test

Deployment Example 2: Federation Using SAML v2

14.5 Completing the Web Policy Agent 4 Installation

Use the following as your checklist for completing the Web Policy Agent 4 installation:

  1. Edit the AMAgent.Properties file.

  2. Verify that Web Policy Agent 4 is working properly.

  3. Import the root CA certificate into the Web Server 4 key store.

  4. Verify that Web Policy Agent 4 can access the Federation Manager load balancer.

ProcedureTo Edit the AMAgent.Properties File

  1. Log in to as a root user to Federation Manager 1 host.

  2. Edit the AMAgent.properties file.


    # cd /etc/opt/SUNWam/agents/es6/ 
config/_opt_SUNWwbsvr_https-ProtectedResource-4.siroe.com

    1. Make a backup of AMAgent.properties, and then set the following properties:


      com.sun.am.policy.am.username = UrlAccessAgent
com.sun.am.policy.am.password = BeVPgddAimR404ivWY6HPQ==
com.sun.am.policy.agents.config.do_sso_only = true

    2. Add the following properties to the original file:


      com.sun.am.ignore.naming.service = true

    3. (Optional) Set the debug property as in this example:


      com.sun.am.log.level = all:5

      Save the file.

  3. Restart Web Server 4.

    # cd /opt/SUNWwbsvr/https-ProtectedResource-4.siroe.com
 #./stop; ./start

Procedure To Verify that Web Policy Agent 4 is Working Properly

  1. Go to the following URL:

    http://ProtectedResource-4.siroe.com:2080

  2. Log in to Access Manager using the following information:

    Username

    spuser

    Password

    spuser

    You should see the default index.html page for Web Server 4.

ProcedureTo Import the Root CA Certificate into the Web Server 4 Key Store

The Web Policy Agent on Protected Resource 4 connects to Federation Manager servers through Load Balancer 9. The load balancer is SSL-enabled, so the agent must be able to trust the load balancer SSL certificate in order to establish the SSL connection. To do this, import the root CA certificate that issued the Load Balancer 3 SSL server certificate into the Web Policy Agent certificate store.

Before You Begin

Obtain the root CA certificate, and copy it to the Protected Resource 4 host. Copy the certificate into the file /export/software/ca.cert.

  1. Copy the root CA certificate to Protected Resource 4.

  2. Open a browser, and go to the Web Server 4 administration console.

    http://ProtectedResource-4.siroe.com:8888

  3. Log in to the Web Server 4 console using the following information:

    User Name:

    admin

    Password:

    11111111

  4. In the Select a Server field, select ProtectedResource-4.siroe.com, and then click Manage.

    Tip –

    If a “Configuration files have not been loaded” message is displayed, it may be because the Web Server instance that is being accessed through the administration server has had its configuration files manually edited. This is the case when the Web Policy Agent is installed. The mirror configuration files are different from the current configuration files. In order to be sure the changes are not lost, you must apply the changes. First click Apply, and then click Apply Changes. The configuration files are read, and the server is stopped and restarted.

  5. Click the Security tab.

  6. On the Initialize Trust Database page, enter a Database Password.

    Enter the password again to confirm it, and then click OK.

  7. In the left frame, click Install Certificate and provide the following information, and then click OK:

    Certificate For:

    Choose Trusted Certificate Authority (CA).

    Key Pair File Password:

    password

    Certificate Name:

    rootCA.cert

    Message in this File:

    /export/software/ca.cert

  8. Click Add Server Certificate.

  9. Click Manage Certificates.

    The root CA Certificate name rooCA.cert is included in the list of certificates.

  10. Click the Preferences tab.

  11. Restart Web Server 4.

    On the Server On/Off page, click Server Off. When the server indicates that the administration server is off, click Server On.

  12. Restart Web Server 4.

    # cd /opt/SUNWwbsvr/https-ProtectedResource-4.siroe.com
# ./stop; ./start

ProcedureTo Verify that Web Policy Agent 4 Can Access the Federation Manager Load Balancer

  1. Go to the Protected Resource 4 URL:


    http://ProtectedResource-4.siroe.com:2080/index.html

  2. Log into the Federation Manager console using the following information:

    User Name:

    spuser

    Password:

    spuser

    The policy agent redirects the request, and the URL changes to https://LoadBalancer-9.siroe.com:3443/federation/UI/Login. The default Sun ONE Web Server page is displayed. This verifies that the web policy agent is properly configured to access the Federation Manager load balancer.