test

Sun Java System Federation Manager 7.0 User's Guide

ProcedureTo Change the Default Administrator Authentication Module from Flat File to Sun Java System Directory Server

  1. Use the following template, modify ROOT SUFFIX to reflect that of the organization.


    <?xml version="1.0" encoding="ISO-8859-1"?>
<!--
    Copyright (c) 2005 Sun Microsystems, Inc. All rights reserved
    Use is subject to license terms.
-->

<!DOCTYPE Requests
    PUBLIC "-//iPlanet//Sun Java System Access Manager 2005Q4 Admin CLI DTD//EN"
    "jar://com/iplanet/am/admin/cli/amAdmin.dtd"

<!--  CREATE REQUESTS -->

<Requests>
<OrganizationRequests DN="ROOT SUFFIX">
   <ModifyServiceTemplate serviceName="iPlanetAMAuthService" 
    schemaType="Organization">
     <AttributeValuePair>
       <Attribute name="iplanet-am-auth-admin-auth-module" />
         <Value>&lt;AttributeValuePair&gt;&lt;Value&gt;com.sun.
          identity.authentication.modules.ldap.LDAPREQUIRED&lt;
          Value&gt;&lt;AttributeValuePair&gt;</Value>
     </AttributeValuePair>
   </ModifyServiceTemplate>
</OrganizationRequests>
</Requests>

  2. Load the modified XML file using amadmin and the format FederationManager-base/fm/bin/amadmin —u amadmin —w password —i war—staging—directory -t name-of-XML-file.

  3. Make the following changes in the AMConfig.properties file.

    AMConfig.properties is located in /FederationManager-base/web-src/WEB-INF/. Multiple entries are pipe-separated.

    1. Add the distinguished name (DN) of the administrator to the com.sun.identity.authentication.special.users property.

    2. (Optional) Change the DN of the administrator in the com.sun.identity.authentication.super.user property.

      This step is included if you want to use an administrator who already exists in your directory and not the default Federation Manager administrator amadmin. To use the default amadmin, create the user in Directory Server and make sure the user is given read, write and search permissions to the ou=services branch of the directory information tree (DIT).

    3. Change the value of the admin.auth.classname property to com.sun.identity.authentication.internal.server.LocalLdapAuthModule.

  4. In the serverconfig.xml file, change the value of the server group internalauthentication property to reflect the administrator DN, password and correct base DN.

    serverconfig.xml is located in /FederationManager-base/web-src/WEB-INF/.

  5. Regenerate and redeploy the WAR.

  6. Restart the web container, if applicable.