Version 3.0 agents, including the agentadmin program, require JDK 1.5 or later to be available on the server where you plan to install the agent. Before you install the agent, set your JAVA_HOME environment variable to point to the JDK installation directory.
Login to the server where you want to install the agent.
Create a directory to unzip the websphere_v61_agent_3.zip distribution file.
This guide uses Agent-HomeDirectory to represent the directory where you unzip the distribution file.
Download and unzip the websphere_v61_agent_3.zip distribution file from one of the following sites:
Sun Downloads site under Identity Management > Policy Agents: http://www.sun.com/download/index.jsp
OpenSSO project site: https://opensso.dev.java.net/public/use/index.html
The following table shows the files and directories after you unzip the agent distribution file, which are in the following directory:
Agent-HomeDirectory/j2ee_agents/websphere_v61_agent
Agent-HomeDirectory is where you unzipped the agent distribution file.
File or Directory |
Description |
---|---|
README.txt and license.txt |
Readme and license files |
/bin |
agentadmin and agentadmin.bat programs |
/config |
Template, properties, and XML files |
/data |
license.log file. Do not edit this file. |
/etc |
Agent application (agentapp.war). The agent application is a housekeeping application used by the agent for notifications and other functions such as cross domain single sign-on (CDSSO) support. For more information, see Deploying the Agent Application. |
/installer-logs |
Log files written by the agentadmin or agentadmin.bat program:
|
/lib |
Required JAR files |
/locale |
Required properties files |
/sampleapp |
Policy agent sample application. For information, see Deploying the Java EE Policy Agent Sample Application. |
A password file is an ASCII text file with only one line specifying the password in clear text. By using a password file, you are not forced to expose a password at the command line during the agent installation. When you install the WebSphere Application Server/Portal Server agent using the agentadmin program, you are prompted to specify paths to following password files:
An agent profile password file is required for both the agentadmin default and custom installation options.
An agent administrator password file is required only if you use the custom installation option and have the agentadmin program automatically create the agent profile in OpenSSO Enterprise server during the installation.
Create an ASCII text file for the agent profile. For example: /tmp/wsas6agentpw
If you want the agentadmin program to automatically create the agent profile in OpenSSO Enterprise server during the installation, create another password file for the agent administrator. For example: /tmp/agentadminpw
Using a text editor, enter the appropriate password in clear text on the first line in each file.
Secure each password file appropriately, depending on the requirements for your deployment.
The WebSphere Application Server/Portal Server agent uses an agent profile to communicate with OpenSSO Enterprise server. You can create an agent profile using any of these three methods:
Create the agent profile during installation when you run the agentadmin program with the --custom-install option. The program prompts you for this information:
Agent profile name and path to the agent profile password file
Agent administrator name and path to the agent administrator password file
Use the OpenSSO Enterprise Console
Use the ssoadm command-line utility with the create-agent subcommand. For more information about the ssoadm command, see the Sun OpenSSO Enterprise 8.0 Administration Reference.
Login into the OpenSSO Enterprise Administration Console as amAdmin.
Click Access Control, realm-name, Agents, and then J2EE.
Under Agent, click New.
In the Name field, enter the name for the new agent profile. For example: WSASAgentProfile
Enter and confirm the Password.
Important: This password must be the same password that you enter in the agent profile password file that you specify when you run the agentadmin program to install the agent.
In the Server URL field, enter the OpenSSO Enterprise server URL.
For example: http://openssohost.example.com:8080/opensso
In the Agent URL field, enter the URL for the agent application (agentapp).
For example: http://agenthost.example.com:8090/agentapp
The agent application (agentapp.war) is a housekeeping application used by the agent for notifications and other functions such as cross domain single sign-on (CDSSO) support. For more information, see Deploying the Agent Application.
Click Create.
The console creates the agent profile and displays the J2EE Agent page again with a link to the new agent profile, WSASAgentProfile.
To do additional configuration for the agent profile, click the agent link to display the Edit agent page. For information about the agent configuration fields, see the Console online Help.
If you prefer, you can also use the ssoadm command-line utility to edit the agent profile. For more information, see the Sun OpenSSO Enterprise 8.0 Administration Reference.
Make a note of the values you specified for the agent profile, including the profile name, password, server URL, and agent URL. You will need these values when you install the agent using the agentadmin program.
If the WebSphere Application Server/Portal Server agent will not retrieve the Role from the Access Manager SDK (AMSDK) Identity Repository Plug-in, perform the following steps:
Click the WebSphere Application Server/Portal Server agent link (for example, WSASAgentProfile) to display the agent profile Edit page.
Click the Application subtab.
Click the Privilege Attributes Processing link.
Under the Privilege Attributes Processing section, remove Role from the Current Values for the Privileged Attribute Type list box.
You should have only Group left under the Current Values.
Click Save.
An agent administrator can manage agents in OpenSSO Enterprise, including:
Agent management: Use the agent administrator to manage agents either in the OpenSSO Enterprise Console or by executing the ssoadm utility.
Agent installation: If you install the agent using the custom installation option (agentadmin --custom-install) and want to have the installation program create the agent profile, specify the agent administrator (and password file) when you are prompted.
Login to OpenSSO Enterprise Administration Console.
Create a new agents administrator group:
Create a new agent administrator user and add the agent administrator user to the agents administrator group:
Click Access Control, realm-name, Subjects, and then User.
Click New and provide the following values:
ID: Name of the agent administrator. For example: agentadminuser
This is the name you will use to login to the OpenSSO Enterprise Console .
First Name (optional), Last Name, and Full Name.
For simplicity, use the same name for each of these values that you specified for ID.
Password (and confirmation)
User Status: Active
Click OK.
Click the new agent administrator name.
On the Edit User page, click Group.
Add the agents administrator group from Available to Selected.
Click Save.
Assign read and write access to the agents administrator group:
Login into the OpenSSO Enterprise Console as the new agent administrator. The only available top-level tab is Access Control. Under realm-name, you will see only the Agents tab and sub tabs.