Sun OpenSSO Enterprise Policy Agent 3.0 Guide for Apache HTTP Server 2.2.x

Pre-Installation Tasks for the Apache HTTP Server 2.2.x Agent

Meeting the Requirements for the Apache HTTP Server 2.2.x Agent

Before you install the Apache HTTP Server 2.2.x agent, your deployment must meet these requirements:

Setting Your JAVA_HOME Environment Variable

The agent installation program requires the Java Runtime Environment (JRE) 1.5 or later. Before you install the agent , set your JAVA_HOME environment variable to point to the JDK installation directory for the JDK version you are using. If you have not set this variable (or if you set it incorrectly), the program will prompt you for the correct path.

Downloading and Unzipping the Agent Distribution File

ProcedureTo Download and Unzip the Agent Distribution File

  1. Login into the server where you want to install the Apache HTTP Server 2.2.xagent.

  2. Create a directory to unzip the agent distribution file.

  3. Download and unzip the agent distribution file, depending on your platform:


    Distribution File 

    Solaris SPARC systems, 64–bit

    Solaris SPARC systems, 32–bit

    Solaris x86 systems, 64–bit

    Solaris x86 systems, 32–bit

    Linux systems, 64–bit

    Linux systems, 32–bit

    Windows systems

    IBM AIX systems

    HP-UX systems

    These distribution files are available from the Oracle E-Delivery Web site:

    The following table shows the files and directories after you unzip the agent distribution file. These files are in the following directory:

    AgentHome/web_agents/apache22_agent, where AgentHome is where you unzipped the agent distribution file.

    For example: /opt/web_agents/apache22_agent

    File or Directory 


    README.txt and license.txt

    Readme and license files 


    • UNIX, Linux, and AIX systems: agentadmin, certutil, and crypt_util

    • Windows systems: agentadmin.bat, certutil.exe, and cryptit.exe


    Template, properties, and XML files 


    license.log file (Do not edit this file.)


    dsame.template file


    Library and JAR files 


    Properties files 


    Log files after you install the agent 

Creating a Password File

A password file is an ASCII text file with only one line specifying the password in clear text. By using a password file, you are not forced to expose a password at the command line during the agent installation. When you install the Apache HTTP Server agent using the agentadmin program, you are prompted to specify paths to following password files:

ProcedureTo Create a Password File

  1. Create an ASCII text file for the password file. For example: /tmp/apache22agentpw

  2. If you want the agentadmin program to automatically create the agent profile in Oracle OpenSSO server during the installation, create another password file for the agent administrator. For example: /tmp/agentadminpw

  3. Using a text editor, enter the appropriate password in clear text on the first line in each file.

  4. Secure each password file appropriately, depending on the requirements for your deployment.

Creating an Agent Profile

A web agent uses an agent profile to communicate with Oracle OpenSSO server. For a version 3.0 agent, however, you must create an agent profile using any of these three methods:

ProcedureTo Create an Agent Profile in the Oracle OpenSSO Console

  1. Login into the Oracle OpenSSO Administration Console as amAdmin.

  2. Click Access Control, realm-name, Agents, and Web.

  3. Under Agent, click New.

  4. In the Name field, enter the name for the new agent profile.

  5. Enter and confirm the Password.

    Important: This password must be the same password that you enter in the agent profile password file that you specify when you run the agentadmin program to install the agent.

  6. In the Configuration field, check the location where the agent configuration properties are stored:

    • Local: In the file on the server where the agent is installed.

    • Centralized: In the Oracle OpenSSO server central configuration data repository.

  7. In the Server URL field, enter the Oracle OpenSSO server URL.

    For example:

  8. In the Agent URL field, enter the URL for the agent.

    For example:

  9. Click Create.

    The console creates the agent profile and displays the WebAgent page again with a link to the new agent profile.

    To do additional configuration for the agent, click this link to display the Edit agent page. For information about the agent configuration fields, see the Console online Help.

    If you prefer, you can also use the ssoadm command-line utility to edit the agent profile. For more information, see the Sun OpenSSO Enterprise 8.0 Administration Reference.

Setting the IBM JDK/JRE for IBM AIX Systems

ProcedureTo Set the IBM JDK/JRE for IBM AIX Systems

Perform this task only if you are installing the Apache HTTP Server 2.2.x agent on an IBM AIX system and you are using the IBM JDK/JRE.

  1. After you download and unzip the Apache HTTP Server 2.2.x agent distribution file for AIX, locate the agentadmin script in the following directory:

    AgentHome/web_agents/apache22_agent/bin, where AgentHome is where you unzipped the agent distribution file.

  2. In the agentadmin script, comment out the following line, which sets the regular JDK/JRE classpath:

    $JAVA_VM -classpath "$AGENT_CLASSPATH" $*
  3. In the agentadmin script, uncomment the following line at the end of the file, which sets the IBM JDK/JRE classpath:

    #$JAVA_VM -DamKeyGenDescriptor.provider=IBMJCE -DamCryptoDescriptor.provider=IBMJCE 
    -DamRandomGenProvider=IBMJCE -classpath "$AGENT_CLASSPATH" $*
  4. Save your changes.

Creating an Agent Administrator (Optional)

Creating an agent administrator is optional. An agent administrator can manage agents in Oracle OpenSSO, including:

ProcedureTo Create an Agent Administrator

  1. Login to Oracle OpenSSO Console as amadmin.

  2. Create a new agents administrator group:

    1. Click Access Control, realm-name, Subjects, and then Group.

    2. Click New.

    3. In ID, enter the name of the group. For example: agentadmingroup

    4. Click OK.

  3. Create a new agent administrator user and add the agent administrator user to the agents administrator group:

    1. Click Access Control, realm-name, Subjects, and then User.

    2. Click New and provide the following values:

      • ID: Name of the agent administrator. For example: agentadminuser

        This is the name you will use to login to the Oracle OpenSSO Console .

      • First Name (optional), Last Name, and Full Name.

        For simplicity, use the same name for each of these values that you specified in the previous step for ID.

      • Password (and confirmation)

      • User Status: Active

    3. Click OK.

    4. Click the new agent administrator name.

    5. On the Edit User page, click Group.

    6. Add the agents administrator group from Available to Selected.

    7. Click Save.

  4. Assign read and write access to the agents administrator group:

    1. Click Access Control, realm-name, Privileges and then on the new agents administrator group link.

    2. Check Read and write access to all configured Agents.

    3. Click Save.

Next Steps

Login into the Oracle OpenSSO Console as the new agent administrator. The only available top-level tab is Access Control. Under realm-name, you will see only the Agents tab and sub tabs.