CA API Gateway 9.1

9.4 9.1

Start the Policy Manager

You can access the Policy Manager in the following two ways:
gateway92
You can access the Policy Manager in the following two ways:
  • Desktop client
    : The standard desktop client provides maximum functionality and best performance, but it requires the Policy Manager application to be installed on the client computer.
  • Browser client
    : The browser-based client provides the greatest flexibility—you can run the Policy Manager from virtually any computer with an Internet connection and a compatible Web browser with a Java Runtime Environment (JRE) installed. However, not all features are available.
CA API Gateway does not support applet client; the Policy Manager browser client is a Java Web Start application.
Contents:
2
2
Start the Policy Manager from the Desktop Client
To start the Policy Manager as a desktop client, perform the following steps:
  • Linux
    : Navigate to the directory where the Policy Manager is installed and then either run ./Manager.sh or double click the .sh icon.
  • Windows
    : Click
    Start
    , 
    All Programs,
     
    Policy Manager,
     
    Policy Manager
After the Policy Manager is started, you can connect to the
API Gateway
. 
Start the Policy Manager from the Browser Client
You can start the Policy Manager using Java Web Start application.
To disable the client access of the browser, use the
Enable web-based administration
 option in the Listen Port Properties ([
Endpoints
] tab) for the SSL endpoint.
Prerequisites:
  • Verify that the proper Java version is installed for running the Policy Manager from a browser. For more information, see Requirements and Compatibility. 
  • Verify that any JavaScript blockers are disabled in the browser.
  • Verify that the operator running the browser client has at least one assigned role in the Policy Manager.
  • Verify that the Policy Manager URL is added to the Java exceptions list. Add the Policy Manager web URL to the Java "Exception Site List" before the browser client can run. For more information, see: https://www.java.com/en/download/faq/exception_sitelist.xml
  • Verify that you perform the following steps for Internet Explorer:
    • Internet Explorer 11:
      If Java is installed and is not recognizable, then verify the Java version and update it.
    • Internet Explorer 8:
      If the latest Java version is installed and the browser still prompts to update Java, enable the "Scripting of Java applets" in
      Internet Options
      ,
      Security Settings
      .
Run the Policy Manager using Web Start Application, follow these steps:
Internet Explorer and Mozilla Firefox security settings require special handling to eliminate warning messages, if your SSL certificate is not signed by a certificate authority.
  1. To launch Policy Manager, enter the following URL in the address bar of the browser:
    https://
    <gatewayHostName>
    :8443/ssg/webstart/manager.jnlp
  2. Based on the type of browser perform the following steps:
    For Internet Explorer:
    • Ignore all the security warnings, select the required certificate, and proceed to the login page.
    For Mozilla Firefox:
    • Allow all the java plug-in popups.
    • Ignore all the security warnings and proceed to the login page.
  3. The Policy Manager is started.
  4. Connect to the CA API Gateway.
Connect to the Gateway
Whenever you start the Policy Manager, the Login dialog automatically appears. Use this dialog to connect to the Gateway by doing either of the following steps:
  • Connect to an existing Gateway or cluster by selecting its URL from the drop-down list on the Login dialog.
  • Connect to a new Gateway or cluster by typing its URL in the Login dialog.
You can also display the Login dialog from within the Policy Manager by doing either of the following steps:
  • Click
    Connect 
    on the Main Tool Bar (if currently connected, you must first Disconnect before connecting to a different Gateway)
  • Select
    File
    , Connect from the Main Menu.
Once the connection to the Gateway is established, the Policy Manager verifies your user permissions as defined by your role, and then enables the appropriate features within the system.
CA Technologies recommend using separate account for administrative access (that is, connecting to the Gateway) and for the message processing (that is, adding a user to a service policy). To simplify using separate user accounts, you may consider using different identity providers for administration/message traffic. For more information, see Identity Providers.
The following table describes the Login dialog options:
Option
Description
User Name/Password
This option specifies the login User Name and Password. Your account may be configured to remember your user name.
For security, the administrative user account will be locked for 20 minutes after five unsuccessful login attempts. No further login attempts may be made during the lockout period. The settings can be changed using the Manage Administrative User Account Policy dialog.
Client certificate
This option allows you to log in using a client certificate. Select the certificate from the Certificate drop-down list. To add or remove certificates from the list, click Manage and select a task.
Users with client certificates are required to use their certificates during login. The 'CN' value in the certificate must match the username.
Gateway
This option allows you to select the Gateway to connect to from the drop-down list. If the correct Gateway is not listed, type the URL in the Gateway field, in the format machinename.domain.com. The URL is saved to the list.
Install the license file after connecting to a new Gateway.
Connecting to a non-default port
To connect to a port other than the default 8443, you must append the SSL Endpoint port number to the Gateway name. For example, mygateway.domain.com:8445.
IPv6 Support
The Gateway field supports IPv6 literals for the Gateway host. The following formats are supported:
[2222::7]
[2222::7]:8443
The IPv6 literals must be enclosed within square brackets ("[ ]") to be interpreted correctly.
 To edit the list of client certificates:
To...
Do this...
Add a client certificate to the list
  1. Click
    Manage
     under the Client Certificate option. The Certificate Manager dialog appears.
  2. Click
    Import
     and then navigate to the PKCS#12 keyStore to load.
  3. Enter the
    Keystore Password
     when prompted. The details of the selected certificate are displayed.
  4. Verify that the details are correct and then click OK. The imported certificate is added to the list.
Remove a client certificate from the list
  1. Click
    Manage
     under the Client Certificate option. The Certificate Manager dialog appears.
  2. Select the certificate to be deleted from the
    Certificate Lis
    t. The details of the certificate are displayed.
  3. Click
    Delete
     and then click Yes to confirm. The certificate is removed from the
    Certificate List
    .
  4. Click [
    OK
    ] to close the Certificate Manager and return to the Login dialog.
Connecting Through a Proxy
If you want to connect the Gateway through a proxy server, make the following modifications. Follow these steps before using the connection instructions mentioned in the previous section.
The modifications that are shown here are required only for the desktop client.
To configure the Policy Manager to use a proxy (Windows):
  1. Locate the file
    CA API Gateway Policy Manager.ini
    and open it in a text editor. This file is located in the same directory as the
    CA API Gateway Policy Manager.exe
     file.
  2. Add the following string before the "-jar" section of the file. For example, if your .INI file ends with "-jar Manager.jar", then add the string before "-jar".
    -Dhttp.proxyHost=
    <Proxy_host>
     -Dhttp.proxyPort=
    <Proxy_port>
     -Dhttp.proxyUsername=
    <User_name>
     -Dhttp.proxyPassword=
    <User_password>
  3. Save and exit. The Policy Manager now uses the proxy when connecting to the Gateway.
To configure the Policy Manager to use a proxy (Linux):
  1. Locate the file
    Manager.ini
     and open it in a text editor. This file is located in the same directory as the
    Manager.exe
     and
    Manager.jar
     files.
  2. Add the following to the "extra" variable declaration.
    extra="
    ...
    -Dhttp.proxyHost=
    <Proxy_host>
    -Dhttp.proxyPort=
    <Proxy_port>
    -Dhttp.proxyUsername=
    <User_name>
    -Dhttp.proxyPassword=
    <User_password>
    "
  3. Save and exit and then run
    Manager.sh
    . The Policy Manager now uses the proxy host when connecting to the Gateway.
Troubleshooting
Adjust High DPI Scaling Settings for Policy Manager
These instructions address a display problem when running Policy Manager on Windows 10.
The Policy Manager may not display correctly on some high resolution monitors. If you experience display problems such as small fonts and illegible lines, try overriding the high DPI scaling behavior of the executable file.
To adjust the display settings for Windows 10:
  1. Navigate to the Policy Manager installation folder.
    For example: c:\Program Files (x86)\CA Technologies\CA API Gateway Policy Manager 
    version
    \
  2. Right-click the CA API Gateway Policy Manager.exe file and select Properties.
    The properties dialog opens with the General tab selected.
  3. Click the 
    Compatibility
     tab.
  4. Performing 
    one
     of the following tasks based on options corresponding to your Windows build and version: 
    • Select 
      Override high DPI scaling behavior
      , then select 
      System 
      from the menu. (Win 10 Build 16299/Version 1709) 
    • Click 
      Change high DPI settings
      , select 
      Override high DPI scaling behavior
      , then select 
      System 
      from the menu. (Win 10 Build 17763/Version 1809) 
  5. Restart Windows and reopen the Policy Manager.

Content feedback and comments