CA API Gateway 9.1

9.4 9.1

Install the Java System Access Manager Assertion

The Java System Access Manager assertion allows a policy to use the Single Sign-On (SSO) and Policy Service from an existing Oracle Java System Access Manager 7.0 or 7.1 deployment.
gateway92
The Java System Access Manager assertion allows a policy to use the Single Sign-On (SSO) and Policy Service from an existing Oracle Java System Access Manager 7.0 or 7.1 deployment.
This section describes how to install and configure the custom assertion on the Gateway. When configuration is complete, the Access Resource Protected by JSAM Assertion appears in the Policy Manager, under both the Access Control and Custom Assertions palettes.
Contents:
Requirements
  • Oracle Java System Access Manager 7 version 7.0 or 7.1
  • A Policy Agent profile defined under the realm.
  • The custom assertion RPM installation file:
    ssg-jsam-<version>.noarch.rpm
    This file is located in the "CA API Gateway CustomAssertions" distribution archive.
Configure the Gateway
Note:
 To install and configure the assertion in a cluster, repeat the following procedures for each Gateway in the cluster.
Two main steps are required to configure the Gateway for this custom assertion:
  • Install the custom assertion onto the Gateway server.
  • Modify two properties files with information configured in the Java System Access Manager Server.
Step 1: Install the Custom Assertion
Note:
 In the following steps, “<SSG_home>” is “/opt/SecureSpan/Gateway” by default.
To install the custom assertion:
  1. Log in as
    ssgconfig
     and open a privileged shell from the Gateway configuration menu.
  2. Stop the Gateway:
    # service ssg stop
  3. Navigate to the location of the custom assertion installation file.
  4. Run the following command to install the RPM:
    # rpm -Uvh ssg-jsam-
    <version>
    .noarch.rpm
    where
    "<version>"
     is the version number of the Gateway, plus an archive number.
Step 2: Edit the Properties Files
Perform the following configuration after the installing the custom assertion package:
  1. Open the following file in a text editor:
    <SSG_home>
    /node/default/etc/conf/sun-jsam-client.properties
  2. Review and update the properties.
    Property
    Description
    com.sun.identity.agents.app.username
    Name of the Policy Agent profile created on the Access Manager server.
    com.iplanet.am.service.password
    The plain text password of the Policy Agent profile.
    If an encrypted password is used instead, enter it in the “
    com.iplanet.am.service.secret
     property.
    com.iplanet.am.service.secret
    The encrypted password of the Policy Agent profile. If a plain text password is used instead, enter it in the
    com.iplanet.am.service.password
     property.
    am.encryption.pwd
    If an encrypted password is used, then this value must match
    AMConfig.properties
    .
    com.iplanet.am.naming.url
    This value must match
    AMConfig.properties
    .
    com.iplanet.am.notification.url
    This value must match
    AMConfig.properties.
    com.iplanet.am.server.protocol
    This value must match
    AMConfig.properties
    .
    com.iplanet.am.server.host
    The fully qualified host name of the Access Manager server. This value must match
    AMConfig.properties
    .
    com.iplanet.am.server.port
    This value must match
    AMConfig.properties
    .
    com.iplanet.services.debug.level
    Controls the Access Manager Client SDK internal logging. Enter the minimum severity level to be logged:
         off (logging disabled)
         error
         warning
         message
    com.iplanet.services.debug.directory
    The directory to store the Access Manager Client SDK internal log files.
  3. You can optionally verify that the following entries match those in the Java System Access Manager. They should match if the server uses the factory default values.:
    1. Open the following file in a text editor:
      <SSG_home>
      /node/default/etc/conf/sun-jsam-ca.properties
    2. Verify these properties:
      Property
      Default Value
      com.l7tech.custom.sun.jsam.PolicyServiceName
      iPlanetAMWebAgentService
      com.l7tech.custom.sun.jsam.SsoCookieName
      iPlanetDirectoryPro
      Note:
       The default values are automatically used if the file or the properties are missing.
  4. Restart the Gateway:
    # service ssg start

Content feedback and comments