Chapter 10 Configuring the Service Provider Protected Resource Host Machine

In this deployment, protected resources are hosted on one machine that contains two installed web containers (one Sun Java™ System Web Server and one BEA WebLogic Server application server) and the appropriate policy agent for each (a web policy agent and a J2EE policy agent, respectively). The policy agents are configured to access the OpenSSO Enterprise Load Balancer 4. This chapter contains the following sections:

• 10.1 Installing the J2EE Container and J2EE Policy Agent on Protected Resource 1

• 10.2 Installing the Web Server and Web Policy Agent on Protected Resource 1

10.1 Installing the J2EE Container and J2EE Policy Agent on Protected Resource 1

Download the BEA WebLogic Server bits to the Protected Resource 1 host machine (pr1.sp-example.com) and install the application server. Additionally, download, install and configure the appropriate J2EE policy agent. Use the following list of procedures as a checklist for completing this task.

1. To Install BEA WebLogic Server on Protected Resource 1

2. To Configure BEA WebLogic Server on Protected Resource 1

3. To Import a Certificate Authority Root Certificate to Protected Resource 1

4. To Install the J2EE Policy Agent on Protected Resource 1

5. To Deploy and Start the J2EE Policy Agent Housekeeping Application

6. To Deploy the J2EE Policy Agent Sample Application

7. To Configure the J2EE Policy Agent to Bypass Application Server Administrator Authentication

8. To Enable the J2EE Policy Agent to Run in SSO Only Mode

9. To Configure the J2EE Policy Agent for SAML v2 Communication

To Install BEA WebLogic Server on Protected Resource 1

BEA WebLogic Server is the application server used as the J2EE web container on Protected Resource 1.

Before You Begin

Ensure that your machine is properly patched. Refer to the BEA web site to make sure that your system has the recommended patches.

1. As a root user, log into the pr1.sp-example.com host machine.

2. Create a directory into which you can download the WebLogic Server bits and change into it.

   # mkdir /export/BEAWL10 # cd /export/BEAWL10

3. Download the WebLogic Server bits from http://commerce.bea.com/.

   For this deployment, we download the Solaris version.

   # ls -al total 294548 drwxr-xr-x 2 root root 512 Aug 7 13:23 . drwxr-xr-x 3 root sys 512 Aug 7 13:16 .. -rw-r--r-- 1 root root 656834948 Aug 7 13:24 server100_solaris32.bin

4. Run the installer.

   # ./server100_solaris32.bin

5. When prompted, do the following:

   The Welcome screen is displayed.	Click Next.
   Accept the License agreement	Select Yes and click Next.
   Create a new BEA Home	Type /usr/local/bea and click Next.
   Select "Custom"	Click Next.
   Deselect the following: - Workshop for WebLogic Platform	Click Next.
   Choose Product Installation Directories	Type /usr/local/bea/weblogic10 and click Next.
   Installation Complete	Deselect Run Quickstart and click Done.

6. (Optional) Verify that the application was correctly installed.

   # cd /usr/local/bea # ls -al total 90 drwxr-xr-x 7 root root 512 Jul 15 11:59 . drwxr-xr-x 4 root root 512 Jul 15 11:58 .. -rwxr-xr-x 1 root root 826 Jul 15 11:59 UpdateLicense.sh -rw-r--r-- 1 root root 14 Jul 15 11:59 beahomelist drwxr-xr-x 6 root root 512 Jul 15 11:59 jdk150_06 -rw-r--r-- 1 root root 12447 Jul 15 11:59 license.bea drwxr-xr-x 2 root root 512 Jul 15 11:59 logs drwxr-xr-x 6 root root 6656 Jul 15 11:58 modules -rw-r--r-- 1 root root 15194 Jul 15 11:59 registry.dat -rw-r--r-- 1 root root 1077 Jul 15 11:59 registry.xml drwxr-xr-x 4 root root 512 Jul 15 12:01 utils drwxr-xr-x 10 root root 512 Jul 15 11:59 weblogic10

To Configure BEA WebLogic Server on Protected Resource 1

Before You Begin

This procedure assumes you have just completed To Install BEA WebLogic Server on Protected Resource 1 and are still logged into the host machine as the root user.

1. Run the WebLogic Server configuration script.

   # cd /usr/local/bea/weblogic10/common/bin # ./config.sh

2. When prompted, do the following:

   Select "Create a new Weblogic domain"	Click Next.
   Select "Generate a domain configured automatically to support the following BEA products:"	Click Next.
   Configure Administrator Username and Password	Enter the following and click Next.  Username: weblogic Password: bea10admin Confirm Password: bea10admin
   Select "Prduction Mode" and "BEA Supplied JDK's" (Sun SDK 1.5.0_06@/usr/local/bea/jdk150_06)	Click Next.
   Customize Environment and Services Settings	Select yes and click Next.
   Configure the Administration Server	Accept the default values and click Next.
   Configure Managed Servers	Select Add, enter the following values, and click Next.  Name: ApplicationServer-1 Listen Port: 1081
   Configure Clusters	Accept the default values and click Next.
   Configure Machines	Select the Unix Machine tab, then select Add, type pr1 and click Next.
   Assign Servers to Machines	From the left panel select AdminServer and ApplicationServer-1. From the right panel select pr-1. Click --> and then click Next.
   Review WebLogic Domain	Click Next.
   Create WebLogic Domain	Add the following and click Create.  Domain name: pr1 Domain Location: /usr/local/bea/user_projects/domains (default)
   Creating Domain	Click Done.

3. Start AdminServer, the WebLogic administration server.

   # cd /usr/local/bea/user_projects/domains/pr1 # ./startWebLogic.sh

   When prompted, type the following credentials.

   Username

   weblogic

   Password

   bea10admin

4. Run the netstat command to verify that the port is open and listening.

   # netstat -an | grep 7001 XXX.XX.XX.101.7001 *.* 0 0 49152 0 LISTEN XXX.X.X.1.7001 *.* 0 0 49152 0 LISTEN

   ---

   Note –

   You can also access the administration console by pointing a web browser to http://pr1.sp-example.com:7001/console.

   ---

5. Change to the AdminServer directory.

   # cd /usr/local/bea/user_projects/domains/pr1/servers/AdminServer

6. Create a security directory and change into it.

   # mkdir security # cd security

7. Create a boot.properties file for the WebLogic Server administration server administrator credentials.

   The administration server administrative user and password are stored in boot.properties. Application Server 1 uses this information during startup. WebLogic Server encrypts the file, so there is no security risk even if you enter the user name and password in clear text.

   # cat > boot.properties username=weblogic password=bea10admin Hit Control D to terminate the command ^D

8. Restart WebLogic to encrypt the username and password in boot.properties.

   # cd /usr/local/bea/user_projects/domains/pr1/bin # ./stopWebLogic.sh # ./startWebLogic.sh

9. Start the managed servers.

   # cd /usr/local/bea/user_projects/domains/pr1/bin # ./startManagedWebLogic.sh ApplicationServer-1 t3://localhost:7001

   You will be prompted for the administrative user credentials.

   Username

   weblogic

   Password

   bea10admin

10. Change to the ApplicationServer-1 directory.

    # cd /usr/local/bea/user_projects/domains/pr1/ servers/ApplicationServer-1

11. Create a security directory and change into it.

    # mkdir security # cd security

12. Create a boot.properties file for the WebLogic Server managed server administrator credentials.

    The managed server administrative user and password are stored in boot.properties. The Application Server 1 managed server uses this information during startup. WebLogic Server encrypts the file, so there is no security risk even if you enter the user name and password in clear text.

    # cat > boot.properties username=weblogic password=bea10admin Hit Control D to terminate the command ^D

13. Restart the managed server.

    # cd /usr/local/bea/user_projects/domains/ pr-1/bin # ./stopManagedWebLogic.sh ApplicationServer-1 t3://localhost:7001 # ./startManagedWebLogic.sh ApplicationServer-1 t3://localhost:7001

14. Run the netstat command to verify that the port is open and listening.

    # netstat -an | grep 1081 XXX.XX.XX.101.1081 *.* 0 0 49152 0 LISTEN XXX.X.X.1.1081 *.* 0 0 49152 0 LISTEN

15. Access http://pr1.sp-example.com:7001/console from a web browser.

16. Login to the BEA WebLogic Server as the administrator.

    Username

    weblogic

    Password

    bea10admin

17. Click servers under Domain Structure —>Environment.

    On the Summary of Servers page, verify that both AdminServer (admin) and ApplicationServer-1 are running and OK.

18. Log out of the console.

19. Log out of the pr1.sp-example.com host machine.

To Import a Certificate Authority Root Certificate to Protected Resource 1

The Certificate Authority (CA) root certificate enables the J2EE policy agent to trust the certificate from the OpenSSO Enterprise Load Balancer 2, and to establish trust with the certificate chain that is formed from the CA to the certificate.

Before You Begin

Copy the same CA root certificate used in To Install a CA Root Certificate to OpenSSO Enterprise Load Balancer 2 to the /export/software directory on the pr1.sp-example.com host machine.

1. As a root user, log into the pr1.sp-example.com host machine.

2. Change to the directory where cacerts, the certificate store is located.

   # cd /usr/local/bea/jdk150_06/jre/lib/security.

   ---

   Tip –

   Backup cacerts before modifying it.

   ---

3. Import ca.cer, the CA root certificate.

   # /usr/local/bea/jdk150_06/bin/keytool -import -trustcacerts -alias OpenSSLTestCA -file /export/software/ca.cer -keystore /usr/local/bea/jdk150_06/jre/lib/security/cacerts -storepass changeit Owner: EMAILADDRESS=nobody@nowhere.com, CN=OpenSSLTestCA, OU=Sun, O=Sun,L=Santa Clara, ST=California C=US Issuer: EMAILADDRESS=nobody@nowhere.com, CN=OpenSSLTestCA, OU=Sun, O=Sun,L=Santa Clara, ST=California C=US Serial number: 97dba0aa26db6386 Valid from: Tue Apr 18 07:66:19 PDT 2006 until: Tue Jan 13 06:55:19 PST 2009 Certificate fingerprints: MD5: 9f:57:ED:B2:F2:88:B6:E8:0F:1E:08:72:CF:70:32:06 SHA1: 31:26:46:15:C5:12:5D:29:46:2A:60:A1:E5:9E:26:64:36:80:E4:70 Trust this certificate: [no] yes Certificate was added to keystore.

4. Verify that ca.cer was successfully imported.

   # /usr/local/bea/jdk150_06/bin/keytool -list -keystore /usr/local/bea/jdk150_06/jre/lib/security/cacerts -storepass changeit | grep -i openssl OpenSSLTestCA, Sep 15, 2008, trustedCertEntry,

5. Log out of the pr1 host machine.

To Install the J2EE Policy Agent on Protected Resource 1

Before You Begin

Set JAVA_HOME to /usr/local/bea/jdk150_06.

1. As a root user, log into the pr1.sp-example.com host machine.

2. Stop the WebLogic Server 1 administration server and the WebLogic Server 1 managed instance.

   # cd /usr/local/bea/user_projects/domains/pr1/bin # ./stopManagedWebLogic.sh ApplicationServer-1 t3://localhost:7001 # ./stopWebLogic.sh

3. Create a directory into which you will download the J2EE Policy Agent bits and change into it.

   # mkdir /export/J2EEPA1 # cd /export/J2EEPA1

4. Create a text file that contains a password for the Agent Profile created during installation.

   The J2EE Policy Agent installer requires this.

   # cat > agent.pwd j2eeagent1 Hit Control D to terminate the command ^D

5. Download the J2EE policy agent bits for WebLogic Server from http://www.sun.com/download/index.jsp.

   # ls -al total 18824 drwxr-xr-x 2 root root 512 Jul 17 16:02 . drwxr-xr-x 8 root root 512 Jul 17 15:58 .. -rw-r--r-- 1 root root 11 Jul 17 15:59 agent.pwd -rw-r--r-- 1 root root 9 Jul 17 16:01 agentadm.pwd -rw-r--r-- 1 root root 9623704 Jul 17 16:02 weblogic_v10_agent_3.zip

6. Unzip the J2EE policy agent bits.

   # unzip weblogic_v10_agent_3.zip

7. Run the J2EE policy agent installer.

   # cd /export/J2EEPA1/j2ee_agents/weblogic_v10_agent/bin # chmod 755 agentadmin # ./agentadmin --custom-install

8. When prompted, provide the following information.

   The following information is to configure the J2EE Policy Agent against the OpenSSO Enterprise secure port.

   Please read the following License Agreement carefully:	Press Enter to continue. Continue to press Enter until you reach the end of the License Agreement and the installer's Welcome page is displayed.
   Enter startup script location.	Enter /usr/local/bea/user_projects/domains/pr1/bin/startwebLogic.sh
   Enter the WebLogic Server instance name: [AdminServer]	Enter the name of the WebLogic Server instance secured by the agent ApplicationServer-1
   Enter the WebLogic home directory: [/usr/local/bea/wlserver_10.0]	Enter /usr/local/bea/weblogic10.
   OpenSSO Enterprise URL	Enter the URL where OpenSSO Enterprise is running (including the URI): https://lb4.sp-example.com:1081/opensso
   Is the agent being deployed on a Portal domain [false]	Accept the default value.
   Agent URL:	Enter the URL where the policy agent is running (including the URI): http://pr1.sp-example.com:1081/agentapp
   Enter the Encryption Key [+Yr3K4K1/lWFe4H17SBHMNIUzLNRut7H]:	Accept the default value.
   Enter the Agent Profile Name:	j2eeagent-1
   Enter the path to the password File:	Enter /export/J2EEPA1/agent.pwd, path to the file that contains the password used for identifying the policy agent. Note – A warning message is displayed regarding the existence of the agent profile.
   This Agent Profile does not exist in OpenSSO Enterprise. Will it be created by the installer? (Agent Administrator name and password are required) [true]:	Accept the default value to create the Agent Profile during installation.
   ----------------------------------------------- SUMMARY OF YOUR RESPONSES ----------------------------------------------- Startup script location : /usr/local/bea/user_projects/domains/ pr1/bin/startWebLogic.sh WebLogic Server instance name : ApplicationServer-1 WebLogic home directory : /usr/local/bea/weblogic10 OpenSSO Server URL : https://lb4.sp-example.com:1081/opensso Agent Installed on Portal domain : false Agent URL : http://pr1.sp-example.com:1081/agentapp Encryption Key : +Yr3K4K1/lWFe4H17SBHMNIUzLNRut7H Agent Profile name : j2eeagent-1 Agent Profile Password file name : /export/J2EEPA1/agent.pwd Verify your settings and decide from the choices below: 1. Continue with Installation 2. Back to the last interaction 3. Start Over 4. Exit Please make your selection [1]:	Accept the default value.
   --------------------------------------------- SUMMARY OF AGENT INSTALLATION ----------------------------- Agent instance name: Agent_001 Agent Bootstrap file location: /export/J2EEPA1/j2ee_agents/ weblogic_v10_agent/Agent_001/ config/FAMAgentBootstrap.properties Agent Configuration file location /export/J2EEPA1/j2ee_agents/ weblogic_v10_agent/Agent_001/ config/FAMAgentConfiguration.properties Agent Audit directory location: /export/J2EEPA1/j2ee_agents/ weblogic_v10_agent/Agent_001/logs/audit Agent Debug directory location: /export/J2EEPA1/j2ee_agents/ weblogic_v10_agent/Agent_001/logs/debug Install log file location: /export/J2EEPA1/j2ee_agents/ weblogic_v10_agent/installer-logs /audit/custom.log	Accept the default value.

   When the installer is finished, a new file is in the bin directory called setAgentEnv_ApplicationServer-1.sh.

9. Modify the startup script setDomainEnv.sh to reference setAgentEnv_ApplicationServer-1.sh with the following sub procedure.

   ---

   Tip –

   Backup setDomainEnv.sh before you modify it.

   ---

   1. Change to the bin directory.

      # cd /usr/local/bea/user_projects/domains/pr1/bin

   2. Insert the following line at the end of setDomainEnv.sh.

      . /usr/local/bea/user_projects/domains/pr1/ bin/setAgentEnv_ApplicationServer-1.sh

   3. Save setDomainEnv.sh and close the file.

10. Change permissions for setAgentEnv_ApplicationServer-1.sh.

    # chmod 755 setAgentEnv_ApplicationServer-1.sh

11. Start the WebLogic Server administration server and managed instance.

    # ./startWebLogic.sh & # ./startManagedWebLogic.sh ApplicationSever-1 t3://localhost:7001

    Watch for startup errors.

12. Verify that the J2EE Policy Agent 1 was successfully created in OpenSSO Enterprise using the following sub procedure.

    1. Access https://lb4.sp-example.com:1081/opensso/console from a web browser.

    2. Log in to the OpenSSO Enterprise console as the administrator.

       User Name:

       amadmin

       Password:

       ossoadmin

    3. Under the Access Control tab, click / (Top Level Realm).

    4. Click the Agents tab.

    5. Click the J2EE tab.

       j2eeagent-1 is displayed under the Agent table.

    6. Click j2eeagent-1.

       The j2eeagent-1 properties page is displayed.

    7. Log out of the OpenSSO Enterprise console and close the browser.

13. Remove the password files.

    # cd /export/J2EEPA1 # rm agent.pwd # rm agentadm.pwd

14. Log out of the pr1.sp-example.com host machine.

To Deploy and Start the J2EE Policy Agent Housekeeping Application

The agent application is a housekeeping application bundled with the binaries and used by the agent for notifications and other internal functionality. This application must be deployed to the agent-protected web container using the same URI that was supplied during the agent installation process. For example, during the installation process, if you entered /agentapp as the deployment URI for the agent application, use that same context path in this procedure.

1. Access http://pr1.sp-example.com:7001/console from a web browser.

2. Log in to the WebLogic Server console as the administrator.

   Username

   weblogic

   Password

   bea10admin

3. Under Domain Structure, click Deployments.

4. On the Summary of Deployments page, in the Change Center, click Lock & Edit.

5. Under Deployments, click Install.

6. On the Install Application Assistant page, click the pr1.sp-example.com link.

7. In the field named Location: pr1.sp-example.com, click the root directory.

8. Navigate to /export/J2EEPA1/j2ee_agents/weblogic_v10_agent/etc, the application directory.

9. Select agentapp.war and click Next.

10. In the Install Application Assistant page, choose Install this deployment as an application and click Next.

11. In the list of Servers, mark the checkbox for ApplicationServer-1 and click Next.

12. In the Optional Settings page, click Next.

13. Click Finish.

14. On the Settings for agentapp page, click Save.

15. In the Change Center, click Activate Changes.

16. On the Settings for agentapp page, click Deployments.

17. On the Summary of Deployments page, mark the agentapp checkbox and click Start > Servicing all requests.

18. On the Start Application Assistant page, click Yes.

    ---

    Tip –

    If you encounter a JavaScript^TM error, start the WebLogic Server instance and perform the steps again.

    ---

To Deploy the J2EE Policy Agent Sample Application

1. Access Application Server 1 at http://pr1.sp-example.com:7001/console.

2. Log in to the WebLogic Server console as the administrator.

   Username

   weblogic

   Password

   bea10admin

3. On the Change Center, click Lock & Edit.

4. Under Domain Structure, click Deployments.

5. Under Deployments, click Install.

6. On the Install Application Assistant page, click the pr1.sp-example.com link.

7. In the list for Location: pr1.example.com, click the root directory.

8. Navigate to the application directory (/export/J2EEPA1/j2ee_agents/weblogic_v10_agent/sampleapp/dist), select agentsample.ear and click Next.

9. In the Install Application Assistant page, choose Install this deployment as an application and click Next.

10. In the list of Servers, mark the checkbox for ApplicationServer-1 and click Next.

11. On the Optional Settings page, click Next to accept the default settings.

12. On the Review Your Choices page, click Finish.

    The Target Summary section indicates that the module agentsample will be installed on the target ApplicationServer-1.

13. On the Settings for agentsample page, click Save.

14. On the Settings for agentsample page, click Activate Changes.

15. Under Domain Structure, click Deployments.

16. In the Deployments list, mark the checkbox for agentsample and click Start > Servicing All Requests.

17. On the Start Application Assistant page, click Yes.

    The state of the deployment changes from Prepared to Active.

18. Log out of the Application Server 1 console.

To Configure the J2EE Policy Agent to Bypass Application Server Administrator Authentication

The J2EE policy agent can operate in local or centralized mode. The centralized option was selected during the custom installation of the agent. Centralized agent configuration stores agent configuration data in a data store managed by OpenSSO Enterprise. Since J2EE policy agents are configured in centralized mode, any configuration changes must be made using the OpenSSO Enterprise server. In this procedure, configure the agent to bypass authentication of the Application Server administrator.

1. Access https://lb4.sp-example.com:1081/opensso/console from a web browser.

2. Log in to the OpenSSO Enterprise console as the administrator.

   User Name:

   amadmin

   Password:

   ossoadmin

3. Under the Access Control tab, click / (Top Level Realm).

4. Click the Agents tab.

5. Click the J2EE tab.

   j2eeagent-1 is displayed under the Agent table.

6. Click j2eeagent-1.

   The j2eeagent-1 properties page is displayed.

7. Click the Miscellaneous tab.

   The Miscellaneous properties page is displayed.

8. Provide the user name of the Application Server administrator in the Bypass Principal List and click Add.

   Enter weblogic to ensure that the administrator will be authenticated against WebLogic itself and not OpenSSO Enterprise.

9. Click Save.

10. Exit the console and close the browser.

To Enable the J2EE Policy Agent to Run in SSO Only Mode

1. Access https://lb4.sp-example.com:1081/opensso/console from a web browser.

2. Log in to the OpenSSO Enterprise console as the administrator.

   User Name:

   amadmin

   Password:

   ossoadmin

3. Under the Access Control tab, click / (Top Level Realm).

4. Click the Agents tab.

5. Click the J2EE tab.

   j2eeagent-1 is displayed under the Agent table.

6. Click j2eeagent-1.

   The j2eeagent-1 properties page is displayed.

7. Click the General link on the j2eeagent-1 properties page.

8. Remove the existing value of the Agent Filter Mode property.

   This value is displayed in the Current Values text box.

9. Add the following values to the New Value text boxes and click Add.

   Map Key

   agentsample

   Corresponding Map Value

   SSO_ONLY

10. Click Save.

11. Log out of the OpenSSO Enterprise console and close the browser.

12. Log in to the pr1.sp-example.com host machine as root user.

13. Restart the WebLogic administration server and managed instance.

    # cd /usr/local/bea/user_projects/domains/pr1/bin # ./stopManagedWebLogic.sh ApplicationServer-1 t3://localhost:7001 # ./stopWebLogic.sh # ./startWebLogic.sh # ./startManagedWebLogic.sh ApplicationServer-1 t3://localhost:7001

14. Log out of the pr1.sp-example.com host machine.

15. Verify the configurations with the following sub procedure.

    1. Close and reopen the browser application.

    2. Access http://pr1.sp-example.com:1081/agentsample from a web browser.

    3. Log in to the OpenSSO Enterprise console as the administrator.

       User Name:

       spuser

       Password:

       spuser

       The user is redirected to the service provider console for authentication.

    4. Close the browser.

To Configure the J2EE Policy Agent for SAML v2 Communication

1. Access https://lb4.sp-example.com:1081/opensso/console from a web browser.

2. Log in to the OpenSSO Enterprise console as the administrator.

   User Name:

   amadmin

   Password:

   ossoadmin

3. Under the Access Control tab, click / (Top Level Realm).

4. Click the Agents tab.

5. Click the J2EE tab.

   j2eeagent-1 is displayed under the Agent table.

6. Click j2eeagent-1.

   The j2eeagent-1 properties page is displayed.

7. Click the OpenSSO Services tab.

   The Edit j2eeagent-1 page is displayed.

8. Click the Login URL link on the Edit j2eeagent-1 page.

9. Remove the existing value of the OpenSSO Login URL property.

   This value is displayed in the Selected box.

10. Enter https://lb4.sp-example.com:1081/opensso/spssoinit? metaAlias=/sp&idpEntityID=https://lb2.idp-example.com:1181/opensso in the text box and click Add.

    This URL redirects the agent to the identity provider for authentication.

11. Enter https://lb4.sp-example.com:1081/opensso/saml2/jsp/spSingleLogoutInit.jsp?idpEntityID=https://lb2.idp-example.com:1181/opensso as a value of the OpenSSO Logout URL attribute and click Add.

12. Click Save.

13. Click the Application tab.

14. Add the following values to the Application Logout URI text boxes and click Add.

    Map Key

    agentsample

    Corresponding Map Value

    /agentsample/logout

15. Click Save.

16. Log out of the OpenSSO Enterprise console and close the browser.

17. Log in to the pr1.sp-example.com host machine.

18. Restart the WebLogic administration server and managed instance.

    # cd /usr/local/bea/user_projects/domains/pr1/bin # ./stopManagedWebLogic.sh ApplicationServer-1 t3://localhost:7001 # ./stopWebLogic.sh # ./startWebLogic.sh # ./startManagedWebLogic.sh ApplicationServer-1 t3://localhost:7001

19. Log out of the pr1.sp-example.com host machine.

20. Verify the configurations with the following sub procedure.

    1. Access http://pr1.sp-example.com:1081/agentsample from a web browser.

       The user is redirected to the OpenSSO Enterprise login page on the identity provider side.

    2. Log in to the OpenSSO Enterprise console as the administrator.

       User Name:

       idpuser

       Password:

       idpuser

       After successful authentication, single sign on is accomplished between the identity provider and the service provider.

21. Access http://pr1.sp-example.com:1081/agentsample/logout from a web browser.

    The J2EE policy agent sample application welcome page is displayed. The user has successfully logged out of both the identity provider and the service provider.

10.2 Installing the Web Server and Web Policy Agent on Protected Resource 1

Download the Sun Java System Web Server bits to the Protected Resource 1 host machine (pr1.sp-example.com) and install it. Additionally, download, install and configure the appropriate web policy agent. Use the following list of procedures as a checklist for completing the task.

• To Patch the Protected Resource 1 Host Machine

• To Install and Configure Sun Java System Web Server on Protected Resource 1

• To Import a Certificate Authority Root Certificate to Protected Resource 1

• To Install and Configure Web Policy Agent on Protected Resource 1

• To Enable the Web Policy Agent to Run in SSO Only Mode

• To Configure the Web Policy Agent for SAML v2 Communication

To Patch the Protected Resource 1 Host Machine

Sun Java System Web Server is the second web container used on the pr1.sp-example.com host machine.

Before You Begin

Read the latest version of the Web Server 7.0 Release Notes to determine if you need to install patches on your host machine. In this case, the Release Notes indicate that based on the hardware and operating system being used, patch 119963–08, patch 120011–14, and patch 117461–08 are required.

1. As a root user, log into the pr1.sp-example.com host machine.

2. Run patchadd to see if the patch is installed.

   # patchadd -p | grep 117461–08

   A list of patch numbers is displayed. On our lab machine, the required patch 117461–08 is present so there is no need to install it.

   # patchadd -p | grep 119963–08

   No results are returned which indicates that the patch is not yet installed on the system.

   # patchadd -p | grep 120011-14

   No results are returned which indicates that the patch is not yet installed on the system.

3. Make a directory for downloading the patch you need and change into it.

   # mkdir /export/patches # cd /export/patches

4. Download the patches.

   You can search for patches directly at http://sunsolve.sun.com. Navigate to the PatchFinder page, enter the patch number, click Find Patch, and download the appropriate patch.

   ---

   Note –

   Signed patches are downloaded as JAR files. Unsigned patches are downloaded as ZIP files.

   ---

5. Unzip the patch file.

   # unzip 119963–08.zip # unzip 120011–14.zip

6. Run patchadd to install the patches.

   # patchadd /export/patches/119963–08 # patchadd /export/patches/120011–14

7. After installation is complete, run patchadd to verify that the patch was added successfully.

   # patchadd -p | grep 119963–08

   In this example, a series of patch numbers are displayed, and the patch 119963–08 is present.

   # patchadd -p | grep 120011-14

   In this example, a series of patch numbers are displayed, and the patch 120011–14 is present.

To Install and Configure Sun Java System Web Server on Protected Resource 1

Before You Begin

This procedure assumes you have just finished To Patch the Protected Resource 1 Host Machine and are still logged in as the root user.

1. Create a directory into which you can download the Web Server bits and change into it.

   # mkdir /export/WS7 # cd /export/WS7

2. Download the Sun Java System Web Server 7.0 Update 3 software from http://www.sun.com/download/products.xml?id=45ad781d.

   Follow the instructions on the Sun Microsystems Product Downloads web site for downloading the software.

3. Unpack the Web Server package.

   # gunzip sjsws-7_0u3-solaris-sparc.tar.gz # tar xvf sjsws-7_0u3-solaris-sparc.tar

4. Run setup.

   # cd /export/WS7 # ./setup --console

5. When prompted, provide the following information.

   Welcome to the Sun Java System Web Server 7.0u3 installation wizard. ... You will be asked to specify preferences that determine how Sun Java System Web Server 7.0U3 is installed and configured. The installation program pauses as questions are presented so you can read the information and make your choice. When you are ready to continue, press Enter. (Return on some keyboards.)	Press Enter. Continue to press Enter when prompted.
   Have you read the Software License Agreement and do you accept all terms [no] {"," goes back, "!" exits}?	Enter yes.
   Sun Java System Web Server 7.0 Installation Directory [/sun/webserver7] {"," goes back, "!" exits} :	Enter /opt/SUNWwbsvr
   Specified directory /opt/SUNWwbsvr does not exist. Create Directory? [Yes/No] [yes] {"," goes back, "!" exits}	Enter yes.
   Select Type of Installation 1. Express 2. Custom 3. Exit What would you like to do? [1] {"," goes back, "!" exits}	Enter 2.
   Component Selection 1. Server Core 2. Server Core 64-biy Binaries 3. Administration Command Line Interface 4. Sample Applications 5. Language Pack Enter the comma-separated list [1,2,3,4,5] {"," goes back, "!" exits}	Enter 1,3,5.
   Java Configuration Sun Java System Web Server 7.0 requires Java Se Development Kit (JDK). Provide the path to a JDK 1.5.0_15 or greater. 1. Install Java SE Development Kit (JDK) 1.5.0_15 2. Reuse existing Java SE Development Kit (JDK) 1.5.0_15 3. Exit What would you like to do? [1] {"," goes back, "!" exits}	Enter 1.
   Administrative Options 1. Create an Administration Server and a Web Server Instance 2. Create an Administration Node Enter your option. [1] {"," goes back, "!" exits}	Enter 1.
   Create SMF services for server instances [yes/no] [no] {"," goes back, "!" exits}	Accept the default value.
   Host Name [pr1.sp-example.com] {"," goes back, "!" exits}	Accept the default value.
   SSL Port [8989] {"," goes back, "!" exits}	Accept the default value.
   Create a non-SSL Port? [yes/no] [no] {"," goes back, "!" exits}	Enter no.
   Runtime User ID [root] {"," goes back, "!" exits}	Accept the default value (for the administration server).
   Administrator User Name [admin] {"," goes back, "!" exits}	Accept the default value.
   Administrator Password:	Enter web4dmin.
   Retype Password:	Enter web4dmin.
   Server Name [pr1.sp-example.com] {"," goes back, "!" exits}	Accept the default value.
   Http Port [8080] {"," goes back, "!" exits}	Enter 1080.
   Runtime User ID [webserverd] {"," goes back, "!" exits}	Enter root (for the instance).
   Document Root Directory [/opt/SUNWwbsvr/ https-pr1.sp-example.com/docs] {"," goes back, "!" exits}	Accept the default value.
   Start Administration Server [yes/no] [yes] {"," goes back, "!" exits}	Enter no.
   Ready To Install 1. Install Now 2. Start Over 3. Exit Installation What would you like to do [1] {"," goes back, "!" exits}?	Enter1.

   When installation is complete, the following message is displayed:

   Installation Successful.

6. Start the Web Server administration server.

   # cd /opt/SUNWwbsvr/admin-server/bin # ./startserv

7. Run netstat to verify that the port is open and listening.

   # netstat -an | grep 8989 *.8989 *.* 0 0 49152 0 LISTEN

8. (Optional) Login to the Web Server administration console at https://pr1.sp-example.com:8989 as the administrator.

   Username

   admin

   Password

   web4dmin

   You should see the Web Server administration console.

9. (Optional) Log out of the Web Server console and close the browser.

10. Start the Protected Resource 1 Web Server instance.

    # cd /opt/SUNWwbsvr/https-pr1.sp-example.com/bin # ./startserv Sun Java System Web Server 7.0U3 B06/16/2008 12:00 info: CORE5076: Using [Java HotSpot(TM) Server VM, Version 1.5.0_15] from [Sun Microsystems Inc.] info: HTTP3072: http-listener-1: http://pr1.sp-example.com:1080 ready to accept requests info: CORE3274: successful server startup

11. Run netstat to verify that the port is open and listening.

    # netstat -an | grep 1080 *.1080 *.* 0 0 49152 0 LISTEN

12. (Optional) Access the Protected Resource 1 instance at http://pr1.sp-example.com:1080 using a web browser.

    You should see the default Web Server index page.

13. Log out of the pr1.sp-example.com host machine.

To Import a Certificate Authority Root Certificate to Protected Resource 1

The Certificate Authority (CA) root certificate enables the web policy agent to trust the certificate from the OpenSSO Enterprise Load Balancer 2, and to trust the certificate chain that is formed from the CA to the server certificate.

Before You Begin

• Copy the same CA root certificate used in To Install a CA Root Certificate to OpenSSO Enterprise Load Balancer 2 to the pr1.sp-example.com host machine. In this example, the file is /export/software/ca.cer.

• Backup cacerts before modifying it.

1. As a root user, log into the pr1.sp-example.com host machine.

2. Import the CA root certificate into cacerts, the certificate store.

   # /opt/SUNWwbsvr/jdk/jre/bin/keytool -import -trustcacerts -alias OpenSSLTestCA -file /export/software/ca.cer -keystore /opt/SUNWwbsvr/jdk/jre/lib/security/cacerts -storepass changeit Owner: EMAILADDRESS=nobody@nowhere.com, CN=OpenSSLTestCA, OU=Sun, O=Sun,L=Santa Clara, ST=California C=US Issuer: EMAILADDRESS=nobody@nowhere.com, CN=OpenSSLTestCA, OU=Sun, O=Sun,L=Santa Clara, ST=California C=US Serial number: f59cd13935f5f498 Valid from: Thu Sep 20 11:14:51 PDT 2008 18 07:66:19 PDT 2006 until: Thu Jun 17 11:41:51 PDT 2010 Certificate fingerprints: MD5: 78:7D:F0:04:8A:5B:5D:63:F5:EC:5B:21:14:9C:8A:B9 SHA1: A4:27:8A:B0:45:7A:EE:16:31:DC:E5:32:46:61:9E:B8:A3:20:8C:BA Trust this certificate: [no] yes Certificate was added to keystore.

3. Verify that the CA root certificate was imported.

   # /opt/SUNWwbsvr/jdk/jre/bin/keytool -list -keystore /opt/SUNWwbsvr/jdk/jre/lib/security/cacerts -storepass changeit | grep -i open openSSLTestCA, Sep 20, 2008, trustedCertEntry,

4. Log out of the pr1.sp-example.com host machine.

To Install and Configure Web Policy Agent on Protected Resource 1

Before You Begin

The JAVA_HOME environment variable should be set to /opt/SUNWwbsvr/jdk/jre.

1. As a root user, log into the pr1.sp-example.com host machine.

2. Create a directory into which you can download the Web Server agent bits and change into it.

   # mkdir /export/WebPA1 # cd /export/WebPA1

3. Create a text file that contains the Agent Profile password.

   The Web Policy Agent installer requires this for installation.

   # cat > agent.pwd webagent1 Hit Control D to terminate the command ^D

4. Download the web policy agent for Web Server from http://www.sun.com/download/.

   # ls -al total 7512 drwxr-xr-x 2 root root 512 Jul 24 14:48 . drwxr-xr-x 11 root root 512 Jul 24 14:41 .. -rw-r--r-- 1 root root 10 Jul 24 14:42 agent.pwd -rw-r--r-- 1 root root 9 Jul 24 14:42 agentadm.pwd -rw-r--r-- 1 root root 3826794 Jul 24 14:48 sjsws_v70_SunOS_sparc_agent_3.zip

5. Unzip the downloaded file.

   # unzip sjsws_v70_SunOS_sparc_agent_3.zip

6. Run the agent installer.

   # cd /export/WebPA1/web_agents/sjsws_agent/bin # ./agentadmin --custom-install

7. When prompted, do the following.

   Please read the following License Agreement carefully:	Press Enter and continue to press Enter until you have reached the end of the License Agreement.
   Do you completely agree with all the terms and conditions of this License Agreement (yes/no): [no]:	Type yes and press Enter.
   Enter the Sun Java System Web Server Config Directory Path [/var/opt/SUNWwbsvr7/ https-pr1.sp-example.com/config]:	Type /opt/SUNWwbsvr/https-pr1.sp-example.com/config and press Enter.
   Enter the OpenSSO Enterprise URL including the deployment URI (http://opensso.sample.com:58080/opensso)	Type https://lb4.example.com:1081/opensso and press Enter.
   Enter the Agent URL: (http://agent1.sample.com:1234)	Type http://pr1.sp-example.com:1080 and press Enter.
   Enter the Encryption Key [WSpf7aqc3AFIGvf2mCqvNBOsf44cDrf3].	Accept the default value.
   Enter the Agent profile name [UrlAccessAgent]:	Type webagent-1 and press Enter.
   Enter the path to a file that contains the password to be used for identifying the Agent.	Type /export/WebPA1/agent.pwd and press Enter. Note – A warning message is displayed regarding the existence of the agent profile.
   ----------------------------------------- SUMMARY OF YOUR RESPONSES ----------------------------------------------- Sun Java System Web Server Config Directory : /opt/SUNWwbsvr/https-pr1.sp-example.com/config OpenSSO Server URL : https://lb4.sp-example.com:1081/opensso Agent URL : http://pr1.sp-example.com:1080 Encryption Key : WSpf7aqc3AFIGvf2mCqvNBOsf44cDrf3 Agent Profile name : webagent-1 Agent Profile Password file name : /export/WebPA1/agent.pwd Agent Profile will be created right now by agent installer : true Agent Administrator : amadmin Agent Administrator's password file name : /export/WebPA1/agentadm.pwd Verify your settings above and decide from the choices below. 1. Continue with Installation 2. Back to the last interaction 3. Start Over 4. Exit Please make your selection [1]:	Type 1 and press Enter.

8. Restart the Web Server 1 instance.

   # cd /opt/SUNWwbsvr/https-pr1.sp-example.com/bin # ./stopserv; ./startserv server has been shutdown Sun Java System Web Server 7.0U3 B06/16/2008 12:00 info: CORE3016: daemon is running as super-user info: CORE5076: Using [Java HotSpot(TM) Server VM, Version 1.5.0_15] from [Sun Microsystems Inc.] info: HTTP3072: http-listener-1: http://pr1.sp-example.com:1080 ready to accept requests info: CORE3274: successful server startup

9. Verify that the Web Policy Agent was successfully created in OpenSSO Enterprise using the following sub procedure.

   1. Access https://lb4.sp-example.com:1081/opensso/console from a web browser.

   2. Log in to the OpenSSO Enterprise console as the administrator.

      User Name:

      amadmin

      Password:

      ossoadmin

   3. Under the Access Control tab, click / (Top Level Realm).

   4. Click the Agents tab.

      By default, the Web tab is displayed. You should see webagent-1 under the Agent table.

   5. Click webagent-1.

      The webagent-1 properties page is displayed.

   6. Log out of the console and close the browser.

10. Remove the password files.

    # cd /export/WebPA1 # rm agent.pwd # rm agentadm.pwd

11. Log out of the pr1.sp-example.com host machine.

To Enable the Web Policy Agent to Run in SSO Only Mode

1. Access https://lb4.sp-example.com:1081/opensso/console from a web browser.

2. Log in to the OpenSSO Enterprise console as the administrator.

   User Name:

   amadmin

   Password:

   ossoadmin

3. Under the Access Control tab, click / (Top Level Realm).

4. Click the Agents tab.

5. Click the Web tab.

   webagent-1 is displayed under the Agent table.

6. Click webagent-1.

   The webagent-1 properties page is displayed.

7. Click the General link on the webagent-1 properties page.

8. Select the check box to enable the SSO Mode Only property.

9. Click Save.

10. Log out of the OpenSSO Enterprise console and close the browser.

11. Log in to the pr1.sp-example.com host machine as root user.

12. Restart the Web Server.

    # cd /opt/SUNWwbsvr/https-pr1.sp-example.com/bin # ./stopserv # ./startserv

13. Log out of the pr1.sp-example.com host machine.

14. Verify the configurations with the following sub procedure.

    1. Close and reopen the browser.

    2. Access https://lb4.sp-example.com:1080/index.html from a web browser.

    3. Log in to the OpenSSO Enterprise console using the following credentials.

       User Name:

       spuser

       Password:

       spuser

       The default Web Server page is displayed.

    4. Close the browser.

To Configure the Web Policy Agent for SAML v2 Communication

1. Access https://lb4.sp-example.com:1081/opensso/console from a web browser.

2. Log in to the OpenSSO Enterprise console as the administrator.

   User Name:

   amadmin

   Password:

   ossoadmin

3. Under the Access Control tab, click / (Top Level Realm).

4. Click the Agents tab.

5. Click the Web tab.

   webagent-1 is displayed under the Agent table.

6. Click webagent-1.

   The webagent-1 properties page is displayed.

7. Click the OpenSSO Services tab.

   The Edit webagent-1 page is displayed.

8. Click the Login URL link on the Edit webagent-1 page.

9. Remove the existing value of the OpenSSO Login URL property.

   This value is displayed in the Selected box.

10. Enter https://lb4.sp-example.com:1081/opensso/spssoinit?metaAlias=/sp&idpEntityID=https://lb2.idp-example.com:1181/opensso in the text box and click Add.

    This URL redirects the agent to the identity provider for authentication.

11. Select the existing value of the OpenSSO Logout URL attribute and click Delete.

12. Enter https://lb4.sp-example.com:1081/opensso/saml2/jsp/spSingleLogoutInit.jsp?metaAlias=/sp&idpEntityID=https://lb2.idp-example.com:1181/opensso in the text box and click Add.

13. Enter http://www.sun.com as a value of the Logout Redirect URL attribute and click Add.

14. Enter http://pr1.sp-example.com:1080/logout.html as a value of the Agent Logout URL List attribute and click Add.

15. Click Save.

16. Log out of the OpenSSO Enterprise console and close the browser.

17. Log in to the pr1.sp-example.com host machine.

18. Create the logout.html file using the following sub procedure.

    # cd /opt/SUNWwbsvr/https-pr1.sp-example.com/docs # vi logout.html

    This creates an empty file.

19. Restart the Web Server.

    # cd /opt/SUNWwbsvr/https-pr1.sp-example.com/bin # ./stopserv # ./startserv

20. Log out of the pr1.sp-example.com host machine.

21. Verify the configurations with the following sub procedure.

    1. Access http://pr1.sp-example.com:1080/index.html from a web browser.

       The OpenSSO Enterprise login page on the identity provider side is displayed. The browser is then redirected to the identity provider for authentication.

    2. Log in to the OpenSSO Enterprise console using the following credentials.

       User Name:

       idpuser

       Password:

       idpuser

       The default Web Server page is displayed.

    3. Access http://pr1.sp-example.com:1080/logout.html from a web browser.

       This will log out the user from the service provider and the identity provider using the SAML v2 single logout protocol.

    4. Close the browser.