Previous Topic: CA SSO Agent for SAP Deployment ExamplesNext Topic: Configuration for SSO Mode with CA SSO


Installing and Configuring CA SSO Agent for SAP

This section contains the following topics:

Gather Information for the Installation Wizard

Run the Installation Wizard on Windows

Run the Installation Wizard on UNIX

Gather Information for the Configuration Wizard

Run the Configuration Wizard

Gather Information for the Installation Wizard

The installation wizard requires the following information:

Install Folder

Specifies the directory where the product files are installed.

Default:

Windows:

C:\Program Files\CA\webasagent

UNIX

<home-dir>/CA/webasagent
SAP Web Application Server Path

Specifies the SAP Web Application Server instance root directory.

Default:

Windows:

drive:\usr\sap\<SID>\<instance_name>

UNIX

/usr/sap/<SID>/<instance_name>

Run the Installation Wizard on Windows

The installation wizard installs the product on your web application server.

Follow these steps:

  1. Double-click the following file:
    ca-erp-webas-<version>-<operating_environmentprocessor_type>.exe
    

    Note: To install using console, open a console window and then run the previous command with the -i console option.

    Note: To install unattended, open a console window and then run the previous command with the “-i silent –f <installer_properties_file>” options. The installer properties file (ca-sapwebas-installer.properties) is located in the install_config_info directory of the product.

    Important! To install unattended, you must install the product using wizard or console once. The installer properties file is required for unattended installation. Before you perform the unattended installation, verify that the installer properties file is updated based on the host where you install the product.

  2. Follow the prompts in the wizard.
  3. (Optional) Run the configuration wizard when the installation wizard finishes.

More information:

Gather Information for the Configuration Wizard

Run the Installation Wizard on UNIX

The installation wizard installs the product on your web application server.

Follow these steps:

  1. Execute the following file:
    ca-erp-webas-<version>-<operating_environmentprocessor_type>.bin
    

    Note: To install using console, open a console window and then run the previous command with the -i console option.

    Note: To install unattended, open a console window and then run the previous command with the “-i silent –f <installer_properties_file>” options. The installer properties file (ca-sapwebas-installer.properties) is located in the install_config_info directory of the product.

    Important! To install unattended, you must install the product using wizard or console once. The installer properties file is required for unattended installation. Before you perform the unattended installation, verify that the installer properties file is updated based on the host where you install the product.

  2. Follow the prompts in the wizard.

Gather Information for the Configuration Wizard

Before you run the configuration wizard, gather the following information:

Gather Information to Configure Your Authentication Mode

Depending on the authentication mode you want to use, the configuration wizard requires different information. If you are configuring both modes, select both the following check boxes in the configuration wizard:

Agent Mode

Specifies any of the following authentication modes:

SSO Mode

Authenticates the user to the SAP Web AS server using the Policy Server and Web Agent.

Federation Mode

Authenticates the user to the SAP Web AS using CA Federation.

Gather Information to Configure Your SSO Mode

To configure this product for SSO mode, the configuration wizard requires the following information:

To establish a connection between this product host and the Policy Server, register the host with the Policy Server. After registration is complete, the registration tool creates the SmHost.conf file. After this file is created successfully, the client computer becomes a trusted host.

Admin User Name

Specifies the name of a Policy Server administrator that registers the host with the Policy Server. The administrator must be defined already with the Policy Server and must have the permission to register Trusted Hosts.

Admin Password

Specifies the Policy Server administrator account password.

Enable Shared Secret Rollover

Specifies that the Policy Server generates a new shared secret periodically, which is used to encrypt the communication to this product.

Trusted Host Name

Specifies a unique name that represents the trusted host to the Policy Server. This name need not be the same as the physical client system that you register.

Host Configuration Object

Specifies the name of the Host Configuration Object (HCO) in the Policy Server that defines the connection between the trusted host and the Policy Server. The HCO must be defined already in the Policy Server.

Policy Server IP Address

Specifies the IP address or the host name and the authentication port of the Policy Server where you are registering the host.

Default Port: 44442

FIPS Encryption Mode

Determines whether the agent communicates with the Policy Server using the certified Federal Information Processing Standard (FIPS) 140-2 compliant cryptographic libraries.

FIPS Compatibility Mode (Default)

Specifies non-FIPS mode, which lets the Policy Server and the agents read and write information using the existing CA SSO encryption algorithms. If your organization does not require the use of FIPS-compliant algorithms, the Policy Server and the agents can operate in non-FIPS mode without further configuration.

FIPS Only Mode

Specifies full-FIPS mode, which requires that the Policy Server and agents read and write information using only FIPS 140-2 algorithms.

Important! A CA SSO installation that is running in Full FIPS mode cannot interoperate with, or be backward compatible to, earlier versions of CA SSO, including all agents, custom software using older versions of the Agent API, and custom software using PM APIs or any other API that the Policy Server exposes. You must re-link all such software with the corresponding versions of the respective SDKs to achieve the required support for Full FIPS mode.

Configuration File Location

Specifies the location and name of the file that contains the configuration settings.

Windows:

C:\Program Files\CA\webasagent\sapwebas\conf

UNIX:

<home-dir>/webasagent/sapwebas/conf
Agent Mode
SSO Mode

Authenticates the user to the SAP Web AS server using the Policy Server and Web Agent.

Agent Name

Specifies the name of the Agent Object that protects the resource on the Policy Server.

Default: webasagent

Resource URI

Specifies the URI of the protected resource that is defined on your Policy Server.

This value is used as a tier 2 validation realm by this product. This URI must match the protected resource used in the policies.

Default: /smwebasagent/

Error URL

Specifies an absolute URL where this product redirects users when it cannot authenticate them. If you do not specify a value for the Error URL and authentication fails, an error message is displayed in the browser.

Example: http://server.example.com/error.html

Gather Information to Configure Your Federation Mode

To configure the product in Federation mode, the configuration wizard requires the following information:

Configuration File Location

Specifies the location and name of the file that contains the configuration settings.

Windows:

C:\Program Files\CA\webasagent\sapwebas\conf

UNIX:

<home-dir>/webasagent/sapwebas/conf
Agent Mode
Federation Mode

Authenticates the user to the SAP Web AS using CA Federation.

Federation Password

Specifies the password defined in CA Federation that is used to encrypt data that is sent from CA Federation to this product.

FedConnector Zone

Specifies the Federation security zone in which CA Federation is running.

Default: FED

Error URL

Specifies an absolute URL where this product redirects users when it cannot authenticate them. If you do not specify a value for the Error URL and authentication fails, an error message is displayed in the browser.

Example: http://server.example.com/error.html

Run the Configuration Wizard

Use the configuration wizard to configure the product.

Follow these steps:

  1. Run the appropriate file for your operating environment:

    Windows

    C:\Program Files\CA\webasagent\ca-sapwebas-config.cmd
    

    UNIX

    <agent_install_dir>/webasagent/ca-sapwebas-config.bin
    

    Note: To configure using console, open a console window and then run the previous command with the -i console option.

    Note: To configure unattended, open a console window and then run the previous command with the “-i silent –f <configuration_properties_file>” options. The configuration properties file (ca-sapwebas-configuration.properties) is located in the install_config_info directory of the product.

    Important! To configure unattended, you must configure the product using wizard or console once. The configuration properties file is required for unattended configuration. Before you perform the unattended configuration, verify that the configuration properties file is updated based on the host where you configure the product.

  2. Follow the prompts in the wizard.
  3. Restart your system.

    The product is configured.