#### J2EE Policy Agent

A J2EE agent instance can be configured using this interface. The properties described only apply if during agent creation, centralized configuration was chosen. If local configuration was selected, the properties related to this agent must be edited in the `OpenSSOAgentConfiguration.properites` file in the agent installation directory.

The types of configuration available are divided into the following categories:

- Global

- Application

- SSO

- OpenSSO Services

- Miscellaneous

- Advanced

##### Global

These properties apply to all applications protected by an agent.

##### Group

If applicable, select a group from the drop down list to assign this agent to the group. This list consists of previously configured groups.

##### Password

The password was set when you created the agent profile. However, you can change the password at any time in the future.

##### Password Confirm

The confirmation of the password was performed when you created the agent profile. If you change the password, you must confirm the change.

##### Status

The `Active` option is selected when the agent is created. Choose `Inactive` only if you want to remove the protection the agent provides.

##### Agent Notification URL

The URL used by the agent to register notification listeners.

##### Location of Agent Configuration Repository

If desired, change the configuration location to whichever of the two options is available: centralized or local. The centralized location allows you to control the configuration in a centralized manner, such as from the Console.

The local option is provided for backward compatibility purposes. If the local configuration option is selected, the agent will use its local configuration in the `OpenSSOAgentConfiguration.properites` file in the agent installation directory. In addition, the Console will only display the following properties: Password, Password (confirmation), and Status.

##### Configuration Reload Interval

The interval in seconds between configuration reloads. Setting this property to `0` disables the hot-swap mechanism.

##### Agent Configuration Change Notification

When enabled, the agent receives notification messages from the OpenSSO server about configuration changes.

##### Agent Filter Mode

The mode of operation for the filter. For this properly, a global value can be set to apply to all the applications that don't have their own specific filter mode.

Enter a web application name for the Map Key and a value for the Corresponding Map Values. Valid values are ALL, J2EE_POLICY, URL_POLICY, SSO_ONLY, and NONE. To set ALL as the global filter mode: leave Map Key field empty, and enter ALL in Corresponding Map Value field.

##### Resource Access Denied URI:

The URL of the customized access denied page. If no value is provided, the agent returns an `HTTP` status of `403 (Forbidden)`.

##### HTTP Session Binding

When enabled, the `HTTP` session is invalidated when login fails. The user has no SSO session, or the principal user name does not match the SSO user name.

##### GOTO Parameter Name

A string that represents the `goto` parameter name, which is used by the agent to redirect the user to the appropriate authentication service. The value of this parameter is used by the authentication service to redirect the user to the original requested destination.

##### Login Attempt Limit

The number of failed login attempts allowed during a single browser session until the user request is blocked. A value of `0` disables this feature.

##### Custom Response Header

A list of mappings of custom headers. The headers are set by the agent on the client browser. Enter a header name for the Map Key and the header value for the Corresponding Map Values.

##### Redirect Attempt Limit

The number of successive single point redirects allowed during a single browser session until the user request is blocked. A value of `0` disables this feature.

##### Agent Debug Level

The type of debug messages logged. This setting determines the level of the debug log saved locally on the agent host.

##### User Mapping Mode

The mechanism the agent uses to determine the user ID.

##### User Attribute Name

The name of the attribute that contains the user ID. The value for this property is not used if the property labeled User Mapping Mode is set to `USER_ID`.

##### User Principal Flag

When enabled, the principal of the authenticated user is used to authenticate the user instead of solely the user ID. The value for this property is used if the property labeled User Mapping Mode is set to `USER_ID`.

##### User Token Name

The session property name of the user ID of the authenticated user in session. The value for this property is used when the property labeled User Mapping Mode is set to `USER_ID` and the property labeled User Principal Flag is not enabled.

##### Audit Access Types

The types of messages the agent logs based on user URL access attempts.

##### Audit Log Location

The location to which audit messages are logged.

##### Remote Log File Name

Name of the OpenSSO log file to which each URL access to OpenSSO is recorded.

##### Rotate Local Audit Log

When enabled, audit log files are rotated when they reach the size specified by the property labeled Local Audit Log Rotation Size.

##### Local Audit Log Rotation Size

The size at which the local audit log file is rotated to a new file.

##### FQDN Check

When enabled, the FQDN default value and the FQDN map values are checked.

##### FQDN Default

The fully qualified host name for users to use to access resources.

##### FQDN Virtual Host Map

A mapping to an actual or valid host name. This mapping is from a host name that is not recognized to one that is recognized. This mapping is useful in the following situations: when an IP address or an incorrect URL is entered by the user or when a virtual host is used for protected resources.

Enter values for the Map Key and the Corresponding Map Values and click Add.

##### Application

These properties tend to be application specific.

##### Login Form URI

The list of absolute URIs corresponding to an application's `web.xml` form-login-page element.

##### Login Error URI

The list of absolute URIs corresponding to an application's `web.xml` form-error-page element.

##### Use Internal Login

When enabled, agent uses the customized internal content as specified by the property labeled Login Content File Name. When not enabled, the agent uses the default internal content.

##### Login Content File Name

The complete path and name of the custom login content file.

##### Application Logout Handler

Application-specific mappings, each of which identifies a handler to be used for logout processing.

Enter the logout handler for the Map Key field and the application logout handler class name in the Corresponding Map Values field. Click Add.

##### Application Logout URI

Application-specific mappings, each of which identifies a request URI. The presence of the specified request URI indicates a logout event.

Enter the logout URI for the Map Key field and the application logout URI in the Corresponding Map Values field. Click Add.

##### Logout Request Parameter

Application-specific mappings, each of which identifies a parameter. The presence of the specified parameter in the `HTTP` request indicates a logout event.

##### Logout Introspect Enabled

When enabled, the agent to searches the `HTTP` request body to locate the logout parameter.

##### Logout Entry URI

Application specific mappings, each of which identifies a URI to be used as an entry point after successful logout and, if applicable, after subsequent successful authentication.

Enter the value for the Map Key field and the logout entry URI in the Corresponding Map Values field. Click Add.

##### Not Enforced URIs

A URI list for which no authentication is performed. For every URI on this list, protection is not enforced by the agent and credentials are not requested.

##### Invert Not Enforced URIs

When enabled, the not enforced URI list becomes the enforced list. Therefore, all the URIs listed as values for the property labeled Not Enforced URIs are then enforced, while all other URIs are not enforced.

##### Not Enforced URIs Cache Enabled

When enabled, the evaluation results are cached for not-enforced URIs. Therefore, evaluation results are cached for the list of values associated with the property labeled Not Enforced URIs.

##### Not Enforced URIs Cache Size

When the property labeled Not Enforced URIs Cache Enabled is enabled, the value specified for this property is used to set the cache size.

##### Not Enforced Client IP List

Client IP address list, requests from which do not undergo authentication or authorization. For every IP address on this list, access is granted, credentials are not requested for authentication or authorization.

##### Not Enforced IP Invert List

When enabled, the not-enforced client IP list becomes the enforced list. Therefore, all the IP addresses listed as values for the property labeled Not Enforced Client IP List are then enforced, while all other IP addresses are not enforced.

##### Not Enforced IP Cache Flag

When enabled, the evaluation results are cached for not-enforced IP addresses. Therefore, evaluation results are cached for the list of values associated with the property labeled Not Enforced Client IP List.

##### Not Enforced IP Cache Size

When the property labeled Not Enforced IP Cache Flag is enabled, the value specified for this property is used to set the cache size.

##### Profile Attribute Fetch Mode

The modes available to fetch additional user profile attributes to be introduced into a request.

##### Profile Attribute Mapping

A list of mappings from profile attribute names to `HTTP` header names. The `HTTP` header names are populated under specific names for the currently authenticated user.

##### Response Attribute Fetch Mode

The modes available to fetch additional user response attributes to be introduced into a request.

##### Response Attribute Mapping

A list of mappings from response attribute names to `HTTP` header names. The HTTP header names are populated under specific names for the currently authenticated user.

##### Cookie Separator Character

The character to be used to separate multiple values of the same attribute when it is being set as a cookie.

##### Fetch Attribute Date Format

The format of date attribute values to be used when the attribute is being set as an `HTTP` header. The format is based on `java.text.SimpleDateFormat`.

##### Attribute Cookie Encode

When enabled, the value of the attribute is URL encoded before being set as a cookie.

##### Session Attribute Fetch Mode

The modes available to fetch additional user session attributes to be introduced into a request.

##### Session Attribute Mapping

A list of mappings from session attribute names to `HTTP` header names. The session attribute names are populated under specific names for the currently authenticated user.

##### Default Privileged Attribute

A list of privileged attributes to authenticated users. These attributes are granted to all users who have a valid OpenSSO session.

##### Privileged Attribute Type

A list of privileged attribute types to be fetched for each user.

##### Privileged Attributes To Lower Case

A list of mappings from privileged attribute types to values of `true` or `false`: `true` to indicate that the attribute type is converted to lowercase or `false` if it is not converted.

##### Privileged Session Attribute

A list of session property names that hold privileged attributes for the authenticated user.

##### Enable Privileged Attribute Mapping

When enabled, mappings are applied from an attribute's original value to an alternate value as specified by the property labeled Privileged Attribute Mapping.

##### Privileged Attribute Mapping

A list of mappings from an attribute's original value to an alternate value. This property is effective only when the property labeled Enable Privileged Attribute Mapping is enabled.

##### Custom Authentication Handler

A list of mappings from an application to the authentication handler specific to that application. Each authentication handler is used by the agent to authenticate the user within the container for the specified application.

##### Custom Logout Handler

A list of mappings from an application to the logout handler specific to that application. Each logout handler is used by the agent to log out the user within the container for the specified application.

##### Custom Verification Handler

A list of mappings from an application to the local verification handler specific to that application. Local verification handlers are used by the agent to validate the user credentials with the local repository.

##### SSO

These properties allow you to configure features of the agent related to single sign-on (SSO) and cross domain single sign-on (CDSSO).

##### Cookie Name

The name of the SSO token cookie used between the OpenSSO server and the agent.

##### SSO Cache Enable

When enabled, the SSO cache is active for the agent and can be used through public APIs exposed by the agent SDK.

##### Cross Domain SSO

When enabled, cross domain single sign-on (CDSSO) is active.

##### CDSSO Redirect URI

An intermediate URI used by the agent to process CDSSO requests.

##### CDSSO Servlet URL

A list of URLs of the available CDSSO controllers. These URLs can be used by the agent for CDSSO processing.

##### CDSSO Clock Skew

The number of seconds to be used by the agent to determine the validity of the CDSSO `AuthnResponse` assertion.

##### CDSSO Trusted ID Provider

A list ofOpenSSO Server/ID providers to be trusted by the agent when evaluating the CDC Liberty responses. Setting this property is necessary when a load balancer, firewall, or both are present between the agent and theOpenSSO instance.

##### CDSSO Secure Enable

When enabled and when the communications channel with the host is secure, the SSO token cookie set by the agent in the different domains in CDSSO mode are marked secure.

##### CDSSO Domain List

A list of domains for which cookies have to be set in a CDSSO scenario.

##### Cookie Reset

When enabled, the agent resets cookies in the response before redirecting to authentication.

##### Cookies Reset Name List

A list of cookie names to be reset by the agent if the property labeled Cookie Reset is enabled.

##### Cookies Reset Domain Map

A list of mappings from a cookie name specified by the property labeled Cookie Reset Name List to the domain of the cookie to be used when a reset event occurs (the value).

##### Cookies Reset Path Map

A list of mappings from a cookie name specified in the property labeled Cookie Reset Name List (the key) to the path of the cookie to be used when a reset event occurs (the value).

##### OpenSSO Services

These properties configure the OpenSSO services that the agent uses, such as policy service, session service, authentication service, and service management (SM) service.

##### OpenSSO Login URL

A list of URLs to OpenSSO authentication. When authentication is required, the agent redirects incoming users to the appropriate authentication service as specified by the URL.

##### Login URL Prioritized

When enabled, prioritizes the failover sequence for Login URLs or CDSSO URLs as defined by the property labeled OpenSSO Login URL.

##### Login URL Probe

When enabled, the agent checks the availability of the URLs defined by the property labeled OpenSSO Login URL before redirecting to them.

##### Login URL Probe Timeout

When the property labeled Login URL Probe is enabled, the value specified for this property determines the number of milliseconds for the connect timeout.

##### OpenSSO Logout URL

A list of OpenSSO logout page URLs.

##### Logout URL Prioritized

When enabled, prioritizes the failover sequence for logout URLs as defined by the property labeled OpenSSO Login URL.

##### Logout URL Probe

When enabled, the agent checks the availability of logout URLs, as defined by the property labeled OpenSSO Login URL, before redirecting to them.

##### Logout URL Probe Timeout

When the property labeled Logout URL Probe is enabled, the value specified for this property determines the number of milliseconds for the connect timeout.

##### OpenSSO Authentication Service Protocol

The protocol to be used by the OpenSSO authentication service.

##### OpenSSO Authentication Service Host Name

The host name to be used by the OpenSSO authentication service.

##### OpenSSO Authentication Service Port

The number of the port to be used by the OpenSSO authentication service.

##### Enable Policy Notifications

When enabled, notifications are operative for the remote policy client.

##### Policy Client Polling Interval

The duration in minutes after which the cached entries are refreshed by the remote policy client.

##### Policy Client Cache Mode

The mode of caching to be used by the remote policy client. The valid values are as follows: `subtree` or `self`.

##### Policy Client Boolean Action Values

The boolean action values available for policy action names.

Example:

    serviceName|actionName|trueValue|falseValue

##### Policy Client Resource Comparators

The resource comparators to be used for different service names.

##### Policy Client Clock Skew

The number of seconds allowed to accommodate the time difference between the OpenSSO server machine and the remote policy client machine.

##### URL Policy Env GET Parameters

A list of `HTTP GET` request parameters whose names and values are to be set in the environment map for URL policy evaluation at OpenSSO server.

The map key is in the format of `GET` parameterName while the map value is a set of string values of the parameter.

##### URL Policy Env POST Parameters

A list of `HTTP POST` request parameters whose names and values are to be set in the environment map for URL policy evaluation at OpenSSO erver.

The map key is in the format of `POST` parameterName while the map value is a set of string values of the parameter.

##### URL Policy Env jsession Parameters

A list of `HTTP SESSION` attributes whose names and values are to be set in the environment map for URL policy evaluation at OpenSSO server.

The map key is in the format of `JSESSION` parameterName while the map value is a set of string values of the parameter.

##### User Data Cache Polling Time

The cache update time in minutes for user management data. If set to `0`, no updates occur.

##### Enable Notification of Service Data Caches

When enabled, notifications are operative for service management caches.

##### Service Data Cache Time

Cache update time in minutes for service configuration data. If set to `0`, no updates occur.

This property takes effect only if no notification URL is provided as a value for the property labeled Agent Notification URL or if notifications are disabled.

##### Enable Client Polling

When enabled, the session client must use polling for updating session information and not depend upon server notifications.

##### Client Polling Period

The time in seconds after which the session client requests an update of cached session information from the server.

##### Miscellaneous

These properties do not fit smoothly in other categories.

##### Locale Language

The language code for identifying the locale of operation.

##### Locale Country

The country code for identifying the locale of operation.

##### Port Check Enable

When enabled, port check functionality is operative.

##### Port Check File

The name or complete path of a file that has the content necessary to handle requests requiring port correction.

##### Port Check Setting

A list of mappings from port numbers to protocols. The key is the listening port number while the value is the listening protocol to be used by the agent to identify requests with invalid port numbers.

##### Bypass Principal List

A list of principals bypassed by the agent for authentication and search purposes.

##### Legacy Support Enable

When enabled, legacy user agents (browsers) are supported.

##### Legacy User Agent

A list of user agent header values. Each value identifies a legacy browser.

##### Legacy Redirect URI

An intermediate URI used by the agent to redirect legacy user agent requests.

##### Encryption Provider

The encryption provider implementation to be used by the agent.

##### Advanced

These properties are either custom properties or properties that tend to be used in more-complex or less-common deployments.

##### Client IP Address Header

The `HTTP` header name that holds the IP address of the client.

##### Client Hostname Header

The `HTTP` header name that holds the host name of the client.

##### Web Service Enable

When enabled, web services are processed.

##### Web Service End Points

A list of web application end points. Each end point represents a web service.

##### Web Service Process GET Enable

When enabled, `HTTP GET` requests for web-service endpoints are processed.

##### Web Service Authenticator

An implementation class that can be used to authenticate web-service requests.

##### Web Service Internal Error Content File

The name of the file of which the agent uses the contents to generate an internal error fault for clients.

##### Web Service Authorization Error Content File

The name of the file of which the agent uses the contents to generate an authorization error fault for clients.

##### Alternative Agent Host Name

The host name identifying the agent-protected server to the client browsers, if the host name used is different than the actual host name.

##### Alternative Agent Port Name

The port number identifying the agent protected server listening port to the client browsers, if the port number used is different than the actual listening port.

##### Alternative Agent Protocol

The protocol being used (`HTTP`/`HTTPS`) by the client browsers to communicate with the agent protected server, if the protocol used is different than the actual protocol used by the server.

##### Custom Properties

Additional properties that allow users to augment the set of properties supported by the agent.

Example:

    customproperty=custom-value1
    customlist[0]=customlist-value-0
    customlist[1]=customlist-value-1
    custommap[key1]=custommap-value-1
    custommap[key2]=custommap-value-2