How to Configure SiteMinder WSS Agents on UNIX/Linux

Web Services Security Guides › CA SiteMinder® Web Services Security Agent Guide for iPlanet Web Servers › Install and Configure SiteMinder WSS Agents for iPlanet on UNIX/Linux › How to Configure SiteMinder WSS Agents on UNIX/Linux

How to Configure SiteMinder WSS Agents on UNIX/Linux

Configuring the SiteMinder WSS Agent occurs after the installation. Configuration requires several separate procedures which are described using the following process:.

Set environment variables.
Run the agent configuration program.
(Optional) Run the unattended or silent installation and configuration program for other agents.
Determine if your Agent for Oracle iPlanet requires any of the following additional configuration steps:
- (For SunOne 6.1 web servers only) If you want to use the Oracle iPlanet Administration Server console, apply the CA SiteMinder® changes to the configuration files of the Oracle iPlanet web server.
- (Except SunOne 7.0/Sun Java 7.0 web servers) Manually configure any nondefault server instances, reverse proxies, or virtual servers for CA SiteMinder®.
- For Solaris 9 SP3 and Solaris 10, modify the startup script.

Set Environment Variables for a SiteMinder WSS Agent on UNIX

After installing the SiteMinder WSS Agent on UNIX, you must set required environment variables using the ca_wa_env.sh script. Running the script for SiteMinder WSS Agents on most UNIX platforms ensures that the SiteMinder WSS Agent and web server can work together.

The ca_wa_env.sh script sets the following environment variables:

NETE_WA_ROOT
PATH
NETE_WA_PATH
LD_LIBRARY_PATH
Note: The SiteMinder WSS Agent requires that LD_LIBRARY_PATH include /usr/lib before any other directory containing older versions of libm.so.
SHLIB_PATH
LIBPATH

To set the SiteMinder WSS Agent environment variables after installation, source the following script after you install and configure the SiteMinder WSS Agent:

Open a command window.
Navigate to WSS_Home/webagent/.

WSS_Home

Specifies the path to where CA SiteMinder® Web Services Security is installed.
Enter the following command:
. ./ca_wa_env.sh

Note: You do not have to run this script for Sun Java System web servers because this file as been added to the start script.

Run the SiteMinder WSS Agent Configuration Program on UNIX or Linux Systems

You can configure your SiteMinder WSS Agents and register a trusted host immediately after installing the SiteMinder WSS Agent or at a later time; however, the host must be registered to communicate with the Policy Server.

Note: You only register the host once, not each time you install and configure a SiteMinder WSS Agent on your system.

These instructions are for GUI and Console Mode registration. The steps for the two modes are the same, with the following exceptions for Console mode:

You may be instructed to select an option by entering a corresponding number for that option.
You press Enter after each step to proceed through the process. The prompts should guide you through the process.
All passwords that you enter are displayed in clear text. To workaround this issue, run the installation in GUI or unattended mode.

To configure Agents and register a trusted host

If necessary, start the Configuration Wizard as follows:
1. Open a console window.
2. Navigate to agent_home/install_config_info, where agent_home is the installed location of the SiteMinder WSS Agent.
3. Enter one of the following commands:
  GUI Mode: ./ca-pep-config.bin
  
  Console Mode: ./ca-pep-config.bin -i console
The Configuration Wizard starts.
Use gathered system and component information to configure the SiteMinder WSS Agent and register the host.
Note: If you choose to configure multiple Agents, you can set the Register with same Policy Server option to register them all with the same Policy Server.

When the wizard completes, the host is registered and a host configuration file, SmHost.conf, is created in agent_home/config. You can modify this file.

agent_home: Is the installed location of the SiteMinder WSS Agent

(Optional) Run the Unattended or Silent Installation and Configuration Programs for your SiteMinder WSS Agent

The unattended or silent installation option can help you automate the installation and configuration process. This method saves time if you have a large CA SiteMinder® Web Services Security environment that uses many agents with identical settings.

For example, suppose the Agents in your environment use the same web server version, installation directory, Agent Configuration Object and Policy Servers. Use the installation wizard or console-based installation program for your first installation. Afterwards, you could create your own script to run the installation program with the .properties file the wizard or console-based installation program created.

Follow these steps:

Run the following wizards on your first web server (in the order shown):
1. The CA SiteMinder® Web Services Security Installation wizard.
2. The CA SiteMinder® Web Services Security Configuration wizard.
Locate the following file on your first web server:
```
WSS_Home/install_config_info/ca-wss-installer.properties
```
Note: If the path contains spaces, surround it with quotes.

WSS_Home

Specifies the path to where CA SiteMinder® Web Services Security is installed.
Perform each of the following steps on the subsequent web servers:
Note: To automate this process, create your own customized script to execute these files on your systems. Use any scripting language that you want.
1. Create a temporary directory on the subsequent web server.
2. Copy the following files from the web server where you ran the wizards (from Steps 1 and 2) to the temporary directory on your subsequent web server:
  - The SiteMinder WSS Agent Installation executable file.
  - The ca-pepconfig-installer.properties file.
3. Open a Command Prompt window with root privileges in the temporary directory.
4. Run the following command:
```
ca-sm-wss-12.52 SP1-cr-unix_version.bin -f properties_file -i silent
```
  cr
  
  Specifies the cumulative release number. The base 12.52 SP1 release does not include a cumulative release number.
  
  The SiteMinder WSS Agent is installed and configured on the web server silently.
5. (Optional) Delete the temporary directory from your web server.
Repeat Step 3 for each additional web server in your CA SiteMinder® environment that uses the configuration that the settings in your ca-wss-installer.properties file specify.

Apply CA SiteMinder® Changes to Oracle iPlanet Configuration Files with Oracle iPlanet Administration Server Console for SunOne 6.1 Servers

The Agent Configuration Wizard modifies the default obj.conf, and mime.types files that the Oracle iPlanet web server uses.

If you are using version 6.1 of a SunOne web server, and you plan to use the Oracle iPlanet Administration console, apply the changes to these files before using the console. If you do not apply the changes using the console first, the changes that are made for your CA SiteMinder® configuration could be corrupted. If you lose your configuration, run the configuration program again.

Note: The agent adds settings to the obj.conf file of the Oracle iPlanet web server when the Agent is configured to support an advanced authentication scheme. CA SiteMinder® does not remove these settings later. Edit the obj.conf file manually to remove any obsolete settings.

Follow these steps:

Log in to the Oracle iPlanet Administration Server console.
From the Servers tab, select the web server with the CA SiteMinder® agent installed and click Manage.
In the right corner of the dialog, click Apply.
A warning message about loading the modified configuration files appears.
Click Load Configuration Files.
Exit the console.
Restart the web server.
Optimize the Agent for Oracle iPlanet by tuning the shared memory segments.
The CA SiteMinder® changes are applied.

More information:

Reconfigured Web Agent Won't Operate

Manually Configure Non-Default Server Instances, Virtual Servers, or Reverse Proxies for Oracle iPlanet Web Servers

The SiteMinder WSS Agent Configuration wizard only configures the default instance of your Oracle iPlanet web server. To configure a different instance of the Oracle iPlanet web server for CA SiteMinder®, manually edit the obj.conf file that is associated with that server instance. Examples of server instances that need manual configuration include:

Servers installed in a nondefault directory
Servers that you want to configure as a reverse proxy. We recommend configuring the reverse proxy using your Oracle iPlanet interface before adding the CA SiteMinder® settings to the obj.conf file.
Note: The CA SiteMinder® Agent Configuration wizard only modifies the default obj.conf file on the Oracle iPlanet (formerly Sun Java System) web server. To protect other instances or reverse proxy deployments with CA SiteMinder®, copy the CA SiteMinder® settings from the default obj.conf file to any respective instance_name-obj.conf files. For example, your web server created an obj.conf file when you installed it, but you later added a server instance named my_server.example.com. To protect resources on my_server.example.com with CA SiteMinder®, copy the CA SiteMinder® settings the wizard added from the obj.conf file to the my_server.example.com-obj.conf file.
Virtual servers on the same computer

Note: SunOne/Sun Java 7.0 web servers do not require these manual configuration steps.

Follow these steps:

Locate the directory of the server instance you want to configure.
Open the obj.conf file with a text editor.
Locate the following line:
```
<Object name="default">
```
Insert a new line below the previous one, and then add the following text:
```
AuthTrans fn="SiteMinderAgent"
```

Locate the following line:

AuthTrans fn="match-browser" browser="*MSIE*" ssl-unclean-shutdown="true"

Insert a new line below the previous one, and then add the following text:

NameTrans fn="pfx2dir" from="/siteminderagent/pwcgi" dir="agent_home/pw" name="cgi"
NameTrans fn="pfx2dir" from="/siteminderagent/pw" dir="agent_home/pw"
NameTrans fn="pfx2dir" from="/siteminderagent/jpw" dir="agent_home/jpw"
NameTrans fn="pfx2dir" from="/siteminderagent/redirectjsp" dir="agent_home/affwebservices/redirectjsp"
NameTrans fn="pfx2dir" from="/siteminderagent/certoptional" dir="agent_home/samples"
NameTrans fn="pfx2dir" from="/siteminderagent" dir="agent_home/samples"
NameTrans fn="pfx2dir" from="/siteminderagent/pwservlet" dir=agent_home/jpw"

agent_home

Indicates the directory where the SiteMinder WSS Agent is installed on your web server.

Default (Windows 32-bit SiteMinder WSS Agent installations: C:\Program Files\CA\Web Services Security\webagent

Default (Windows 64-bit SiteMinder WSS Agent installations: C:\Program Files\CA\Web Services Security\webagent\win64

Default (Windows 32-bit SiteMinder WSS Agent installations operating on 64-bit systems: C:\Program Files (x86)\CA\Web Services Security\webagent\win32

Locate the following line:
```
NameTrans fn="ntrans-j2ee" name="j2ee"
```
Insert a new line below the previous one, and then add the following text:
```
PathCheck fn="SmRequireAuth"
```

Remove the following line:

NameTrans fn="pfx2dir" from="/mc-icons" dir="C:/Program Files/Sun/WebServer7.0/lib/icons" name="es-internal"

Locate the following line:

ObjectType fn="force-type" type="text/plain"

Insert a new line below the previous one, and then add the following text:
```
Service method="(GET|POST)" fn="SmAdvancedAuth"
```
Locate the following line:
```
Error fn="error-j2ee
```
Insert a new line above the previous one, and then add the following text:
```
Error fn="SmSoapFault" code="500" reason="SmSoapFault"
```
Save the obj.conf file.
Open the magnus.conf file with a text editor.

Add the following line:

Init fn="load-modules" shlib="agent_home/bin/SunOneWebAgent.dll" funcs="SmInitAgent,SmInitChild,SiteMinderAgent,SmRequireAuth,SmAdvancedAuth,SmSoapFault

Save the magnus.conf file.
The Oracle iPlanet web server is manually configured.

Modify the Oracle iPlanet Startup Script to Prevent Crashes when the Server Stops

The Oracle iPlanet server can sometimes crash when shutting down in the following operating environments:

Solaris 9 SP3
Solaris 10

Modify the startserv script to prevent the Oracle iPlanet web server from crashing when shuttng down.

Follow these steps:

Open the following file with a text editor:
```
sunone_instance_directory/bin/startserv
```
sunone_instance_directory

Indicates the directory of the SunOne web server instance.
Locate the following line:
```
LIBUMEM_32=/usr/lib/libumem.so
```
Add a comment character in the beginning of the previous line. See the following example:
```
#LIBUMEM_32=/usr/lib/libumem.so
```
Locate the following line:
```
LIBUMEM_64=/usr/lib/64/libumem.so
```
Add a comment character in the beginning of the previous line. See the following example:
```
#LIBUMEM_64=/usr/lib/64/libumem.so
```
Save the file and close the text editor.
The Oracle iPlanet startup script is modified.