test

Sun Java System Access Manager Policy Agent 2.2 Guide for BEA WebLogic Server 9.0/9.1

Using the Installation Program of Agent for BEA WebLogic Server 9.0/9.1

After you issue the agentadmin command and accept the license agreement (if necessary) the installation program appears, prompting you for information.

The steps in the installation program are displayed in this section in an example interaction. Your answers to prompts can differ slightly or greatly from this example depending upon your specific deployment. In the example, most of the defaults have been accepted. This example is provided for your reference and does not necessarily indicate the precise information you should enter.

The following bulleted list provides key points about the installation program.

About Installation Prompts in Agent for BEA WebLogic Server 9.0/9.1

The following list provides information about specific prompts in the installation. Often the prompt is self explanatory. However, at other times you might find the extra information presented here to be very helpful. This extra information is often not obvious. Study this section carefully before issuing the agentadmin --install command.

The Deployment URI for the Agent Application

The deployment URI for the agent application is required for the agent to perform necessary housekeeping tasks such as registering policy and session notifications, legacy browser support, and CDSSO support. Accept /agentapp as the default value for this interaction. Once the installation is completed, browse the directory PolicyAgent-base/etc. Use the agentapp.war file to deploy the agent application in the application container. Please note that the deployment URI for agent application during install time should match the deployment URI for the same application when deployed in the J2EE container.

The Encryption Key

This key is used to encrypt sensitive information such the passwords. The key should be at least 12 characters long. A key is generated randomly and provided as the default. You can accept the random key generated by the installer or create your own using the .agentadmin --getEncryptKey command.

For information about creating a new encryption key, see agentadmin --getEncryptKey.

The Agent Profile Name

An agent profile should have been created as a pre-installation step. The creation of the agent profile is mentioned in that section. For the pre-installation steps, see Preparing to Install Agent for BEA WebLogic Server 9.0/9.1. For the actual information on creating an agent profile, see Creating a J2EE Agent Profile.

In summary, the J2EE agent communicates with Access Manager with a specific ID and password created through an agent profile using Access Manager Console. For J2EE agents, the creation of an agent profile is mandatory. Access Manager uses the agent profile to authenticate an agent. This is part of the security infrastructure.

The J2EE Password File

The J2EE password file should have been created as a pre-installation step. For the pre-installation steps, see Preparing to Install Agent for BEA WebLogic Server 9.0/9.1.

When the installation program prompts you for the password for the agent, enter the fully qualified path to this password file.

After you have completed all the steps, a summary of your responses appears followed by options that allow you to navigate through those responses to accept or reject them.

When the summary appears, note the agent instance name, such as agent-001. You might be prompted for this name during the configuration process.

About the options, the default option is 1, Continue with Installation.

You can edit your responses as necessary, return to the options list, and choose option 1 to finally process your responses.

Example of Installation Program Interaction in Agent for BEA WebLogic Server 9.0/9.1

The following example is a sample installation snapshot of Policy Agent 2.2 for BEA WebLogic Server 9.0/9.1. By no means does this sample represent a real deployment scenario.

The section following this example, Implications of Specific Deployment Scenarios in Agent for BEA WebLogic Server 9.0/9.1, explains specific deployment scenarios, such as installing the agent on the Access Manager host. If any of these deployment scenarios apply to your deployment, you might need to respond to prompts in a specified manner during the installation as explained in that section. Review the explanations in that section before proceeding with the installation. Those explanations are divided into subsections as follows:


************************************************************************
Welcome to the Access Manager Policy Agent for BEA WebLogic 9 Platform.
If the Policy Agent is used with Federation Manager services, User needs to
enter information relevant to Federation Manager.
************************************************************************

Enter the path to the location of the script used to start the WebLogic domain. 
Please ensure that the agent is first installed on the admin server instance 
before installing on any managed server instance.
[ ? : Help, ! : Exit ]
Enter the Startup script location
[/usr/local/bea/user_projects/domains/mydomain/startWebLogic.sh]: 
/usr/local/bea/user_projects/domains/serverdomain/startWebLogic.sh
Enter the name of the WebLogic Server/Portal instance secured by the
agent.
[ ? : Help, < : Back, ! : Exit ]
Enter the WebLogic Server/Portal instance name [myserver]:


Enter the fully qualified host name of the server where Access Manager
Services are installed.
[ ? : Help, < : Back, ! : Exit ]
Access Manager Services Host:  subcompany22.company22.example.com


Enter the port number of the Server that runs Access Manager Services.
[ ? : Help, < : Back, ! : Exit ]
Access Manager Services port [80]: 58080


Enter http/https to specify the protocol used by the Server that runs Access
Manager services.
[ ? : Help, < : Back, ! : Exit ]
Access Manager Services Protocol [http]: http 
Enter the Deployment URI for Access Manager Services.
[ ? : Help, < : Back, ! : Exit ]
Access Manager Services Deployment URI [/amserver]:


Enter the fully qualified host name on which the Application Server
protected by the agent is installed.
[ ? : Help, < : Back, ! : Exit ]
Enter the Agent Host name:  employee.company22.example.com


Enter the WebLogic home directory
[ ? : Help, < : Back, ! : Exit ]
Enter the WebLogic home directory [/usr/local/bea/weblogic9]:


Enter true if the agent is being installed on a Portal domain
[ ? : Help, < : Back, ! : Exit ]
Is the agent being installed on a Portal domain ? [false]: false


Enter the preferred port number on which the application server provides its
services.
[ ? : Help, < : Back, ! : Exit ]
Enter the port number for Application Server instance [80]:  7001


Select http or https to specify the protocol used by the Application server
instance that will be protected by Access Manager Policy Agent.
[ ? : Help, < : Back, ! : Exit ]
Enter the Preferred Protocol for Application Server instance [http]: http 


Enter the deployment URI for the Agent Application. This Application is used
by the agent for internal housekeeping.
[ ? : Help, < : Back, ! : Exit ]
Enter the Deployment URI for the Agent Application [/agentapp]:


Enter a valid Encryption Key.
[ ? : Help, < : Back, ! : Exit ]
Enter the Encryption Key [KpsVJMr84cwd6OATx+UgLWHSCB8KWFVW]:

Enter a valid Agent profile name. Before proceeding with the agent 
installation, please ensure that a valid Agent profile exists in Access Manager.  
[ ? : Help, < : Back, ! : Exit ]
Enter the Agent Profile name:  exampleagent

Enter the path to a file that contains the password to be used for identifying
the Agent.
[ ? : Help, < : Back, ! : Exit ]
Enter the path to the password file:  /export/temp/passwordfile


Enter true if the Agent is being installed on the same instance of Application
Server on which Access Manager is deployed. Enter false if that is not the
case.
[ ? : Help, < : Back, ! : Exit ]
Are the Agent and Access Manager installed on the same instance of
Application Server ? [false]:


-----------------------------------------------
SUMMARY OF YOUR RESPONSES
-----------------------------------------------
Startup script location :
/usr/local/bea/user_projects/domains/mydomain/startWebLogic.sh
WebLogic domain name : myserver
Access Manager Services Host : subcompany22.company22.example.com
Access Manager Services Port : 58080
Access Manager Services Protocol : http
Access Manager Services Deployment URI : /amserver
Agent Host name : employee.company22.example.com
WebLogic home directory : /usr/local/bea/weblogic9
Agent Installed on Portal domain : false
Application Server Instance Port number : 7001
Protocol for Application Server instance : http
Deployment URI for the Agent Application : /agentapp
Encryption Key : KPsVJMr84cwd6OATx+UgLWHSCB8KWFVW
Agent Profile name : exampleagent
Agent Profile Password file name : /export/temp/passwordfile
Agent and Access Manager on same application server instance : false

Verify your settings above and decide from the choices below.
1. Continue with Installation
2. Back to the last interaction
3. Start Over
4. Exit
Please make your selection [1]:

************************************************************************
Welcome to the Access Manager Policy Agent for BEA WebLogic 9 Platform.
If the Policy Agent is used with Federation Manager services, User needs to
enter information relevant to Federation Manager.
************************************************************************

Implications of Specific Deployment Scenarios in Agent for BEA WebLogic Server 9.0/9.1

The following sections refer to specific deployment scenarios involving Policy Agent 2.2 for BEA WebLogic Server 9.0/9.1. These scenarios are likely to affect how you respond to prompts during the installation process. You might also need to perform additional configurations.

Installing a J2EE Agent on Multiple BEA WebLogic Server 9.0/9.1 Instances on the Same Domain

Once a J2EE agent is installed for a particular domain configuration directory, you can install the agent on more than one BEA WebLogic Server 9.0/9.1 instance associated with the same domain by running the agentadmin --install command. Once prompted to enter the appropriate server instance name, enter the domain configuration directory and unique instance name that will enable the agent to distinguish the first instance from consecutive instances.

Installing a J2EE Agent for a BEA WebLogic Server 9.0/9.1 Instance on a Different Server Domain

Caution – Caution –

Once a J2EE agent is installed for a specific domain, the J2EE agent binaries cannot be used on that same host for a different BEA WebLogic Server 9.0/9.1 domain. If you attempt to use previously installed J2EE agent binaries on the same host, but on a different domain, the installation fails.

J2EE agents associate a specific set of agent binaries with a particular domain for BEA WebLogic Server 9.0/9.1. If you want to install a J2EE agent on a different domain, unpack a new set of bits and copy them to a separate location before running the agentadmin --install command for the second domain.

Installing Agent for BEA WebLogic Server 9.0/9.1 on the Access Manager Host

If a J2EE agent and Access Manager are collocated on the same container, enter true for the following question:


Enter true if the Agent is being installed on the same instance of Application
Server on which Access Manager is deployed. Enter false if that is not the
case.
[ ? : Help, < : Back, ! : Exit ]
Are the Agent and Access Manager installed on the same instance of
Application Server ? [false]: true

In this case, the agentadmin program will make the necessary changes to install and configure the agent on the same BEA WebLogic Server 9.0/9.1 instance that hosts Access Manager.

However, this deployment scenario changes the agent configuration in a manner that requires your attention. For details, see Combining J2EE Agents With Access Manager.

Summary of a J2EE Agent Installation in Policy Agent 2.2

At the end of the installation process, the installation program prints the status of the installation along with the installed J2EE agent information. The information that the program displays can be very useful. For example, the program displays the agent instance name, which is needed when configuring a remote instance. The program also displays the location of specific files, which can be of great importance. In fact, you might want to view the installation log file once the installation is complete, before performing the post-installation steps as described in Chapter 4, Post-Installation Tasks of Policy Agent 2.2 for BEA WebLogic Server 9.0/9.1.

The location of directories displayed by the installer are specific. However, throughout this guide and specifically in Summary of Agent Installation shown in this section, PolicyAgent-base is used to describe the directory where the distribution files are stored for a specific J2EE agent.

The following example serves as a quick description of the location of the J2EE agent base directory (PolicyAgent-base) of Policy Agent 2.2 for BEA WebLogic Server 9.0/9.1.

Example 3–5 Policy Agent Base Directory of Agent for BEA WebLogic Server 9.0/9.1

The following directory represents PolicyAgent-base of Agent for BEA WebLogic Server 9.0/9.1:


Agent-HomeDirectory/j2ee_agents/am_wl9_agent

where Agent-HomeDirectory is the directory you choose in which to unpack the J2EE agent binaries.

Information regarding the location of the J2EE agent base directory is explained in detail in Location of the J2EE Agent Base Directory in Policy Agent 2.2.

The following type of information is printed by the installer:


SUMMARY OF AGENT INSTALLATION
-----------------------------
Agent instance name: agent_001
Agent Configuration file location:
PolicyAgent-base/agent_001/config/AMAgent.properties
Agent Audit directory location:
PolicyAgent-base/agent_001/logs/audit
Agent Debug directory location:
PolicyAgent-base/agent_001/logs/debug

Install log file location:
PolicyAgent-base/logs/audit/install.log

Thank you for using Access Manager Policy Agent

Once the agent is installed, the directories shown in the preceding example are created in the agent_00x directory, which for this example is specifically agent_001. Those directories and files are briefly described in the following paragraphs.

PolicyAgent-base/agent_001/config/AMAgent.properties

Location of the J2EE agent AMAgent.properties configuration file for the agent instance. Every instance of a J2EE agent has a unique copy of this file. You can configure this file to meet your site's requirements. For more information, see the following sections:

PolicyAgent-base/agent_001/logs/audit

Location of the J2EE agent local audit trail.

PolicyAgent-base/agent_001/logs/debug

Location of all debug files required to debug an agent installation or configuration issue.

PolicyAgent-base/logs/audit/install.log

Location of the file that has the agent install file location. If the installation failed for any reason, you can look at this file to diagnose the issue.