A J2EE agent instance can be configured using this interface. The properties described only apply if during agent creation, centralized configuration was chosen. If local configuration was selected, the properties related to this agent must be edited in the OpenSSOAgentConfiguration.properites file in the agent installation directory.
The types of configuration available are divided into the following categories:
These properties apply to all applications protected by an agent.
If applicable, select a group from the drop down list to assign this agent to the group. This list consists of previously configured groups.
The password was set when you created the agent profile. However, you can change the password at any time in the future.
The confirmation of the password was performed when you created the agent profile. If you change the password, you must confirm the change.
The Active option is selected when the agent is created. Choose Inactive only if you want to remove the protection the agent provides.
The URL used by the agent to register notification listeners.
If desired, change the configuration location to whichever of the two options is available: centralized or local. The centralized location allows you to control the configuration in a centralized manner, such as from the Console.
The local option is provided for backward compatibility purposes. If the local configuration option is selected, the agent will use its local configuration in the OpenSSOAgentConfiguration.properites file in the agent installation directory. In addition, the Console will only display the following properties: Password, Password (confirmation), and Status.
The interval in seconds between configuration reloads. Setting this property to 0 disables the hot-swap mechanism.
When enabled, the agent receives notification messages from the OpenSSO server about configuration changes.
The mode of operation for the filter. For this properly, a global value can be set to apply to all the applications that don't have their own specific filter mode.
Enter a web application name for the Map Key and a value for the Corresponding Map Values. Valid values are ALL, J2EE_POLICY, URL_POLICY, SSO_ONLY, and NONE. To set ALL as the global filter mode: leave Map Key field empty, and enter ALL in Corresponding Map Value field.
The URL of the customized access denied page. If no value is provided, the agent returns an HTTP status of 403 (Forbidden).
When enabled, the HTTP session is invalidated when login fails. The user has no SSO session, or the principal user name does not match the SSO user name.
A string that represents the goto parameter name, which is used by the agent to redirect the user to the appropriate authentication service. The value of this parameter is used by the authentication service to redirect the user to the original requested destination.
The number of failed login attempts allowed during a single browser session until the user request is blocked. A value of 0 disables this feature.
A list of mappings of custom headers. The headers are set by the agent on the client browser. Enter a header name for the Map Key and the header value for the Corresponding Map Values.
The number of successive single point redirects allowed during a single browser session until the user request is blocked. A value of 0 disables this feature.
The type of debug messages logged. This setting determines the level of the debug log saved locally on the agent host.
The mechanism the agent uses to determine the user ID.
The name of the attribute that contains the user ID. The value for this property is not used if the property labeled User Mapping Mode is set to USER_ID.
When enabled, the principal of the authenticated user is used to authenticate the user instead of solely the user ID. The value for this property is used if the property labeled User Mapping Mode is set to USER_ID.
The session property name of the user ID of the authenticated user in session. The value for this property is used when the property labeled User Mapping Mode is set to USER_ID and the property labeled User Principal Flag is not enabled.
The types of messages the agent logs based on user URL access attempts.
The location to which audit messages are logged.
Name of the OpenSSO log file to which each URL access to OpenSSO is recorded.
When enabled, audit log files are rotated when they reach the size specified by the property labeled Local Audit Log Rotation Size.
The size at which the local audit log file is rotated to a new file.
When enabled, the FQDN default value and the FQDN map values are checked.
The fully qualified host name for users to use to access resources.
A mapping to an actual or valid host name. This mapping is from a host name that is not recognized to one that is recognized. This mapping is useful in the following situations: when an IP address or an incorrect URL is entered by the user or when a virtual host is used for protected resources.
Enter values for the Map Key and the Corresponding Map Values and click Add.
These properties tend to be application specific.
The list of absolute URIs corresponding to an application's web.xml form-login-page element.
The list of absolute URIs corresponding to an application's web.xml form-error-page element.
When enabled, agent uses the customized internal content as specified by the property labeled Login Content File Name. When not enabled, the agent uses the default internal content.
The complete path and name of the custom login content file.
Application-specific mappings, each of which identifies a handler to be used for logout processing.
Enter the logout handler for the Map Key field and the application logout handler class name in the Corresponding Map Values field. Click Add.
Application-specific mappings, each of which identifies a request URI. The presence of the specified request URI indicates a logout event.
Enter the logout URI for the Map Key field and the application logout URI in the Corresponding Map Values field. Click Add.
Application-specific mappings, each of which identifies a parameter. The presence of the specified parameter in the HTTP request indicates a logout event.
When enabled, the agent to searches the HTTP request body to locate the logout parameter.
Application specific mappings, each of which identifies a URI to be used as an entry point after successful logout and, if applicable, after subsequent successful authentication.
Enter the value for the Map Key field and the logout entry URI in the Corresponding Map Values field. Click Add.
A URI list for which no authentication is performed. For every URI on this list, protection is not enforced by the agent and credentials are not requested.
When enabled, the not enforced URI list becomes the enforced list. Therefore, all the URIs listed as values for the property labeled Not Enforced URIs are then enforced, while all other URIs are not enforced.
When enabled, the evaluation results are cached for not-enforced URIs. Therefore, evaluation results are cached for the list of values associated with the property labeled Not Enforced URIs.
When the property labeled Not Enforced URIs Cache Enabled is enabled, the value specified for this property is used to set the cache size.
Client IP address list, requests from which do not undergo authentication or authorization. For every IP address on this list, access is granted, credentials are not requested for authentication or authorization.
When enabled, the not-enforced client IP list becomes the enforced list. Therefore, all the IP addresses listed as values for the property labeled Not Enforced Client IP List are then enforced, while all other IP addresses are not enforced.
When enabled, the evaluation results are cached for not-enforced IP addresses. Therefore, evaluation results are cached for the list of values associated with the property labeled Not Enforced Client IP List.
When the property labeled Not Enforced IP Cache Flag is enabled, the value specified for this property is used to set the cache size.
The modes available to fetch additional user profile attributes to be introduced into a request.
A list of mappings from profile attribute names to HTTP header names. The HTTP header names are populated under specific names for the currently authenticated user.
The modes available to fetch additional user response attributes to be introduced into a request.
A list of mappings from response attribute names to HTTP header names. The HTTP header names are populated under specific names for the currently authenticated user.
The character to be used to separate multiple values of the same attribute when it is being set as a cookie.
The format of date attribute values to be used when the attribute is being set as an HTTP header. The format is based on java.text.SimpleDateFormat.
When enabled, the value of the attribute is URL encoded before being set as a cookie.
The modes available to fetch additional user session attributes to be introduced into a request.
A list of mappings from session attribute names to HTTP header names. The session attribute names are populated under specific names for the currently authenticated user.
A list of privileged attributes to authenticated users. These attributes are granted to all users who have a valid OpenSSO session.
A list of privileged attribute types to be fetched for each user.
A list of mappings from privileged attribute types to values of true or false: true to indicate that the attribute type is converted to lowercase or false if it is not converted.
A list of session property names that hold privileged attributes for the authenticated user.
When enabled, mappings are applied from an attribute's original value to an alternate value as specified by the property labeled Privileged Attribute Mapping.
A list of mappings from an attribute's original value to an alternate value. This property is effective only when the property labeled Enable Privileged Attribute Mapping is enabled.
A list of mappings from an application to the authentication handler specific to that application. Each authentication handler is used by the agent to authenticate the user within the container for the specified application.
A list of mappings from an application to the logout handler specific to that application. Each logout handler is used by the agent to log out the user within the container for the specified application.
A list of mappings from an application to the local verification handler specific to that application. Local verification handlers are used by the agent to validate the user credentials with the local repository.
These properties allow you to configure features of the agent related to single sign-on (SSO) and cross domain single sign-on (CDSSO).
The name of the SSO token cookie used between the OpenSSO server and the agent.
When enabled, the SSO cache is active for the agent and can be used through public APIs exposed by the agent SDK.
When enabled, cross domain single sign-on (CDSSO) is active.
An intermediate URI used by the agent to process CDSSO requests.
A list of URLs of the available CDSSO controllers. These URLs can be used by the agent for CDSSO processing.
The number of seconds to be used by the agent to determine the validity of the CDSSO AuthnResponse assertion.
A list ofOpenSSO Server/ID providers to be trusted by the agent when evaluating the CDC Liberty responses. Setting this property is necessary when a load balancer, firewall, or both are present between the agent and theOpenSSO instance.
When enabled and when the communications channel with the host is secure, the SSO token cookie set by the agent in the different domains in CDSSO mode are marked secure.
A list of domains for which cookies have to be set in a CDSSO scenario.
When enabled, the agent resets cookies in the response before redirecting to authentication.
A list of cookie names to be reset by the agent if the property labeled Cookie Reset is enabled.
A list of mappings from a cookie name specified by the property labeled Cookie Reset Name List to the domain of the cookie to be used when a reset event occurs (the value).
A list of mappings from a cookie name specified in the property labeled Cookie Reset Name List (the key) to the path of the cookie to be used when a reset event occurs (the value).
These properties configure the OpenSSO services that the agent uses, such as policy service, session service, authentication service, and service management (SM) service.
A list of URLs to OpenSSO authentication. When authentication is required, the agent redirects incoming users to the appropriate authentication service as specified by the URL.
When enabled, prioritizes the failover sequence for Login URLs or CDSSO URLs as defined by the property labeled OpenSSO Login URL.
When enabled, the agent checks the availability of the URLs defined by the property labeled OpenSSO Login URL before redirecting to them.
When the property labeled Login URL Probe is enabled, the value specified for this property determines the number of milliseconds for the connect timeout.
A list of OpenSSO logout page URLs.
When enabled, prioritizes the failover sequence for logout URLs as defined by the property labeled OpenSSO Login URL.
When enabled, the agent checks the availability of logout URLs, as defined by the property labeled OpenSSO Login URL, before redirecting to them.
When the property labeled Logout URL Probe is enabled, the value specified for this property determines the number of milliseconds for the connect timeout.
The protocol to be used by the OpenSSO authentication service.
The host name to be used by the OpenSSO authentication service.
The number of the port to be used by the OpenSSO authentication service.
When enabled, notifications are operative for the remote policy client.
The duration in minutes after which the cached entries are refreshed by the remote policy client.
The mode of caching to be used by the remote policy client. The valid values are as follows: subtree or self.
The boolean action values available for policy action names.
Example:
serviceName|actionName|trueValue|falseValue
The resource comparators to be used for different service names.
The number of seconds allowed to accommodate the time difference between the OpenSSO server machine and the remote policy client machine.
A list of HTTP GET request parameters whose names and values are to be set in the environment map for URL policy evaluation at OpenSSO server.
The map key is in the format of GET parameterName while the map value is a set of string values of the parameter.
A list of HTTP POST request parameters whose names and values are to be set in the environment map for URL policy evaluation at OpenSSO erver.
The map key is in the format of POST parameterName while the map value is a set of string values of the parameter.
A list of HTTP SESSION attributes whose names and values are to be set in the environment map for URL policy evaluation at OpenSSO server.
The map key is in the format of JSESSION parameterName while the map value is a set of string values of the parameter.
The cache update time in minutes for user management data. If set to 0, no updates occur.
When enabled, notifications are operative for service management caches.
Cache update time in minutes for service configuration data. If set to 0, no updates occur.
This property takes effect only if no notification URL is provided as a value for the property labeled Agent Notification URL or if notifications are disabled.
When enabled, the session client must use polling for updating session information and not depend upon server notifications.
The time in seconds after which the session client requests an update of cached session information from the server.
These properties do not fit smoothly in other categories.
The language code for identifying the locale of operation.
The country code for identifying the locale of operation.
When enabled, port check functionality is operative.
The name or complete path of a file that has the content necessary to handle requests requiring port correction.
A list of mappings from port numbers to protocols. The key is the listening port number while the value is the listening protocol to be used by the agent to identify requests with invalid port numbers.
A list of principals bypassed by the agent for authentication and search purposes.
When enabled, legacy user agents (browsers) are supported.
A list of user agent header values. Each value identifies a legacy browser.
An intermediate URI used by the agent to redirect legacy user agent requests.
The encryption provider implementation to be used by the agent.
These properties are either custom properties or properties that tend to be used in more-complex or less-common deployments.
The HTTP header name that holds the IP address of the client.
The HTTP header name that holds the host name of the client.
When enabled, web services are processed.
A list of web application end points. Each end point represents a web service.
When enabled, HTTP GET requests for web-service endpoints are processed.
An implementation class that can be used to authenticate web-service requests.
The name of the file of which the agent uses the contents to generate an internal error fault for clients.
The name of the file of which the agent uses the contents to generate an authorization error fault for clients.
The host name identifying the agent-protected server to the client browsers, if the host name used is different than the actual host name.
The port number identifying the agent protected server listening port to the client browsers, if the port number used is different than the actual listening port.
The protocol being used (HTTP/HTTPS) by the client browsers to communicate with the agent protected server, if the protocol used is different than the actual protocol used by the server.
Additional properties that allow users to augment the set of properties supported by the agent.
Example:
customproperty=custom-value1 customlist[0]=customlist-value-0 customlist[1]=customlist-value-1 custommap[key1]=custommap-value-1 custommap[key2]=custommap-value-2