#
# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
#
# Copyright (c) 2006 Sun Microsystems Inc. All Rights Reserved
#
# The contents of this file are subject to the terms
# of the Common Development and Distribution License
# (the License). You may not use this file except in
# compliance with the License.
#
# You can obtain a copy of the License at
# https://opensso.dev.java.net/public/CDDLv1.0.html or
# opensso/legal/CDDLv1.0.txt
# See the License for the specific language governing
# permission and limitations under the License.
#
# When distributing Covered Code, include this CDDL
# Header Notice in each file and include the License file
# at opensso/legal/CDDLv1.0.txt.
# If applicable, add the following below the CDDL Header,
# with the fields enclosed by brackets [] replaced by
# your own identifying information:
# "Portions Copyrighted [year] [name of copyright owner]"
#
#

#------------------------------------------------------------------------------
# Web Agents Configuration Property File
#
# OpenSSO Policy Agent 
#
# Version: 3.0

#########################################################################
#
# The syntax of this file is that of a standard Java properties file,
# see the documentation for the java.util.Properties.load method for a
# complete description.  (CAVEAT: The SDK in the parser does not currently
# support any backslash escapes except for wrapping long lines.)
# All property names in this file are case-sensitive.
#
# NOTE: The value of a property that is specified multiple times is not
# defined.
#
# WARNING: The contents of this file are classified as an UNSTABLE
# interface by Sun Microsystems, Inc.  As such, they are subject to
# significant, incompatible changes in any future release of the
# software.
#
#########################################################################

#
# LOGIN URL
#   Specifies the login URLs to be used by the Agent to redirect
#   incoming users without sufficient credentials to the OpenSSO
#   authentication service.
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.login.url[0] = @AM_SERVICES_PROTO@://@AM_SERVICES_HOST@:@AM_SERVICES_PORT@@AM_SERVICES_DEPLOY_URI@/UI/Login

#
# SSO TOKEN COOKIE NAME
#   The name of the SSO Token cookie used between the OpenSSO server and
#   the Agent.
#   WARNING: Changing this property without making the corresponding change
#   to the OpenSSO server will disable the SDK.
# Hot-Swap Enabled: No
#
com.sun.identity.agents.config.cookie.name = iPlanetDirectoryPro

#
# SSO TOKEN COOKIE SECURITY
#   If this property is set to true the cookies set by the agent
#   will be marked secure and will only be transmitted if the
#   communications channel with the host is a secure one.
# Hot-Swap Enabled: No
#
com.sun.identity.agents.config.cookie.secure = false

#
# AGENT DEBUG LOG LEVEL
#   Set the level for the specified debug categories.
#   The format of the values is
#
#      <ModuleName>[:<Level>][,<ModuleName>[:<Level>]]*
#
#   The currently used module names are: AuthService, NamingService,
#   PolicyService, SessionService, PolicyEngine, ServiceEngine,
#   Notification, PolicyAgent, RemoteLog and all.
#
#   The all module can be used to set the debug level for all currently
#   none debug modules.  This will also establish the default level for
#   all subsequently created modules.
#
#   The meaning of the 'Level' value is described below:
#
#      0       Disable logging from specified module*
#      1       Log error messages
#      2       Log warning and error messages
#      3       Log info, warning, and error messages
#      4       Log debug, info, warning, and error messages
#      5       Like level 4, but with even more debugging messages
#
#   If level is omitted, then the logging module will be created with
#   the default debug level, which is the debug level associated with
#   the 'all' module.
#
#   Even if the level is set to zero, some messages may be produced for
#   a module if they are logged with the special level value of 'always'.
#
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.debug.level = 

#
# AGENT DEBUG LOG FILE PROPERTIES
#   - .debug.file.rotate: The value of the property specifies whether the agent's
#       debug file gets rotated or not based on debug.file.size value. 
#   - debug.file.size: the number of bytes after which the local debug log file 
#       will be rotated. Minimum value is 3000 bytes. Any value below that will be 
#       reset to 3000 bytes. Default value is 10MB.
#
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.debug.file.rotate = @LOG_ROTATION@
com.sun.identity.agents.config.debug.file.size = 10000000 

#
# AUDIT LOG PROPERTIES
#   - audit.accesstype: Specifies the access type which will be logged by the
#     Agent. Valid value is one of: LOG_NONE, LOG_ALLOW, LOG_DENY, LOG_BOTH.
#   - log.disposition: Specifies the audit log mode that the Agent will use
#     when writing audit log messages. Valid value is one of: LOCAL, REMOTE,
#     ALL.
#   - remote.logfile: Specifies the file name to be used on the remote server
#     if the log.disposition is set to REMOTE or ALL.
#   - remote.log.interval: Specifies the periodic interval time in minutes, 
#     thereby agent sends audit messages to server.
#   - local.log.rotate: A flag that indicates if the rotation of audit log
#     local file is enabled or disabled.
#   - local.log.size: The size in bytes of the local audit log file, beyond
#     which the Agent should rotate the log file.
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.audit.accesstype = LOG_NONE
com.sun.identity.agents.config.log.disposition = REMOTE
com.sun.identity.agents.config.remote.logfile = @AUDIT_LOG_FILENAME@
com.sun.identity.agents.config.remote.log.interval = 5
com.sun.identity.agents.config.local.log.rotate = false
com.sun.identity.agents.config.local.log.size = 52428800

#
# NOTIFICATION PROPERTIES
#   - notification.enable: Should the policy SDK use the OpenSSO server notification
#       mechanism to maintain the consistency of its internal cache?  If the value
#       is false, then a polling mechanism is used to maintain cache consistency.
#       Possible values are true or false.
#   - notification.url: URL to which notification messages should be sent if notification is
#       enabled, see previous property.
#
# Hot-Swap Enabled: No
#
com.sun.identity.agents.config.notification.enable = @NOTIFICATION_ENABLE@
com.sun.identity.client.notification.url = @AGENT_PREF_PROTO@://@AGENT_HOST@:@AGENT_PREF_PORT@/UpdateAgentCacheServlet?shortcircuit=false

#
# URL CASE SENSITIVITY CHECK 
#   This property determines whether URL string case sensitivity is
#   obeyed during policy and not enforced url evaluation.
#
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.url.comparison.case.ignore = true

#
# POLICY CACHE POLLING INTERVAL
#   This property determines the amount of time (in minutes) an entry
#   remains valid after it has been added to the cache. The default
#   value for this property is 3 minutes.
#
# Hot-Swap Enabled: No
#
com.sun.identity.agents.config.policy.cache.polling.interval = 3

#
# SSO TOKEN CACHE POLLING INTERVAL
#   This property determines the amount of time (in minutes) an sso entry
#   remains valid after it has been added to the cache. The default
#   value for this property is 3 minutes.
#
# Hot-Swap Enabled: No
#
com.sun.identity.agents.config.sso.cache.polling.interval = 3

#
# USER ID PROPERTIES
#   - userid.param: This property allows the user to configure the User Id parameter passed
#       by the session information from the access manager. The value of User
#       Id will be used by the agent to set the value of REMOTE_USER server
#       variable. By default this parameter is set to "UserToken".
#   - userid.param.type: Indicates from where the value of UserToken needs to be
#       fetched. Possible values are SESSION and LDAP.
#
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.userid.param = UserToken
com.sun.identity.agents.config.userid.param.type = SESSION

#
# PROFILE ATTRIBUTES FETCH MODE 
#   String attribute mode to specify if additional user profile attributes should
#   be introduced into the request. Possible values are:
#   NONE - no additional user profile attributes will be introduced.
#   HTTP_HEADER - additional user profile attributes will be introduced into 
#               HTTP header.
#   HTTP_COOKIE - additional user profile attributes will be introduced through 
#               cookies.
#   If not within these values, it will be considered as NONE.
#
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.profile.attribute.fetch.mode = NONE

#
# PROFILE ATTRIBUTES MAP
#   The user profile attributes to be added to the HTTP header.  The 
#   specification is of the below format 
#
#   com.sun.identity.agents.config.profile.attribute.mapping[ldap_attribute_name] 
#                                                              = http_header_name
#
#   where "ldap_attribute_name" is the attribute in data store to be fetched 
#   and "http_header_name" is the name of the header to which the value needs 
#   to be assigned.
#
#   Example:
#    com.sun.identity.agents.config.profile.attribute.mapping[cn] = common-name
#
# NOTE: In most cases, in a destination application where a "http_header_name" 
#       shows up as a request header, it will be prefixed by HTTP_, and all
#       lower case letters will become upper case, and any - will become _;
#       For example, "common-name" would become "HTTP_COMMON_NAME"
#
#  Other Examples:
#    com.sun.identity.agents.config.profile.attribute.mapping[ou] = 
#                                                             organizational-unit
#    com.sun.identity.agents.config.profile.attribute.mapping[o] = organization
#    com.sun.identity.agents.config.profile.attribute.mapping[mail] = email
#    com.sun.identity.agents.config.profile.attribute.mapping[employeenumber] = 
#                                                             employee-number
#    com.sun.identity.agents.config.profile.attribute.mapping[c] = country
#
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.profile.attribute.mapping[] = 
 
#
# SESSION ATTRIBUTES MODE 
#   String attribute mode to specify if additional user session attributes should
#   be introduced into the request. Possible values are:
#   NONE - no additional user session attributes will be introduced.
#   HTTP_HEADER - additional user session attributes will be introduced into 
#                 HTTP header.
#   HTTP_COOKIE - additional user session attributes will be introduced through 
#                 cookies.
#   If not within these values, it will be considered as NONE.
#
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.session.attribute.fetch.mode = NONE

#
# SESSION ATTRIBUTES MAP
#   The session attributes to be added to the HTTP header.  The specification is
#   of the below format
#
#   com.sun.identity.agents.config.session.attribute.mapping[session_attrib_name] 
#                                                              = http_header_name
#
#   session_attrib_name is the attribute in session to be fetched and 
#   http_header_name is the name of the header to which the value needs to be 
#   assigned.
#
#   Example:
#    com.sun.identity.agents.config.session.attribute.mapping[successURL] = 
#                                                             success-url
#
#   NOTE: In most cases, in a destination application where a "http_header_name" 
#       shows up as a request header, it will be prefixed by HTTP_, and all
#       lower case letters will become upper case, and any - will become _;
#       For example, "success-url" would become "HTTP_SUCCESS_URL"
#
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.session.attribute.mapping[] =
 
#
# RESPONSE ATTRIBUTES FETCH MODE 
#   String attribute mode to specify if additional user response attributes should
#   be introduced into the request. Possible values are:
#   NONE - no additional user response attributes will be introduced.
#   HTTP_HEADER - additional user response attributes will be introduced into 
#               HTTP header.
#   HTTP_COOKIE - additional user response attributes will be introduced through 
#               cookies.
#   If not within these values, it will be considered as NONE.
#
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.response.attribute.fetch.mode = NONE

#
# RESPONSE ATTRIBUTES MAP
#   The response attributes to be added to the HTTP header.  The specification is
#   of the format 
#
#   com.sun.identity.agents.config.response.attribute.mapping[resp_attrib_name] 
#                                                              = http_header_name
#   resp_attrib_name is the attribute in policy response to be fetched and 
#   http_header_name is the name of the header to which the value needs to be 
#   assigned.
#
#   Example:
#    com.sun.identity.agents.config.session.attribute.mapping[attr1] = 
#                                                             response-attr-one
#
#   NOTE: In most cases, in a destination application where a "http_header_name" 
#       shows up as a request header, it will be prefixed by HTTP_, and all
#       lower case letters will become upper case, and any - will become _;
#       For example, "response-attr-one" would become "HTTP_RESPONSE_ATTR_ONE"
#
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.response.attribute.mapping[] =

#
# ATTRIBUTES MULTI VALUE SEPARATOR
#   The separator used for mulitple values of attributes. 
#   Applies to profile, session and response attributes. 
com.sun.identity.agents.config.attribute.multi.value.separator = |

#
# LOAD BALENCER ENABLE
#   Indicate where a load balancer is used for OpenSSO 
#   services. Valid values: true | false
#
# Hot-Swap Enabled: No
#
com.sun.identity.agents.config.load.balancer.enable = false

#
# AGENT DEPLOYMENT URI PREFIX 
#
# Hot-Swap Enabled: No
#
com.sun.identity.agents.config.agenturi.prefix = @AGENT_PREF_PROTO@://@AGENT_HOST@:@AGENT_PREF_PORT@/amagent

#
# LOCALE
#
# Hot-Swap Enabled: No
#
com.sun.identity.agents.config.locale = en_US

#
# SSO ONLY 
#   Boolean attribute to indicate whether the agent will just enforce user
#   authentication (SSO) without enforcing policies (authorization)
#
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.sso.only = false

#
# ACCESS DENIED URL
#   The URL of the access denied page.  If no value is specified, then
#   the agent will return an HTTP status of 403 (Forbidden).
#
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.access.denied.url =

#
# FQDN CHECK ENABLE
#   This property indicates if FQDN checking is enabled or not.
#
# Hot-Swap Enabled: Yes
#
#
com.sun.identity.agents.config.fqdn.check.enable = true

#
# FQDN DEFAULT VALUE
#   Default FQDN is the fully qualified hostname that the users should use
#   in order to access resources on this web server instance. This is a
#   required configuration value without which the Web server may not
#   startup correctly.
#
#   The primary purpose of specifying this property is to ensure that if
#   the users try to access protected resources on this web server
#   instance without specifying the FQDN in the browser URL, the Agent
#   can take corrective action and redirect the user to the URL that
#   contains the correct FQDN.
#
#   This property is set during the agent installation and need not be
#   modified unless absolutely necessary to accommodate deployment 
#   requirements. 
#
# WARNING: Invalid value for this property can result in the Web Server
# becoming unusable or the resources becoming inaccessible.
#
# See also: com.sun.identity.agents.config.fqdn.check.enable,
#           com.sun.identity.agents.config.fqdn.map[]
#
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.fqdn.default = @AGENT_HOST@

#
# FQDN MAP
#   The FQDN Map is a simple map that enables the Agent to take corrective
#   action in the case where the users may have typed in an incorrect URL
#   such as by specifying partial hostname or using an IP address to
#   access protected resources.  It redirects the browser to the URL
#   with fully qualified domain name so that cookies related to the domain
#   are received by the agents.
#
#   The format for this property is:
#
#   com.sun.identity.agents.config.fqdn.mapping[invalid_hostname] = valid_hostname
#
#   This property can also be used so that the agents use the name specified
#   in this map instead of the web server's actual name. This can be
#   accomplished by doing the following.
#   Say you want your server to be addressed as xyz.hostname.com whereas the
#   actual name of the server is abc.hostname.com.  The browsers only knows
#   xyz.hostname.com and you have specified polices using xyz.hostname.com at
#   the OpenSSO server policy console, in this file set the mapping as
#
#   com.sun.identity.agents.config.fqdn.mapping[valid1]= xyz.hostname.com
#
#   Another example is if you have multiple virtual servers say rst.hostname.com,
#   uvw.hostname.com and xyz.hostname.com pointing to the same actual server
#   abc.hostname.com and each of the virtual servers have their own policies 
#   defined, then the fqdnMap should be defined as follows:
#
#   com.sun.identity.agents.config.fqdn.mapping[valid1] = rst.hostname.com
#   com.sun.identity.agents.config.fqdn.mapping[valid2] = uvw.hostname.com
#   com.sun.identity.agents.config.fqdn.mapping[valid3] = xyz.hostname.com
#
#   Another example including all the above:
#
#   com.sun.identity.agents.config.fqdn.mapping[invalid_hostname] = valid_hostname
#   com.sun.identity.agents.config.fqdn.mapping[valid1] = rst.hostname.com
#   com.sun.identity.agents.config.fqdn.mapping[valid2] = uvw.hostname.com
#   com.sun.identity.agents.config.fqdn.mapping[valid3] = xyz.hostname.com
#
#   WARNING: Invalid value for this property can result in the Web Server
#   becoming unusable or the resources becoming inaccessible.
#
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.fqdn.mapping[] = 

#
# COOKIE RESET ENABLE
#   This property must be set to true, if this agent needs to
#   reset cookies in the response before redirecting to OpenSSO server for 
#   Authentication. By default this is set to false.
#
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.cookie.reset.enable = false

#
# COOKIE RESET LIST
#   This property gives the list of Cookies, that need to be  included 
#   in the Redirect Response to OpenSSO server.
#   This property is used only if the  Cookie Reset feature is enabled. 
#
#   The  Cookie details need to be  specified in the following Format 
#   [0] = name[=value][;Domain=value]
#   [1] = name1[=value1][;Domain1=value]
#
#   If "Domain" is not specified, then the default agent domain is
#   used to set the Cookie. 
#
#   Example : 
#     com.sun.identity.agents.config.cookie.reset[0] = LtpaToken
#     com.sun.identity.agents.config.cookie.reset[1] = token=value;Domain=subdomain.domain.com
#
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.cookie.reset[0] = 


#
# ANONYMOUS USER PROPERTIES
#   - anonymous.user.enable: Enable/Disable REMOTE_USER processing for 
#       anonymous users 
#   - anonymous.user.id: This property is deprecated. User id returned if 
#                        accessing global allow page and not authenticated
#
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.anonymous.user.enable = false
com.sun.identity.agents.config.anonymous.user.id = anonymous

#
# NOT ENFORCED URL PROPERTIES
#   - notenforced.url: The list of URLs for which no authentication is 
#       required. Wildcards can be used to define a pattern of URLs. 
#       The URLs specified may not contain any query parameters.
#   - notenforced.url.invert: Indicate whether the above list is a not 
#       enforced list or an enforced list; When the value is true, the list 
#       means enforced list, or in other words, the whole web site is 
#       open/accessible without authentication except for those URLs in the list.
#   - notenforced.url.attributes.enable: Indicates whether profile attributes need
#       to be fetched for not enforced urls also. This involve policy evaluation to
#       fetch attributes.
#   - notenforced.ip: Not enforced client IP address list is a list of 
#       client IP addresses. No authentication and authorization are required 
#       for the requests coming from these client IP addresses. 
#   Examples:
#     com.sun.identity.agents.config.notenforced.url[0] = http://agent.host.com:8080/test.html
#     com.sun.identity.agents.config.notenforced.url[1] = http://agent.host.com:8080/images/*
#   
#     com.sun.identity.agents.config.notenforced.ip[0] = 192.168.12.2 
#     com.sun.identity.agents.config.notenforced.ip[1] = 1.1.1.1
#
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.notenforced.url[0] = 
com.sun.identity.agents.config.notenforced.url.invert = false
com.sun.identity.agents.config.notenforced.url.attributes.enable = false
com.sun.identity.agents.config.notenforced.ip[0] =

#
# POST DATA PRESERVATION
#   - postdata.preserve.enable: Enables POST data preservation.
#   - postcache.entry.lifetime: POST data cache entry lifetime in minutes,
#       After the specified interval, the entry will be dropped
#   NOTE: This property is applicable for SJS Web Server agent only.
#
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.postdata.preserve.enable = false
com.sun.identity.agents.config.postcache.entry.lifetime = 10

#
# CLIENT IP VALIDATION
#   Enable/Disable client IP address validation. This validate
#   will check if the subsequent browser requests come from the
#   same ip address that the SSO token is initially issued against
#
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.client.ip.validation.enable = false

#
# COOKIE ATTRIBUTES
#   - profile.attribute.cookie.prefix: Customized cookie prefix value.
#   - profile.attribute.cookie.maxage: Customized cookie max-age value.
#
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.profile.attribute.cookie.prefix = HTTP_
com.sun.identity.agents.config.profile.attribute.cookie.maxage = 300

#
# CDSSO PROPERTIES
#   - cdsso.enable: Enables Cross-Domain Single Sign.
#   - cdcservlet.url: List of URLs used by agent to redirect to the user 
#       for authentication in a CDSSO Scenario.
#   - cookie.domain:  This property gives the list of domains in
#       which cookies have to be set in a CDSSO scenario. This property
#       is used only if CDSSO is enabled.  If this property is left blank 
#       then the fully qualified cookie domain for the agent server will 
#       be used for setting the cookie domain. In such case it is a host 
#       cookie instead of a domain cookie.
#   Example : 
#     com.sun.identity.agents.config.cdsso.cookie.domain[0]=.sun.com 
#     com.sun.identity.agents.config.cdsso.cookie.domain[1]=.iplanet.com 
#
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.cdsso.enable = false
com.sun.identity.agents.config.cdsso.cdcservlet.url[0] = @AM_SERVICES_PROTO@://@AM_SERVICES_HOST@:@AM_SERVICES_PORT@@AM_SERVICES_DEPLOY_URI@/cdcservlet
com.sun.identity.agents.config.cdsso.cookie.domain[0] = 

#
# LOGOUT PROCESSING
#   - logout.url: List of OpenSSO logout page URLs.
#   - agent.logout.url: List of Applications's Logout URLs.
#       These URLs are not enforced by policy. 
#       if set, agent will intercept this URL and destroy the user's session,
#       if any. And then it will be redirected to the OpenSSO logout URL.
#       The application's logout URL will be allowed whether or not 
#       the session destroy is successful.
#   - logout.cookie.reset: List of cookies to be reset upon logout;
#       in the same format as cookie reset list.
#   - logout.redirect.url: User gets redirected to this URL after logout.
#
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.logout.url[0] = @AM_SERVICES_PROTO@://@AM_SERVICES_HOST@:@AM_SERVICES_PORT@@AM_SERVICES_DEPLOY_URI@/UI/Logout
com.sun.identity.agents.config.agent.logout.url[0] = 
com.sun.identity.agents.config.logout.cookie.reset[0] = 
com.sun.identity.agents.config.logout.redirect.url = 

#
# FETCH POLICY DECISIONS FROM ROOT RESOURCE
#   By default, when a policy decision for a resource is needed, 
#   agent gets and caches the policy decision of the resource and 
#   all resource from the root of the resource down, from the OpenSSO server.
#   For example, if the resource is http://host/a/b/c, the the root of the 
#   resource is http://host/. This is because more resources from the 
#   same path are likely to be accessed subsequently. 
#   However this may take a long time the first time if there 
#   are many many policies defined under the root resource.
#   To have agent get and cache the policy decision for the resource only,
#   set the following property to false.
#
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.fetch.from.root.resource = true

#
# FETCH CLIENT HOST NAME
#   Whether to get the client's hostname through DNS reverse lookup for use 
#   in policy evaluation.
#
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.get.client.host.name = false

#
# ENABLE NATIVE ENCODING
#   The following property is to enable native encoding of 
#   ldap header attributes forwarded by agents. If set to true 
#   agent will encode the ldap header value in the default 
#   encoding of OS locale. If set to false ldap header values 
#   will be encoded in UTF-8
#
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.convert.mbyte.enable = false

#
# ENCODE URL SPECIAL CHARACTERS
#   The following property is used whether to do encoding of the url 
#   which has special characters before doing policy evaluation. 
#
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.encode.url.special.chars.enable = false

#
# IGNORE URL PATH
#   When the not enforced list or policy has a wildcard '*' character, agent 
#   strips the path info from the request URI and uses the resulting request 
#   URI to check against the not enforced list or policy instead of the entire 
#   request URI, in order to prevent someone from getting access to any URI by 
#   simply appending the matching pattern in the policy or not enforced list. 
#   For example, if the not enforced list has the value http://host/*.gif,
#   stripping the path info from the request URI will prevent someone from 
#   getting access to http://host/index.html by using the URL http://host/index.html?hack.gif.
#   However when a web server (for exmample apache) is configured to be a reverse
#   proxy server for a J2EE application server, path info is interpreted in a different 
#   manner since it maps to a resource on the proxy instead of the app server.  
#   This prevents the not enforced list or policy from being applied to part of 
#   the URI below the app serverpath if there is a wildcard character. For example, 
#   if the not enforced list has value  http://host/webapp/servcontext/* and the 
#   request URL is http://host/webapp/servcontext/example.jsp the path info 
#   is /servcontext/example.jsp and the resulting request URL with path info stripped
#   is http://host/webapp, which will not match the not enforced list. By setting the 
#   following property to true, the path info will not be stripped from the request URL 
#   even if there is a wild character in the not enforced list or policy. 
#   Be aware though that if this is set to true there should be nothing following the
#   wildcard character '*' in the not enforced list or policy, or the 
#   security loophole described above may occur.
#
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.ignore.path.info = false

#
# OVERRIDE PROPERTIES
#   Override the request url given by the web server with 
#   the protocol, host or port of the agent's uri specified in 
#   the com.sun.identity.agents.config.policy.agents.agenturi.prefix property.
#   These may be needed if the agent is sitting behind a ssl off-loader, 
#   load balancer, or proxy, and either the protocol (HTTP scheme), 
#   hostname, or port of the machine in front of agent which users go through  
#   is different from the agent's protocol, host or port.
# 
#   Override the notification url in the same way as other request urls. 
#   Set this to true if any one of the override properties above is true, 
#   and if the notification url is coming through the proxy or load balancer 
#   in the same way as other request url's. 
#
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.override.protocol =
com.sun.identity.agents.config.override.host =
com.sun.identity.agents.config.override.port =
com.sun.identity.agents.config.override.notification.url =

# 
# The following property defines how long to wait in attempting
# to connect to an OpenSSO AUTH server.
# The default value is 2 seconds. This value needs to be increased
# when receiving the error "unable to find active OpenSSO Auth server"
#
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.auth.connection.timeout =

#
# IGNORE SERVER ALIVE CHECK
#   This property indicates whether Agent needs to check whether OpenSSO 
#   server is up and running before doing a 302 redirect
#
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.ignore.server.check = false

#
# POLL PRIMARY OpenSSO SERVER
#   This property determines the amount of time (in minutes) after which
#   the agent polls whether the primary server is up and running.
#   The default value is 5 minutes
#
# Hot-Swap Enabled: No
#
com.sun.identity.agents.config.poll.primary.server = 5

#
# IGNORE PREFERRED NAMING URL
#   This property indicates whether the naming request will have a preferred
#   naming url as an attribute
#   A value of true indicates that the naming request will not have the 
#   preferred naming url as attribute and a value of false indicates
#   that naming request will have the preferred naming url as an attribute
#
# Hot-Swap Enabled: No
#
com.sun.identity.agents.config.ignore.preferred.naming.url = true

#
# AGENT CONFIGURATION POLLING INTERVAL
#   Agent fetches new configuration either from server or local file(i.e. this file)
#   based on agent repository type value: centralized/local.
#   If agent is configured with AM 7.x, then agent uses local file(i.e. this file)
#   The value is in minutes.
#
# Hot-Swap Enabled: No
#
com.sun.identity.agents.config.polling.interval = 60

#
# AGENT CONFIGURATION CACHE CLEAN INTERVAL
#   Agent maintains a cache for it's configuration entries as part of
#   hot-swapping framework. Based on this value, agent cleans old
#   configuration entries, provided they are not referenced by any requests. 
#   The value is in minutes.
#
# Hot-Swap Enabled: No
com.sun.identity.agents.config.cleanup.interval = 30

#
# IIS specific property
#   Authentication Type
#
com.sun.identity.agents.config.iis.auth.type = dsame 

#
# IIS specific property
#    DES key for decrypting the basic authentication 
#      password in the session.
#
com.sun.identity.agents.config.replaypasswd.key = 

#
# IIS specific property
#   Set the IIS filter priority. The choices are
#      HIGH      - IIS5 filter priority is HIGH.
#      LOW       - IIS5 filter priority is LOW.
#      MEDIUM    - IIS5 filter priority is MEDIUM.
#      DEFAULT   - IIS5 filter priority is DEFAULT.
#
com.sun.identity.agents.config.iis.filter.priority = HIGH


#
# IIS-OWA specific properties
#   - owa.enable: Set to true if the IIS agent filter is configured for OWA.
#   - owa.enable.change.protocol: f true, avoids IE6 security pop-ups. 
#   - enable.session.timeout.url: The local idle session timeout page url.
#
com.sun.identity.agents.config.iis.owa.enable = false
com.sun.identity.agents.config.iis.owa.enable.change.protocol = false
com.sun.identity.agents.config.iis.owa.enable.session.timeout.url = 

#
# Sun Java System Proxy Server specific properties
#
com.sun.identity.agents.config.proxy.override.host.port = false

#
# IBM Lotus Domino Server specific properties
#   - check.name.database: If true, agent checks user existence 
#       in Domino name database.
#   - ltpa.enable: Set to true if agent needs to use LTPA Token.
#   - ltpa.cookie.name: The name of the cookie that contains 
#       the LTPA token.
#   - ltpa.config.name: The configuration name that the agent uses 
#       in order to employ the LTPA token mechanism. 
#   - ltpa.org.name: The organization name to which the LTPA token belongs.
#
com.sun.identity.agents.config.domino.check.name.database = false
com.sun.identity.agents.config.domino.ltpa.enable = false
com.sun.identity.agents.config.domino.ltpa.cookie.name = LtpaToken
com.sun.identity.agents.config.domino.ltpa.config.name = LtpaToken
com.sun.identity.agents.config.domino.ltpa.org.name = 

#
# Time in seconds used adjust time difference between Agent machine and
# OpenSSO server. In the absence of this property and where Agent time differs+
# from OpenSSO server time you would see agent making policy calls to
# OpenSSO server even before the policy subject cache has expired
# (subject timeToLive) or infinite re-direction happening.
# User still needs to run a time syncing service to keep the time on
# Agent machine and OpenSSO server machine as close as possible.
#
# Use this property to adjust for the small time difference in spite of
# running time syncing service
# Clock skew in seconds = AgentTime - OpenSSOServerTime
com.sun.identity.agents.config.policy.clock.skew = 0


#
# GOTO PARAMETER NAME
#   Used when CDSSO is enabled.Default value should be changed only when the
#   cdcservlet URL has a landing page specified
#   Example : com.sun.identity.agents.config.cdsso.cdcservlet.url[0] = #
#   http://host:port/opensso/cdcservlet?goto=http://agent:port/landing.jsp
#   The parameter is used by the Agent to append the original request URL to this
#   cdcservlet URL. This parameter is consumed by the landing page to redirect to the
#   original URL. (property name: com.sun.identity.agents.config.redirect.param)
#   If com.sun.identity.agents.config.redirect.param = goto2
#   The complete URL sent for authentication will be
#   http://host:port/opensso/cdcservlet?goto=http://agent:port/landing.jsp?goto2=http://agent.port/original.jsp
#
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.redirect.param = goto
