Bootstrap Information

Figure 3–1 Configuration Agent, Configuration Repository

Associated property file keys are indicated in parentheses, where appropriate.

• State: The status of the Configuration Agent. The check box can be used to either activate or deactivate the Configuration Agent. To make use of the configuration repository, the Configuration Agent must be active. The activation automatically includes the necessary registration with the service management facility ( smf(5) ) on Solaris.

• Host Identifier (HostIdentifierType): can be ”HostName” or “IPAddress”. When searching for host-specific policy data, the Configuration Agent will identify the current host either by host name or IP address. Choose the correct value based on how your host is identified in the selected Context Type.

• Context Type: Use this setting to indicate to the Configuration Agent whether your organizational hierarchy and configuration data are defined in LDAP or File-based storage or a mixture of both.

  ---

  Note –

  To manually enable or disable the Configuration Agent, log in as root and type the command /usr/lib/apoc/apocd enable or /usr/lib/apoc/apocd disable, respectively.

  ---

Figure 3–2 Configuration Agent, LDAP Hierarchy and File-Based Storage

The screen in Figure 3–2 varies, depending on the Context Type chosen on the previous screen. Server Identifier, Server Port and Suffix are required if an LDAP or Hybrid context type is chosen. Configuration Settings URL is required if a File-based or Hybrid context type is chosen.

• Server Identifier: host name of the LDAP server.

• Server Port: port number of the LDAP server.

• Suffix: base DN of the LDAP repository.

• Configuration Settings URL: URL specifying the location of the file based repository.

  A list of URLs can be used to specify fallback repositories in case the connection to the first one does not succeed. The list can be composed of one or more white space-separated URLs, each URL being of the form file://<filepath>, http://<host>:<port>/<filepath>, or https://<host>:<port>/<filepath>. See Appendix A, Configuration Parameters for more information.

  ---

  Note –

  The Agent tries to access the LDAP server using a SSL connection first. If this fails the Agent tries a plain SSL connection.

  For the SSL connection to succeed, the proper certificate must be present in the Java runtime environment key store. That key store is located for a standard JRE in <installation directory>/lib/security/cacerts, and for a standard JDK in <installation directory>/jre/lib/security/cacerts. Either the Certification Authority or the LDAP server certificate must be added to that store, using the command keytool -import -file <certificate file> -keystore <cacerts file location>. The default password for that key store is changeit.

  ---

Figure 3–3 Configuration Agent, Authentication Mechanism

• Authentication Type for the Configuration Agent: can be "Anonymous" or "Simple". If "Anonymous" is selected, the Qualified User Name and Password fields are automatically disabled.

• Qualified User Name (AuthDn): full DN of a user with read and search access rights on the repository.

• Password (Password): password of a registered LDAP user

  ---

  Note –

  If anonymous access is enabled in the directory, the Qualified User Name and the Password settings can be left blank.

  ---

• Authentication Type for applications (AuthType): can be “Anonymous” or “GSSAPI”, depending on how the LDAP server authenticates users.

  ---

  Note –

  For more information, see Data Access/User Authentication.

  ---