Interface
Reference
- Using the ssoadm Command Line Interface
- ssoadm Subcommands and Options
- Agent Configuration
- Authentication Service Management
- Datastore Management
- Identity Management
- add-member
- add-privileges
- add-svc-identity
- create-identity
- delete-identities
- get-identity
- get-identity-svcs
- list-identities
- list-identity-assignable-svcs
- remove-member
- remove-privileges
- remove-svc-identity
- set-identity-attrs
- set-identity-svc-attrs
- show-identity-ops
- show-identity-svc-attrs
- show-identity-types
- show-members
- show-memberships
- show-privileges
- Realm and Policy Management
- Service Management
- add-attr-defs
- add-attrs
- add-plugin-interface
- add-sub-schema
- create-boot-url
- create-sub-cfg
- create-svc
- create-svrcfg-xml
- delete-attr
- delete-attr-def-values
- delete-sub-cfg
- delete-svc
- export-svc-cfg
- get-attr-defs
- get-revision-number
- import-svc-cfg
- remove-attr-choicevals
- remove-attr-defs
- remove-sub-schema
- set-attr-any
- set-attr-bool-values
- set-attr-choicevals
- set-attr-defs
- set-attr-end-range
- set-attr-i18n-key
- set-attr-start-range
- set-attr-syntax
- set-attr-type
- set-attr-ui-type
- set-attr-validator
- set-attr-view-bean-url
- set-inheritance
- set-plugin-viewbean-url
- set-revision-number
- set-sub-cfg
- set-svc-i18n-key
- set-svc-view-bean-url
- update-svc
- Server Configuration
- add-site-members
- add-site-sec-urls
- clone-server
- create-server
- create-site
- delete-server
- delete-site
- export-server
- get-svrcfg-xml
- import-server
- list-server-cfg
- list-servers
- list-sites
- remove-server-cfg
- remove-site-members
- remove-site-sec-urls
- set-site-pri-url
- set-site-sec-urls
- set-svrcfg-xml
- show-site
- show-site-members
- update-server-cfg
- Federation Management
- Miscellaneous
- Chapter 2 The amadmin Command Line Tool
- The amadmin Command Line Executable
- The amadmin Syntax
- Using amadmin for Federation Management
- Changing from Legacy Mode to Realm Mode
- Using amadmin for Resource Bundles
- The amadmin Command Line Executable
- Chapter 3 The ampassword Command Line Tool
- Chapter 4 The amverifyarchive Command Line Tool
- Chapter 1 ssoadm Command Line Interface
Reference
- Part II OpenSSO Attribute Reference
- Chapter 5 Centralized Agent Configuration
Attributes
- Agent Configuration Attributes
- Web Policy Agent
- J2EE Policy Agent
- Web Service Provider
- Web Service Client Attributes
- STS Client
- Discovery Agent Attributes
- Security Token Service Agent Attributes
- 2.2 Policy Agent
- Agent Authenticator
- Agent Configuration Attributes
- Chapter 6 Federation Attributes for Entity
Providers
- SAMLv2 Entity Provider Attributes
- SAMLv2 Service Provider Customization
- SAMLv2 Identity Provider Customization
- SAMLv2 XACML PDP Customization
- SAMLv2 XACML PEP Customization
- SAMLv2 Attribute Authority Customization
- SAMLv2 Attribute Query Customization
- SAMLv2 Authentication Authority Customization
- ID-FF Entity Provider Attributes
- ID-FF Identity Provider Customization
- ID-FF Service Provider Customization
- WS-Federation Entity Provider Attributes
- SAMLv2 Entity Provider Attributes
- Chapter 7 Configuration Attributes
- Authentication
- Active Directory
- Primary Active Directory Server
- Secondary Active Directory Server
- DN to Start User Search
- DN for Root User Bind
- Password for Root User Bind
- Password for Root User Bind (confirm)
- Attribute Used to Retrieve User Profile
- Attributes Used to Search for a User to be Authenticated
- User Search Filter
- Search Scope
- SSL Access to Active Directory Server
- Return User DN to Authenticate
- Active Directory Server Check Interval
- User Creation Attributes
- Authentication Level
- Anonymous
- Authentication Configuration
- Certificate
- Match Certificate in LDAP
- Subject DN Attribute Used to Search LDAP for Certificates
- Match Certificate to CRL
- Issuer DN Attribute Used to Search LDAP for CRLs
- HTTP Parameters for CRL Update
- OCSP Validation
- LDAP Server Where Certificates are Stored
- LDAP Start Search DN
- LDAP Server Principal User
- LDAP Server Principal Password
- LDAP Server Principal Password (confirm)
- Use SSL for LDAP Access
- Certificate Field Used to Access User Profile
- Other Certificate Field Used to Access User Profile
- SubjectAltNameExt Value Type to Access User Profile
- Trusted Remote Hosts
- SSL Port Number
- HTTP Header Name for Client Certificate
- Authentication Level
- Core
- Pluggable Authentication Module Classes
- Supported Authentication Module for Clients
- LDAP Connection Pool Size
- Default LDAP Connection Pool Size
- User Profile
- Remote Auth Security
- Administrator Authentication Configuration
- User Profile Dynamic Creation Default Roles
- Persistent Cookie Mode
- Persistent Cookie Maximum Time
- Alias Search Attribute Name
- Default Authentication Locale
- Organization Authentication Configuration
- Login Failure Lockout Mode
- Login Failure Lockout Count
- Login Failure Lockout Interval
- Email Address to Send Lockout Notification
- Warn User After N Failures
- Login Failure Lockout Duration
- Lockout Duration Multiplier
- Lockout Attribute Name
- Lockout Attribute Value
- Default Success Login URL
- Default Failure Login URL
- Authentication Post Processing Class
- Generate UserID Mode
- Pluggable User Name Generator Class
- Identity Types
- Pluggable User Status Event Classes
- Store Invalid Attempts in Data Store
- Module-based Authentication
- User Attribute Mapping to Session Attribute
- Default Authentication Level
- Data Store
- Federation
- HTTP Basic
- JDBC
- Connection Type
- Connection Pool JNDI Name
- JDBC Driver
- JDBC URL
- Connect This User to Database
- Password for Connecting to Database
- Password for Connecting to Database Confirm
- Password Column String
- Prepared Statement
- Class to Transform Password Syntax
- Authentication Level
- To Configure a Connection Pool — Example
- LDAP
- Primary LDAP Server
- Secondary LDAP Server
- DN to Start User Search
- DN for Root User Bind
- Password for Root User Bind
- Password for Root User Bind (confirm)
- Attribute Used to Retrieve User Profile
- Attributes Used to Search for a User to be Authenticated
- User Search Filter
- Search Scope
- SSL to Access LDAP Server
- Return User DN to Authenticate
- LDAP Server Check Interval
- User Creation Attribute List
- Authentication Level
- Membership
- MSISDN
- Trusted Gateway IP Address
- MSISDN Number Argument
- LDAP Server and Port
- LDAP Start Search DN
- Attribute To Use To Search LDAP
- LDAP Server Principal User
- LDAP Server Principal Password
- LDAP Server Principal Password (confirm)
- SSL for LDAP Access
- MSISDN Header Search Attribute
- LDAP Attribute Used to Retrieve User Profile
- Return User DN on Authentication
- Authentication Level
- RADIUS
- SAE
- SafeWord
- SecurID
- Unix
- Windows Desktop SSO
- Windows NT
- Active Directory
- Console Properties
- Global Properties
- Common Federation Configuration
- Datastore SPI Implementation Class
- Configuration Instance SPI Implementation Class
- Logger SPI Implementation Class
- Session Provider SPI Implementation Class
- Maximum Allowed Content Length
- Password Decoder SPI Implementation Class
- Signature Provider SPI Implementation Class
- Key Provider SPI Implementation Class
- Check Presence of Certificates
- XML Cannonicalization Algorithm
- XML Signature Algorithm
- XML Transformation Algorithm
- Liberty ID-FF Service Configuration
- Liberty ID-WSF Security Service
- Liberty Interaction Service
- WSP to Redirect User for Interaction
- WSP to Redirect User for Interaction for Data
- WSP's Expected Duration for Interaction
- WSP to Enforce That returnToURL must be SSL
- WSP to Enforce Return to Host be the Same as Request Host
- HTML Style Sheet Location
- WML Style Sheet Location
- WSP Interaction URL
- WSP Interaction URL if Behind Load Balancer
- List of Interaction URLs of the WSP Cluster (site) Behind the Load Balancer
- Interaction Configuration Class
- Options for WSC to Participate in Interaction
- WSC to Include userInteractionHeader
- WSC to redirect user for Interaction
- WSC's Expected Duration for Interaction
- WSC to Enforce that Redirection URL Must be SSL
- Multi Federation Protocol
- Password Reset
- User Validation
- Secret Question
- Search Filter
- Base DN
- Bind DN
- Bind Password
- Bind Password Confirm
- Password Reset Option
- Password Change Notification Option
- Password Reset
- Personal Question
- Maximum Number of Questions
- Force Change Password on Next Login
- Password Reset Failure Lockout
- Password Reset Failure Lockout Count
- Password Reset Failure Lockout Interval
- Email Address to Send Lockout Notification
- Warn User After N Failures
- Password Reset Failure Lockout Duration
- Password Reset Lockout Attribute Name
- Password Reset Lockout Attribute Value
- Policy Configuration
- Global Properties
- Realm Attributes
- Primary LDAP Server
- LDAP Base DN
- LDAP Users Base DN
- OpenSSO Enterprise Roles Base DN
- LDAP Bind DN
- LDAP Bind Password
- LDAP Bind Password Confirm
- LDAP Organizations Search Filter
- LDAP Organizations Search Scope
- LDAP Groups Search Scope
- LDAP Groups Search Filter
- LDAP Users Search Filter
- LDAP Users Search Scope
- LDAP Roles Search Filter
- LDAP Roles Search Scope
- OpenSSO Roles Search Scope
- LDAP Organization Search Attribute
- LDAP Groups Search Attribute
- LDAP Users Search Attribute
- LDAP Roles Search Attribute
- Maximum Results Returned from Search
- Search Timeout
- LDAP SSL
- LDAP Connection Pool Minimum Size
- Connection Pool Maximum Size
- Selected Policy Subjects
- Selected Policy Conditions
- Selected Policy Referrals
- Subject Results Time To Live
- User Alias
- Selected Response Providers
- Selected Dynamic Response Attributes
- SAMLv2 Service Configuration
- Cache Cleanup Interval
- Attribute Name for Name ID Information
- Attribute Name for Name ID Information Key
- Cookie Domain for IDP Discovery Service
- Cookie Type for IDP Discovery Service
- URL Scheme for IDP Discovery Service
- XML Encryption SPI Implementation Class
- Include Encrypted Key Inside KeyInfo Element
- XML Signing Implementation Class
- XML Signing Certificate Validation
- CA Certificate Validation
- SAMLv2 SOAP Binding
- Security Token Service
- Issuer
- End Point
- Encryption Issued Key
- Encryption Issued Token
- Lifetime for Security Token
- Token Implementation Class
- Certificate Alias Name
- STS End User Token Plug-in Class
- Security Mechanism
- Authentication Chain
- User Credential
- Is Request Signature Verified
- Is Request Header Decrypted
- Is Request Decrypted
- Is Response Signed
- Is Response Encrypted
- Signing Reference Type
- Encryption Algorithm
- Encryption Strength
- Private Key Alias
- Private Key Type
- Public Key Alias of Web Service (WS-Trust) Client
- Kerberos Domain Server
- Kerberos Domain
- Kerberos Service Principal
- Kerberos Key Tab File
- Verify Kerberos Signature
- SAML Attribute Mapping
- NameID Mapper
- Should Include Memberships
- Attribute Namespace
- Trusted Issuers
- Trusted IP Addresses
- Session
- Secondary Configuration Instance
- Maximum Number of Search Results
- Timeout for Search
- Enable Property Change Notifications
- Enable Quota Constraints
- Read Timeout for Quota Constraint
- Exempt Top-Level Admins From Constraint Checking
- Resulting Behavior If Session Quota Exhausted
- Deny User Login When Session Repository is Down
- Notification Properties
- Enable Session Trimming
- Maximum Session Time
- Maximum Idle Time
- Maximum Caching Time
- Active User Sessions
- User
- Common Federation Configuration
- System Properties
- Client Detection
- Logging
- Maximum Log Size
- Number of History Files
- Log File Location
- Log Status
- Log Record Resolve Host Name
- Logging Type
- Database User Name
- Database User Password
- Database User Password (confirm)
- Database Driver Name
- Configurable Log Fields
- Log Verification Frequency
- Log Signature Time
- Secure Logging
- Secure Logging Signing Algorithm
- Logging Certificate Store Location
- Maximum Number of Records
- Number of Files per Archive
- Buffer Size
- DB Failure Memory Buffer Size
- Buffer Time
- Time Buffering
- Logging Level
- Naming
- Profile Service URL
- Session Service URL
- Logging Service URL
- Policy Service URL
- Authentication Service URL
- SAML Web Profile/Artifact Service URL
- SAML SOAP Service URL
- SAML Web Profile/POST Service URL
- SAML Assertion Manager Service URL
- Federation Assertion Manager Service URL
- Security Token Manager URL
- JAXRPC Endpoint URL
- Identity Web Services Endpoint URL
- Identity REST Services Endpoint URL
- Security Token Service Endpoint URL
- Security Token Service MEX Endpoint URL
- Platform
- To Specify a New Character Set
- Servers and Sites
- To Create a New Server Instance
- Inheritance Settings
- General
- Security
- Session
- SDK
- Directory Configuration
- Advanced
- To Create a New Site Instance
- To Edit a Site Instance
- Servers and Sites Console Attribute Maps
- Authentication
- Chapter 8 Data Store Attributes
- Active Directory Attributes
- LDAP Server
- LDAP Bind DN
- LDAP Bind Password
- LDAP Bind Password (confirm)
- LDAP Organization DN
- LDAP SSL
- LDAP Connection Pool Minimum Size
- LDAP Connection Pool Maximum Size
- Maximum Results Returned from Search
- Search Timeout
- LDAP Follows Referral
- LDAPv3 Repository Plugin Class Name
- Attribute Name Mapping
- LDAPv3 Plugin Supported Types and Operations
- LDAPv3 Plug-in Search Scope
- LDAP Users Search Attribute
- LDAP Users Search Filter
- LDAP User Object Class
- LDAP User Attributes
- Create User Attribute Mapping
- Attribute Name of User Status
- User Status Active Value
- User Status Inactive Value
- LDAP Groups Search Attribute
- LDAP Group Search Filter
- LDAP Groups Container Naming Attribute
- LDAP Groups Container Value
- LDAP Groups Object Classes
- LDAP Groups Attributes
- Attribute Name for Group Membership
- Attribute Name of Unique Member
- Attribute Name of Group Member URL
- LDAP People Container Naming Attribute
- LDAP People Container Value
- Identity Types That Can be Authenticated
- Authentication Naming Attribute
- Persistent Search Base DN
- Persistent Search Filter
- Persistent Search Scope
- Persistent Search Maximum Idle Time Before Restart
- Maximum Number of Retries After Error Code
- The Delay Time Between Retries
- LDAPException Error Codes to Retry
- Caching
- Maximum Age of Cached Items
- Maximum Size of the Cache
- Generic LDAPv3 Attributes
- LDAP Server
- LDAP Bind DN
- LDAP Bind Password
- LDAP Bind Password (confirm)
- LDAP Organization DN
- LDAP SSL
- LDAP Connection Pool Minimum Size
- LDAP Connection Pool Maximum Size
- Maximum Results Returned from Search
- Search Timeout
- LDAP Follows Referral
- LDAPv3 Repository Plugin Class Name
- Attribute Name Mapping
- LDAPv3 Plugin Supported Types and Operations
- LDAPv3 Plug-in Search Scope
- LDAP Users Search Attribute
- LDAP Users Search Filter
- LDAP User Object Class
- LDAP User Attributes
- Create user Attribute Mapping
- Attribute Name of User Status
- User Status Active Value
- User Status Inactive Value
- LDAP Groups Search Attribute
- LDAP Group Search Filter
- LDAP Groups Container Naming Attribute
- LDAP Groups Container Value
- LDAP Groups Object Classes
- LDAP Groups Attributes
- Attribute Name for Group Membership
- Attribute Name of Unique Member
- Attribute Name of Group Member URL
- Default Group Member's User DN
- LDAP People Container Naming Attribute
- LDAP People Container Value
- Identity Types That Can Be Authenticated
- Persistent Search Base DN
- Persistent Search Filter
- Persistent Search Scope
- Persistent Search Maximum Idle Time Before Restart
- Maximum Number of Retries After Error Code
- The Delay Time Between Retries
- LDAPException Error Codes to Retry
- Caching
- Maximum Age of Cached Items
- Maximum Size of the Cache
- Sun Directory Server with OpenSSO Enterprise
Schema Attributes
- LDAP Server
- LDAP Bind DN
- LDAP Bind Password
- LDAP Bind Password (confirm)
- LDAP Organization DN
- LDAP SSL
- LDAP Connection Pool Minimum Size
- LDAP Connection Pool Maximum Size
- Maximum Results Returned from Search
- Search Timeout
- LDAP Follows Referral
- LDAPv3 Repository Plugin Class Name
- Attribute Name Mapping
- LDAPv3 Plugin Supported Types and Operations
- LDAPv3 Plug-in Search Scope
- LDAP Users Search Attribute
- LDAP Users Search Filter
- LDAP User Object Class
- LDAP User Attributes
- Create User Attribute Mappings
- Attribute Name of User Status
- LDAP Groups Search Attribute
- LDAP Group Search Filter
- LDAP Groups Container Naming Attribute
- LDAP Groups Container Value
- LDAP Groups Object Classes
- LDAP Groups Attributes
- Attribute Name for Group Memberships
- Attribute Name of Unique Member
- Attribute Name of Group Member URL
- LDAP Roles Search Attribute
- LDAP Role Search Filter
- LDAP Role Object Class
- LDAP Roles Attributes
- LDAP Filter Roles Search Attribute
- LDAP Filter Role Search Filter
- LDAP Filter Role Object Class
- LDAP Filter Roles Attributes
- LDAP People Container Naming Attribute
- LDAP People Container Value
- Identity Types that can be Authenticated
- Persistent Search Base DN
- Persistent Search Filter
- Persistent Search Scope
- Persistent Search Maximum Idle Time Before Restart
- Maximum Number of Retries After Error Code
- The Delay Time Between Retries
- LDAPException Error Codes to Retry
- Caching
- Maximum Age of Cached Items
- Maximum Size of the Cache
- Active Directory Attributes
- Chapter 5 Centralized Agent Configuration
Attributes
- Part III Error Codes and Log File Reference