Web Services Security Guides › CA SiteMinder WSS Agent Guide for Apache-based Web Servers › Install and Configure Apache-based Agents on UNIX/Linux › How to Configure SiteMinder WSS Agents on UNIX/Linux

How to Configure SiteMinder WSS Agents on UNIX/Linux

Configuring the SiteMinder WSS Agent occurs after the installation. Configuration requires several separate procedures which are described using the following process:.

1. Set environment variables.
2. Run the agent configuration program.
3. (Optional) Run the unattended or silent installation and configuration program for other agents.
4. Determine if your Agent for Oracle iPlanet requires any of the following additional configuration steps:
   • (For SunOne 6.1 web servers only) If you want to use the Oracle iPlanet Administration Server console, apply the CA SiteMinder® changes to the configuration files of the Oracle iPlanet web server.
   • (Except SunOne 7.0/Sun Java 7.0 web servers) Manually configure any nondefault server instances, reverse proxies, or virtual servers for CA SiteMinder®.
   • For Solaris 9 SP3 and Solaris 10, modify the startup script.

Gather Information Required for SiteMinder WSS Agent Configuration

The following information must be supplied during Trusted Host registration:

SM Admin User Name

The name of a Policy Server administrator allowed to register the host with the Policy Server.

This administrator should already be defined at the Policy Server and have the permission Register Trusted Hosts set. The default administrator is SiteMinder.

SM Admin Password

The Policy Server administrator account password.

Trusted Host Name

Specifies a unique name that represents the trusted host to the Policy Server. This name does not have to be the same as the physical client system that you are registering; it can be any unique name, for example, mytrustedhost.

Note: This name must be unique among trusted hosts and not match the name of any other Agent.

Host Configuration Object

The name of the Host Configuration Object in the Policy Server that defines the connection between the trusted host and the Policy Server. For example, to use the default, enter DefaultHostSettings. In most cases, you will have created your own Host Configuration Object.

Note: This value must match the Host Configuration Object entry preconfigured on the Policy Server.

Policy Server IP Address

The IP address, or host name, and authentication port of the Policy Server where you are registering the host. The default port is 44442. If you do not provide a port, the default is used.

You can specify a non-default port number, but if your Policy Server is configured to use a non-default port and you omit it when you register a trusted host, the following error is displayed:

Registration Failed (bad ipAddress[:port] or unable to connect to Authentication server (-1)

Note also that if you specify a non-default port, that port is used for the Policy Server’s authentication, authorization, and accounting ports; however, the unified server responds to any Agent request on any port. The entry in the SmHost.conf file will look like:

policyserver="ip_address,5555,5555,5555"

FIPS Encryption Mode

Determines whether the Agent communicates with the Policy Server using certified Federal Information Processing Standard (FIPS) 140-2 compliant cryptographic libraries.

FIPS Compatibility Mode (Default)

Specifies non-FIPS mode, which lets the Policy Server and the Agents read and write information using the existing CA SiteMinder® encryption algorithms. If your organization does not require the use of FIPS-compliant algorithms, the Policy Server and the Agents can operate in non-FIPS mode without further configuration.

FIPS Only Mode

Specifies full-FIPS mode, which requires that the Policy Server and Web Agents read and write information using only FIPS 140-2 algorithms.

Important! A CA SiteMinder® installation that is running in Full FIPS mode cannot interoperate with, or be backward compatible to, earlier versions of CA SiteMinder®, including all agents, custom software using older versions of the Agent API, and custom software using PM APIs or any other API that the Policy Server exposes. You must re-link all such software with the corresponding versions of the respective SDKs to achieve the required support for Full FIPS mode.

Set Environment Variables for a SiteMinder WSS Agent on UNIX

After installing the SiteMinder WSS Agent on UNIX, you must set required environment variables using the ca_wa_env.sh script. Running the script for SiteMinder WSS Agents on most UNIX platforms ensures that the SiteMinder WSS Agent and web server can work together.

The ca_wa_env.sh script sets the following environment variables:

• NETE_WA_ROOT
• PATH
• NETE_WA_PATH
• LD_LIBRARY_PATH

  Note: The SiteMinder WSS Agent requires that LD_LIBRARY_PATH include /usr/lib before any other directory containing older versions of libm.so.

• SHLIB_PATH
• LIBPATH

To set the SiteMinder WSS Agent environment variables after installation, source the following script after you install and configure the SiteMinder WSS Agent:

1. Open a command window.
2. Navigate to WSS_Home/webagent/.

   WSS_Home

   Specifies the path to where CA SiteMinder WSS is installed.

3. Enter the following command:

   . ./ca_wa_env.sh

Note: You do not have to run this script for Sun Java System web servers because this file as been added to the start script.

Run the SiteMinder WSS Agent Configuration Program on UNIX or Linux Systems

You can configure your SiteMinder WSS Agents and register a trusted host immediately after installing the SiteMinder WSS Agent or at a later time; however, the host must be registered to communicate with the Policy Server.

Note: You only register the host once, not each time you install and configure a SiteMinder WSS Agent on your system.

These instructions are for GUI and Console Mode registration. The steps for the two modes are the same, with the following exceptions for Console mode:

• You may be instructed to select an option by entering a corresponding number for that option.
• You press Enter after each step to proceed through the process. The prompts should guide you through the process.
• All passwords that you enter are displayed in clear text. To workaround this issue, run the installation in GUI or unattended mode.

To configure Agents and register a trusted host

1. If necessary, start the Configuration Wizard as follows:
   1. Open a console window.
   2. Navigate to agent_home/install_config_info, where agent_home is the installed location of the SiteMinder WSS Agent.
   3. Enter one of the following commands:

      GUI Mode: ./ca-pep-config.bin

      Console Mode: ./ca-pep-config.bin -i console

   The Configuration Wizard starts.

2. Use gathered system and component information to configure the SiteMinder WSS Agent and register the host.

   Note: If you choose to configure multiple Agents, you can set the Register with same Policy Server option to register them all with the same Policy Server.

When the wizard completes, the host is registered and a host configuration file, SmHost.conf, is created in agent_home/config. You can modify this file.

agent_home

Is the installed location of the SiteMinder WSS Agent

(Optional) Run the Unattended or Silent Installation and Configuration Programs for your SiteMinder WSS Agent

The unattended or silent installation option can help you automate the installation and configuration process. This method saves time if you have a large CA SiteMinder WSS environment that uses many agents with identical settings.

For example, suppose the Agents in your environment use the same web server version, installation directory, Agent Configuration Object and Policy Servers. Use the installation wizard or console-based installation program for your first installation. Afterwards, you could create your own script to run the installation program with the .properties file the wizard or console-based installation program created.

Follow these steps:

1. Run the following wizards on your first web server (in the order shown):
   1. The CA SiteMinder WSS Installation wizard.
   2. The CA SiteMinder WSS Configuration wizard.
2. Locate the following file on your first web server:

   WSS_Home/install_config_info/ca-wss-installer.properties
   

   Note: If the path contains spaces, surround it with quotes.

   WSS_Home

   Specifies the path to where CA SiteMinder WSS is installed.

3. Perform each of the following steps on the subsequent web servers:

   Note: To automate this process, create your own customized script to execute these files on your systems. Use any scripting language that you want.

   1. Create a temporary directory on the subsequent web server.
   2. Copy the following files from the web server where you ran the wizards (from Steps 1 and 2) to the temporary directory on your subsequent web server:
      • The SiteMinder WSS Agent Installation executable file.
      • The ca-pepconfig-installer.properties file.
   3. Open a Command Prompt window with root privileges in the temporary directory.
   4. Run the following command:

      ca-sm-wss-12.51-cr-unix_version.bin -f properties_file -i silent
      

      cr

      Specifies the cumulative release number. The base 12.51 release does not include a cumulative release number.

      The SiteMinder WSS Agent is installed and configured on the web server silently.

   5. (Optional) Delete the temporary directory from your web server.
4. Repeat Step 3 for each additional web server in your CA SiteMinder® environment that uses the configuration that the settings in your ca-wss-installer.properties file specify.

Set the LD_PRELOAD Variable

Most Apache-based CA SiteMinder® agents require that the LD_PRELOAD variable is set to the following value:

LD_PRELOAD=web_agent_home/bin/libbtunicode.so

Note: Embedded Apache web servers included with RedHat Linux require different configuration procedures.

Set the LD_ASSUME_KERNEL for Apache Agent on SuSE Linux 9 for zSeries

After you install the Web Agent on an Apache web server running on SuSE Linux 9 for zSeries, set the LD_ASSUME_KERNEL environment variable as follows:

LD_ASSUME_KERNEL=2.4.21

export LD_ASSUME_KERNEL

Important! You must set this variable to 2.4.21 because it represents the kernel release upon which the Web Agent libraries are built.

Without this setting, the following problems occur:

• The Apache web server will not start properly.
• Host registration dumps core.

Set the CAPKIHOME Variable for Red Hat Linux 6 Systems

If you want to run an Apache-based Web Agent on a Red Hat Linux system, set the CAPKIHOME environment variable by entering the following commands:

CAPKIHOME="/usr/local/CA/webagent/CAPKI"
export CAPKIHOME