The Policy Agent 3.0-02 release currently includes web agents only. This section describes:
Enhancements and Changes for Web Agents in the Policy Agent 3.0-02 Release
Problems Fixed for Web Agents in the Policy Agent 3.0-02 Release
The following version 3.0–02 web agents are available on My Oracle Support: https://support.oracle.com/.
Table 1 Patch IDs for Web Agents in the Policy Agent 3.0-02 Release
|
CR 6967818: Basic authentication support added for IIS 6.x and IIS 7.x agents
CR 6923788: POST data preservation support added for IIS 7.x agent
CR 6921240: Policy Clock Skew value required for "Stale resource is not removed" fix
In the Policy Agent 3.0-02 release, basic authentication support is implemented for both the IIS 6.x and IIS 7.x agents. With basic authentication, the agent populates the authorization header so that the browser doesn't prompt users for the username and password. This section describes:
Perform the steps in this section for both the IIS 6.x and IIS 7.x agents.
To configure OpenSSO server, follow these steps:
Configure the ReplayPasswd class as a post-authorization plug-in:
Log in to the OpenSSO Administration console.
Click Access Control, realm-name, and then Authentication.
Under General, click Advanced Properties.
Scroll down to the Authentication Post Processing Classes field.
In New Value, enter com.sun.identity.authentication.spi.ReplayPasswd and then click Add.
Click Save.
Generate and set the shared key:
Run the following command to generate a shared key:
java -classpath amserver.jar com.sun.identity.common.DESGenKey
An example of the output is: "Key ==> a+CYxFITqD4="
Note. The location of the amserver.jar file depends on the web container you are using for OpenSSO server.
Log in to the OpenSSO Administration console.
Click Configuration, Servers and Sites, and then the Server Name link.
Click Advanced and then add the com.sun.am.replaypasswd.key property with the key you generated in Step a.
Click Save and log out of the console.
Restart the OpenSSO server.
Before you begin, you must install the version 3.0–02 IIS 6.x agent and define the same user and password pairs on the Windows machine as in OpenSSO server.
To configure an IIS 6.x agent, follow these steps:
In the IIS 6.x manager, open the properties window of the website where the agent is installed.
In the Directory Security tab, edit the Authentication and Access Control.
Select Basic Authentication. All the other check boxes should be unchecked.
In the properties window of the web server, select the ISAPI Filters tab.
Add the Agent Auth Filter. The executable name is PolicyAgent-base\bin\amiis6auth.dll.
For example: C:\Agents\web_agents\iis6_agent\bin\amiis6auth.dll
Set the agent properties depending on the agent configuration.
If you are using centralized agent configuration, set the following properties in the OpenSSO Administration console:
Click Access Control, realm-name, Agents, Web, and then the name of the IIS 6.x agent.
Click Advanced and then under Microsoft IIS Server, enter the following values:
Authentication Type: Basic
Replay Password Key: Key you generated in Configuring OpenSSO Server for Basic Authentication.
Click Save.
If you are using local agent configuration, set the following properties in the OpenSSOAgentConfiguration.properties file:
com.sun.identity.agents.config.iis.auth.type = Basic
com.sun.identity.agents.config.replaypasswd.key = Key you generated in Configuring OpenSSO Server for Basic Authentication
Restart the IIS 6.x server
Before you begin, you must install the version 3.0–02 IIS 7.x agent and define the same user and password pairs on the Windows machine as in OpenSSO server.
To configure an IIS 7.x agent, follow these steps:
In the IIS 7.x manager, select the website in the left panel and open the Authentication page.
Enable the Basic Authentication. All the other authentications should be disabled.
Set the agent properties depending on the agent configuration.
If you are using centralized agent configuration, set the following properties in the OpenSSO Administration console:
Click Access Control, realm-name, Agents, Web, and then the name of the IIS 7.x agent.
Click Advanced and then under Microsoft IIS Server, enter the following values:
Authentication Type: Basic
Replay Password Key: Key you generated in Configuring OpenSSO Server for Basic Authentication.
Click Save.
If you are using local agent configuration, set the following properties in the OpenSSOAgentConfiguration.properties file:
com.sun.identity.agents.config.iis.auth.type = Basic
com.sun.identity.agents.config.replaypasswd.key = Key you generated in Configuring OpenSSO Server for Basic Authentication
Restart the IIS 7.x server.
The version 3.0–02 agent for IIS 7.x now supports POST data preservation. Users can preserve POST data, which is submitted to IIS 7.x through HTML forms before the users log in to OpenSSO server.
The Policy Agent 3.0–02 release fixes CR 6921240 (stale resource is not removed). However, for all web agents, you must also set the Policy Clock Skew (com.sun.identity.agents.config.policy.clock.skew agent property) to a value greater than zero.
Set the Policy Clock Skew value depending on the agent configuration.
If you are using centralized agent configuration, set the property in the OpenSSO server Administration console:
Click Access Control, realm-name, Agents, Web, and then the name of the IIS agent.
Click OpenSSO Services and then enter a value greater than zero in the Policy Clock Skew field.
Click Save.
If you are using local agent configuration, set the property in the OpenSSOAgentConfiguration.properties file. For example:
com.sun.identity.agents.config.policy.clock.skew=2
Restart the agent's web container.
Table 2 Problems Fixed for Web Agents in the Policy Agent 3.0-02 Release
|
A version 3.0-02 policy agent requires a full installation. If you have a an earlier policy agent already installed, you must uninstall that agent and then reinstall the new version 3.0-02 agent. To install a version 3.0-02 agent, follow these steps:
If you have an earlier policy agent installed, uninstall the agent by following the instructions in the respective Policy Agent 3.0 guide in the OpenSSO Enterprise 8.0 documentation collection: http://docs.sun.com/coll/1767.1.
Important: Before you uninstall the agent, back up your existing agent deployment. For example, for the Apache HTTP Server 2.2.x agent, back up the files under AgentHome/web_agents/apache22_agent, where AgentHome is where you installed the agent.
Create a directory to download the version 3.0-02 patch file.
Download the agent you want to install from My Oracle Support:
In the download directory, unzip the version 3.0-02 patch file. A patch for a web agent contain a README file and separate ZIP files for each platform supported by the specific agent you downloaded.
Unzip the file for your specific platform.
The files and directories required by the specific agent are then available in the zip-root/web_agents/agent-name directory, where zip-root is where you unzipped the file and agent-name identifies the specific agent.
Check the README available with the agent for more information about the agent for your specific platform.
Install and configure the version 3.0-02 agent by following the instructions in the respective Policy Agent 3.0 guide in the OpenSSO Enterprise 8.0 documentation collection: http://docs.sun.com/coll/1767.1.
Note: Version 3.0 and later agents require JDK 1.5 or later on the server where you plan to install the agent. Before you run the agentadmin program to install the agent, set your JAVA_HOME environment variable to point to the JDK installation directory.