Installation and Upgrade Guides › Web Agent Installation Guide for Oracle iPlanet › Install and Configure an Oracle iPlanet Agent on UNIX/Linux › How to Install and Configure a CA SiteMinder® Agent for Oracle iPlanet on UNIX/Linux

How to Install and Configure a CA SiteMinder® Agent for Oracle iPlanet on UNIX/Linux

Installing and configuring the CA SiteMinder® Agent for Oracle iPlanet involves several separate procedures. To install and configure the Agent for Oracle iPlanet, use the following process:

1. Gather the information for the installation program.
2. Run the wizard based installation program.
3. Gather the information for the configuration program.
4. Source the agent environment script.
5. Set the library path variable.
6. Run the wizard based configuration program.
7. (Optional) Install and configure additional Agents for Oracle IPlanet silently.
8. Determine if your Agent for Oracle iPlanet requires any of the following additional configuration steps:
   • (For SunOne 6.1 web servers only) If you want to use the Oracle iPlanet Administration Server console, apply the CA SiteMinder® changes to the configuration files of the Oracle iPlanet web server.
   • (Except SunOne 7.0/Sun Java 7.0 web servers) Manually configure any nondefault server instances, reverse proxies, or virtual servers for CA SiteMinder®.
   • For Solaris 9 SP3 and Solaris 10, modify the startup script.

Gather the Information for the Installation

Gather the following information about your web server before running the installation program for the agent:

Installation Directory

Specifies the location of the agent binary files on your web server. The web_agent_home variable is set to this location.

Limit: The product requires the name "webagent" for the bottom directory in the path.

Run the Installation Program on UNIX/Linux

The installation program for the CA SiteMinder® agent installs the agent on one computer at a time using the UNIX or Linux operating environments. This installation program can be run in wizard or console modes. The wizard and console-based installation program also creates a .properties file for subsequent installations and configurations using the unattended or silent method with the same settings.

For example, suppose the Agents in your environment use the same web server version, installation directory, Agent Configuration Object and Policy Servers. Use the installation wizard or console-based installation program for your first installation. Afterwards, you could create your own script to run the installation program with the .properties file the wizard or console-based installation program created.

Follow these steps:

1. Copy CA SiteMinder® agent installation executable file to a temporary directory on your web server.
2. Log in as a root user.
3. Do one of the following steps:
   • For wizard-based installations, run the installation executable file.
   • For console-based installations, open a command-line window and run the executable as shown in the following example:

     executable_file_name.exe -i console
     

4. Use the information from your agent Installation worksheet to complete the installation program.

More information:

Web Agent Install Worksheet for the Windows Operating Environment

Gather the Information that the Configuration Program Requires on UNIX/Linux

Gather the following information about the environment for the product before running the configuration program for the agent:

Register Host

Indicates whether you want to register a trusted host. This registration creates a trusted host object in the Policy Server and an SmHost.conf file on the web server. The agent uses this information to make an initial connection to Policy Servers when it starts. Register each agent instance as a trusted host only once.

Default:Yes

Options: Yes, No

Admin User Name

Specifies the name of a CA SiteMinder® user with Administrative privileges that is already defined in the Policy Server. This CA SiteMinder® user account requires privileges to register trusted hosts.

Admin Password

Specifies a password for the Admin User Name that is already defined in the Policy Server.

Confirm Admin Password

Repeats the password entered in the Admin Password field. This value verifies the password for the Admin User Name already defined in the Policy Server.

Trusted Host Object Name

Specifies a unique name for the trusted host you are registering. This trusted host object is stored on the Policy Server.

Host Configuration Object

Specifies the name of a Host Configuration Object that is already defined in the Policy Server. After the agent initially connects to a Policy Server (using the SmHost.conf file settings), subsequent connections use the settings from the Host Configuration Object.

Policy Server IP Address

Specifies the Internet Protocol address of the Policy Servers to which the agent attempts to connect upon startup. If your Policy Server is behind a firewall, specify a port number also.

If a hardware load balancer is configured to expose Policy Servers in your environment through a single Virtual IP Address (VIP), enter the VIP.

Example: (IPV4) 192.168.1.105

Example: (IPV4 with the port number) 192.168.1.105:44443

Example: (IPV6) 2001:DB8::/32

Example: (IPV6) [2001:DB8::/32]:44443

FIPS Mode Setting

Specifies one of the following algorithms:

FIPS Compatibility/AES Compatibility

Uses algorithms existing in previous versions of CA SiteMinder® to encrypt sensitive data and is compatible with previous versions of CA SiteMinder®. If your organization does not require the use of FIPS-compliant algorithms, use this option.

FIPS Migration/AES Migration

Allows a transition from FIPS-compatibility mode to FIPS-only mode. In FIPS-migration mode, CA SiteMinder® environment continues to use existing CA SiteMinder® encryption algorithms as you reencrypt existing sensitive data using FIPS-compliant algorithms.

FIPS Only/AES Only

Uses only FIPS-compliant algorithms to encrypt sensitive data in the CA SiteMinder® environment. This setting does not interoperate with, nor is backwards-compatible with, previous versions of CA SiteMinder®.

Default: FIPS Compatibility/AES Compatibility

FIPS is a US government computer security standard that accredits cryptographic modules which meet the Advanced Encryption Standard (AES).

Important! Use a compatible FIPS/AES mode (or a combination of compatible modes) for both the CA SiteMinder® agent and the Policy Server.

Name

Specifies the name of the SmHost.conf file which contains the settings the Web Agent uses to make initial connections to a Policy Server.

Default: SmHost.conf

Location

Specifies the directory where the SmHost.conf file is stored.

Default: web_agent_home\config

Enable Shared Secret Rollover

Select this check box to change the shared secret that the Policy Server uses to encrypt communications to the Web Agents.

Select Servers

Indicates the web server instances that the configuration program finds on the computer. Select the check boxes of the instances you want to configure. Clear the check boxes of those instances from which you want to remove CA SiteMinder® protection.

Agent Configuration Object Name

Specifies the name of an agent configuration object (ACO) already defined on the Policy Server.

Default: AgentObj

Advanced Authentication Scheme Dialog

Specifies the advanced authentication scheme for the web server instances you selected previously.

Source the Agent Environment Script on UNIX or Linux

The agent installation program creates an environment script in the following directory:

web_agent_home/ca_wa_env.sh

web_agent_home

Indicates the directory where the CA SiteMinder® Agent is installed.

Default (UNIX/Linux installations): /opt/ca/webagent

For most Apache-based web servers, source this script after doing any of the following tasks:

• Running the agent configuration program.
• Starting the web server.

  Note: If you perform all the previous tasks in the same shell, only source the script once.

For the embedded Apache web server included with RedHat Linux, do one of the following tasks:

• Source the script before starting the httpd service.
• Source the script in the following file (instead of starting it manually each time):

  /etc/init.d/htppd
  

More information:

Enable a Web Agent

Set the Library Path Variable on UNIX or Linux

Set the library path variable on UNIX or Linux systems before running the agent configuration program.

The following table lists the library path variables for the various UNIX and Linux operating environments:

Set the value of the library path variable to the web_agent_home/bin directory.

web_agent_home

Indicates the directory where the CA SiteMinder® Agent is installed.

Default (UNIX/Linux installations): /opt/ca/webagent

Run the Web Agent Configuration Program on UNIX/Linux

After gathering the information for your agent configuration, run the agent configuration program. This program creates an agent runtime instance for the web servers running on your computer.

This configuration program is wizard or console based, depending on the option you select. Running the configuration program in the wizard or console mode once creates a properties file. Use the properties file to run unattended configurations on other computers with same operating environment in the future.

Follow these steps:

1. Open the following directory on your web server:

   web_agent_home/install_config_info

   web_agent_home

   Indicates the directory where the CA SiteMinder® Agent is installed.

   Default (UNIX/Linux installations): /opt/ca/webagent

2. Use one of the following configuration methods:
   • For a GUI-based configuration, go to Step 3.
   • For a console-based configuration, go to Step 5.
3. Run the following executable file:

   ca-wa-config.bin
   

4. Go to Step 8.
5. Open a Command Prompt window with root privileges.
6. Navigate to the executable file listed previously, and then run it with the following switch:

   -i console
   

7. Go to Step 8.
8. Follow the prompts shown in the configuration program. Provide the requested values from your agent configuration worksheet.

   The agent runtime instance is created for your web servers.

Run the Unattended or Silent Installation and Configuration Programs for Agents on UNIX/Linux

The unattended or silent installation option can help you automate the installation and configuration process. This method saves time if you have a large CA SiteMinder® environment that uses many agents with identical settings.

For example, suppose the Agents in your environment use the same web server version, installation directory, Agent Configuration Object and Policy Servers. Use the installation wizard or console-based installation program for your first installation. Afterwards, you could create your own script to run the installation program with the .properties file the wizard or console-based installation program created.

Follow these steps:

1. Run the following wizards on your first web server (in the order shown):
   1. The CA SiteMinder® Web Agent Installation wizard.
   2. The CA SiteMinder® Web Agent Configuration wizard.
2. Locate the following file on your first web server:

   web_agent_home/install_config_info/ca-wa-installer.properties
   

   Note: If the path contains spaces, surround it with quotes.

   web_agent_home

   Indicates the directory where the CA SiteMinder® Agent is installed.

   Default (UNIX/Linux installations): /opt/ca/webagent

3. Perform each of the following steps on the subsequent web server:

   Note: To automate this process, create your own customized script to execute these files on your systems. Use any scripting language that you want.

   1. Create a temporary directory on the subsequent web server.
   2. Copy the following files from the web server where you ran the wizards (from Steps 1 and 2) to the temporary directory on your subsequent web server:
      • The CA SiteMinder® Web Agent Installation executable file.
      • CA SiteMinder® ca-wa-installer properties file.
   3. Open a Command Prompt window with root privileges in the temporary directory.
   4. Run the following command:

      agent_executable.bin -f properties_file -i silent
      

      The CA SiteMinder® agent is installed and configured on the web server silently.

   5. (Optional) Delete the temporary directory from your web server.
4. Repeat Step 3 for each additional web server in your CA SiteMinder® environment that uses the configuration that the settings in your ca-wa-installer.properties file specify.

Apply CA SiteMinder® Changes to Oracle iPlanet Configuration Files with Oracle iPlanet Administration Server Console for SunOne 6.1 Servers

The Agent Configuration Wizard modifies the default obj.conf, and mime.types files that the Oracle iPlanet web server uses.

If you are using version 6.1 of a SunOne web server, and you plan to use the Oracle iPlanet Administration console, apply the changes to these files before using the console. If you do not apply the changes using the console first, the changes that are made for your CA SiteMinder® configuration could be corrupted. If you lose your configuration, run the configuration program again.

Note: The agent adds settings to the obj.conf file of the Oracle iPlanet web server when the Agent is configured to support an advanced authentication scheme. CA SiteMinder® does not remove these settings later. Edit the obj.conf file manually to remove any obsolete settings.

Follow these steps:

1. Log in to the Oracle iPlanet Administration Server console.
2. From the Servers tab, select the web server with the CA SiteMinder® agent installed and click Manage.
3. In the right corner of the dialog, click Apply.

   A warning message about loading the modified configuration files appears.

4. Click Load Configuration Files.
5. Exit the console.
6. Restart the web server.
7. Optimize the Agent for Oracle iPlanet by tuning the shared memory segments.

   The CA SiteMinder® changes are applied.

More information:

Reconfigured Web Agent Won't Operate

Manually Configure Non-default Server Instances, Virtual Servers, or Reverse Proxies for Oracle iPlanet Web Servers

The CA SiteMinder® Web Agent Configuration wizard only configures the default instance of your Oracle iPlanet web server. To configure a different instance of the Oracle iPlanet web server for CA SiteMinder®, manually edit the obj.conf file that is associated with that server instance. Examples of server instances that need manual configuration include:

• Servers installed in a nondefault directory
• Servers that you want to configure as a reverse proxy. We recommend configuring the reverse proxy using your Oracle iPlanet interface before adding the CA SiteMinder® settings to the obj.conf file.

  Note: The CA SiteMinder® Agent Configuration wizard only modifies the default obj.conf file on the Oracle iPlanet (formerly Sun Java System) web server. To protect other instances or reverse proxy deployments with CA SiteMinder®, copy the CA SiteMinder® settings from the default obj.conf file to any respective instance_name-obj.conf files. For example, your web server created an obj.conf file when you installed it, but you later added a server instance named my_server.example.com. To protect resources on my_server.example.com with CA SiteMinder®, copy the CA SiteMinder® settings the wizard added from the obj.conf file to the my_server.example.com-obj.conf file.

• Virtual servers on the same computer

Note: SunOne 7.0 web servers do not require these manual configuration steps.

Follow these steps:

1. Locate the directory of the server instance you want to configure.
2. Open the obj.conf file with a text editor.
3. Locate the following line:

   <Object name="default">
   

4. Insert a new line below the previous one, and then add the following text:

   AuthTrans fn="SiteMinderAgent"
   

5. Locate the following line:

   AuthTrans fn="match-browser" browser="*MSIE*" ssl-unclean-shutdown="true"
   

6. Insert a new line below the previous one, and then add the following text:

   NameTrans fn="pfx2dir" from="/siteminderagent/pwcgi" dir="web_agent_home/pw" name="cgi"
   NameTrans fn="pfx2dir" from="/siteminderagent/pw" dir="web_agent_home/pw"
   NameTrans fn="pfx2dir" from="/siteminderagent/jpw" dir="web_agent_home/jpw"
   NameTrans fn="pfx2dir" from="/siteminderagent/redirectjsp" dir="web_agent_home/affwebservices/redirectjsp"
   NameTrans fn="pfx2dir" from="/siteminderagent/certoptional" dir="web_agent_home/samples"
   NameTrans fn="pfx2dir" from="/siteminderagent" dir="web_agent_home/samples"
   

7. Locate the following line:

   NameTrans fn="ntrans-j2ee" name="j2ee"
   

8. Insert a new line below the previous one, and then add the following text:

   PathCheck fn="SmRequireAuth"
   

9. Remove the following line:

   NameTrans fn="pfx2dir" from="/mc-icons" dir="C:/Program Files/Sun/WebServer7.0/lib/icons" name="es-internal"
   

10. Locate the following line:

    ObjectType fn="force-type" type="text/plain"
    

11. Insert a new line below the previous one, and then add the following text:

    Service method="(GET|POST)" fn="SmAdvancedAuth"
    

12. Save the obj.conf file.

    The Oracle iPlanet web server is manually configured.

Modify the Oracle iPlanet Startup Script to Prevent Crashes when the Server Stops

The Oracle iPlanet server can sometimes crash when shutting down in the following operating environments:

• Solaris 9 SP3
• Solaris 10

Modify the startserv script to prevent the Oracle iPlanet web server from crashing when shuttng down.

Follow these steps:

1. Open the following file with a text editor:

   sunone_instance_directory/bin/startserv
   

   sunone_instance_directory

   Indicates the directory of the SunOne web server instance.

2. Locate the following line:

   LIBUMEM_32=/usr/lib/libumem.so
   

3. Add a comment character in the beginning of the previous line. See the following example:

   #LIBUMEM_32=/usr/lib/libumem.so
   

4. Locate the following line:

   LIBUMEM_64=/usr/lib/64/libumem.so
   

5. Add a comment character in the beginning of the previous line. See the following example:

   #LIBUMEM_64=/usr/lib/64/libumem.so
   

6. Save the file and close the text editor.

   The Oracle iPlanet startup script is modified.