Chapter 14 Access Manager Utilities

Sun Java™ System Access Manager 6 2005Q1 provides scripts to backup and restore data as well as application programming interfaces (API) that are used by the server itself or by external applications. This chapter explains the scripts and the API. It contains the following sections:

Utility API

Password API Plug-Ins

Utility API

The utilities package is called com.iplanet.am.util. It contains utility programs that can be used by external applications accessing Access Manager. Following is a summary of the utility API and their functions.

AdminUtils

This class contains the methods used to retrieve TopLevelAdmin DN and password. The information comes from the server configuration file, serverconfig.xml, located in /IdentityServer_base/SUNWam/config/ums.

AMClientDetector

The AMClientDetector interface executes the Client Detection Class configured in the Client Detection Service to get the client type.

AMPasswordUtil

Encrypting and decrypting any string.

Encrypting and decrypting special user passwords such as the password for dsameuser or proxy user.



Note	Any remote application using this utility should have the value of the AMConfig property am.encryption.pwd copied to a properties file on the client side. This value is generated at installation time and stored in /IdentityServer_base/SUNWam/lib/AMConfig.properties. More information on this property can be found in the Encryption section of the Appendix A, "AMConfig.properties File."

Debug

Debug allows an interface to file debug and exception information in a uniform format. It supports different levels of information (in the ascending order): OFF, ERROR, WARNING, MESSAGE and ON. A given debug level is enabled if it is set to at least that level. For example, if the debug state is ERROR, only errors will be filed. If the debug state is WARNING, only errors and warnings will be filed. If the debug state is MESSAGE, everything will be filed. MESSAGE and ON are the same level except MESSAGE writes to a file, whereas ON writes to System.out.



Note	Debugging is an intensive operation and can hurt performance. Java evaluates the arguments to message() and warning() even when debugging is turned off. It is recommended that the debug state be checked before invoking any message() or warning() methods to avoid unnecessary argument evaluation and maximize application performance.

Locale

This class is a utility that provides the functionality for applications and services to internationalize their messages.

SystemProperties

This class provides functionality that allows single-point-of-access to all related system properties. First, the class tries to find AMConfig.class, and then a file, AMConfig.properties, in the CLASSPATH accessible to this code. The class takes precedence over the flat file. If multiple servers are running, each may have their own configuration file. The naming convention for such scenarios is AMConfig_serverName.

ThreadPool

ThreadPool is a generic thread pool that manages and recycles threads instead of creating them when a task needs to be run on a different thread. Thread pooling saves the virtual machine the work of creating new threads for every short-lived task. In addition, it minimizes the overhead associated with getting a thread started and cleaning it up after it dies. By creating a pool of threads, a single thread from the pool can be reused any number of times for different tasks. This reduces response time because a thread is already constructed and started and is simply waiting for its next task.

Another characteristic of this thread pool is that it is fixed in size at the time of construction. All the threads are started, and then each goes into a wait state until a task is assigned to it. If all the threads in the pool are currently assigned a task, the pool is empty and new requests (tasks) will have to wait before being scheduled to run. This is a way to put an upper bound on the amount of resources any pool can use up. In the future, this class may be enhanced to provide support growing the size of the pool at runtime to facilitate dynamic tuning.

Password API Plug-Ins

The Password API plug-ins can be used to integrate password functions into applications. They can be used to generate new passwords as well as notify users when their password has been changed. These interfaces are PasswordGenerator and NotifyPassword, respectively. They can be found in the com.sun.identity.password.plugins package.



Note	The Access Manager Javadocs can be accessed from any browser by copying the complete IdentityServer_base/SUNWam/docs/ directory into the IdentityServer_base/SUNWam/public_html directory and pointing the browser to http://identity_server_host.domain_name:port/docs/ index.html.

There are samples (which include sample code) for these API that can be accessed from the Access Manager installation. They are located in IdentityServer_base/SUNWam/samples/console. They include:

Notify Password Sample

This sample details how to build a plug-in which an administrator can define their own method of notification when a user has reset a password. Instructions for this sample are in the Readme.txt or Readme.html file located in IdentityServer_base/SUNWam/samples/console/NotifyPassword.

Password Generator Sample

This sample details how to build a plug-in which an administrator can define their own method of random password generation when a user’s password is reset using the Password Reset Service. Instructions for this sample are in the Readme.txt or Readme.html file located in IdentityServer_base/SUNWam/samples/console/PasswordGenerator.

Previous Contents Index Next
Sun Java System Access Manager 6 2005Q1 Developer's Guide