Configuration Guide › SiteMinder Integration › How to Protect CA Identity Manager with SiteMinder › Install the Proxy Plugin › Install the Proxy Plug-In for WebSphere

Install the Proxy Plug-In for WebSphere

Once the Web Agent authenticates and authorizes a request for a CA Identity Manager resource, the Web Server on which you installed the Web Agent must forward the request to the application server that hosts the Identity Manager Server. This is accomplished through a Web Server proxy plug-in provided by the application server vendor.

After you install the CA Identity Manager components and deploy the IdentityMinder EAR, you update the plug-in using WebSphere’s GenPluginCfg command.

To install the proxy plug-in

1. Install the proxy plug-in from the WebSphere Launch Pad.
2. Add the Web Server to the WebSphere cell by running the configurewebserver1.bat command as follows:
   1. Edit websphere_home\Plugins\bin\configurewebserver1.bat/,sh in a text editor.
   2. Add a user name and password to after wsadmin.bat/.sh as follows:

      wsadmin.bat -user wsadmin -password password -f configureWebserverDefinition.jacl
      

   3. Run configurewebserver1.bat/.sh.

   Note: See the IBM WebSphere documentation for more information about the configurewebserver command.

3. From the command line, navigate to websphere_home\bin, where websphere_home is the installed location of WebSphere.

   For example:

   • Windows:

     C:\Program Files\WebSphere\AppServer\bin\

   • UNIX:

     /home_dir/WebSphere/AppServer/bin

4. Run the GenPluginCfg.bat or GenPluginCfg.sh command.

   Running this command generates a plugin-cfg.xml file in websphere_home\Plugins\config\webserver1\config\cells.

5. If the application server is on a separate system from the one with the Web server, copy the plugin-cfg.xml to the following directory on the system where you installed the proxy plug-in:

   websphere_home\AppServer\profiles\server_name\config\cells\websphere_cell\nodes\webserver1_node\servers\webserver1\

6. Restart the Web server to activate the plug-in as follows:
   • IIS Web Servers: In the master WWW service, ensure that the WebSphere plug-in (sePlugin) appears after the SiteMinder Web Agent plug-in and that the WebSphere plug-in started successfully.
   • iPlanet Web Servers: Ensure that the WebSphere plug-in (libns41_http.so) is loaded after the SiteMinder Web Agent plug-in (NSAPIWebAgent.so)

     For iPlanet 6.0 Web Servers, check the order of plug-ins in iplanet_home/https-instance/config/magnus.conf.

     For iPlanet 5.x Web Servers, copy the following lines from iplanet_home/https-instance/config/magnus.conf to iplanet_home/https-instance/config/obj.conf

     Init fn="load-modules" funcs="as_init,as_handler,as_term" shlib="/export/WebSphere/AppServer/bin/libns41_http.so"

     Init fn="as_init" bootstrap.properties="/export/WebSphere/AppServer/config/cells/plugin-cfg.xml"

     Add the following after AuthTrans fn="SiteMinderAgent" in the obj.conf file:

     Service fn="as_handler"

   • Apache Web Servers: In the Dynamic Shared Object (DSO) Support section of apache_home/config/httpd.conf, be sure that the SiteMinder Web Agent plug-in (mod2_sm.so) is loaded before the WebSphere plug-in (mod_ibm_app_server_http.so).