Installation and Upgrade Guides › Policy Server Installation Guide › Installing the Administrative UI › How to Install the Administrative UI

How to Install the Administrative UI

Complete the following steps to install the Administrative UI:

1. Be sure that you have reviewed the Administrative UI installation checklist.
2. (Linux) Review the required Linux libraries requirement.
3. Gather information for the installer.
4. (Optional) Reset the registration window.
5. Install the Administrative UI.
6. Register the Administrative UI.

Consider the following:

• After a successful Windows installation, the CA SiteMinder® Administrative UI login screen appears and the application server automatically starts, which lets you register the Administrative UI with a Policy Server.
• After a successful UNIX installation, you start the application server manually and log into the Administrative UI to complete the registration. For more information, see How to Register the Administrative UI.

Gather Information for the Installer

Gather the following information before installing and registering the Administrative UI:

• Installation location—Determine the Administrative UI installation path.
• Administrative UI system name—Identify the fully qualified name of the Administrative UI host system.
• Server port—Identify the port on which JBoss must listen for HTTP requests.
• SiteMinder super user account password—Identify the password for the default user account (siteminder).
• Policy Server system name—Identify the following:
  • The Policy Server to which the Administrative UI will be registered.
  • The fully qualified name of the Policy Server host system.
• Policy Server authentication port—If you changed the default settings after installing the Policy Server, identify the Policy Server authentication port. The Settings tab in the Policy Server Management Console lists the access control ports.

Reset the Administrative UI Registration Window

If either of the following actions occurred more than 24 hours ago, this step is required:

• You used the Policy Server installation wizard to configure a policy store automatically.
• You used the XPSRegClient utility to submit the CA SiteMinder® super user credentials to the Policy Server.

Note: (UNIX) Be sure that the CA SiteMinder® environment variables are set before you use XPSRegClient. If the environment variables are not set, set them manually.

Follow these steps:

1. Log in to the Policy Server host system.
2. Run the following command:

   XPSRegClient siteminder_administrator[:passphrase] -adminui-setup -t timeout -r retries -c comment -cp -l log_path -e error_path -vT -vI -vW -vE -vF
   

   siteminder_administrator

   Specifies a CA SiteMinder® administrator. If you are installing the Administrative UI as part of:

   • A new 12.52 SP1 environment, specify the following default account:

     siteminder
     

   • An upgrade, specify any CA SiteMinder® administrator account with super user permissions in the policy store. If you do not have a super user account in the policy store, use the smreg utility to create the default account.

   passphrase

   Specifies the password for the CA SiteMinder® administrator account.

   -adminui-setup

   Specifies that the Administrative UI is being registered with a Policy Server for the first–time.

   -t timeout

   (Optional) Specifies how long you have after you install the Administrative UI to log in for the time to complete the registration. The Policy Server denies the registration request when the timeout value is exceeded.

   Unit of measurement: minutes

   Default: 1440 (24 hours)

   Minimum limit: 1

   Maximum limit: 1440 (24 hours)

   -r retries

   (Optional) Specifies how many failed attempts are allowed when you are registering the Administrative UI. A failed attempt can result from submitting incorrect CA SiteMinder® administrator credentials when logging in to the Administrative UI for the first–time.

   Default: 1

   Maximum limit: 5

   -c comment

   (Optional) Inserts the specified comments into the registration log file for informational purposes.

   Note: Surround comments with quotes.

   -cp

   (Optional) Specifies that registration log file can contain multiple lines of comments. The utility prompts for multiple lines of comments and inserts the specified comments into the registration log file for informational purposes.

   Note: Surround comments with quotes.

   -l log path

   (Optional) Specifies where the registration log file must be exported.

   Default: siteminder_home\log

   siteminder_home

   Specifies the Policy Server installation path.

   -e error path

   (Optional) Sends exceptions to the specified path.

   Default: stderr

   -vT

   (Optional) Sets the verbosity level to TRACE.

   -vI

   (Optional) Sets the verbosity level to INFO.

   -vW

   (Optional) Sets the verbosity level to WARNING.

   -vE

   (Optional) Sets the verbosity level to ERROR.

   -vF

   (Optional) Sets the verbosity level to FATAL.

3. Press Enter.

   The utility supplies the Policy Server with the administrator credentials. The Policy Server uses these credentials to verify the registration request when you log in to the Administrative UI for the first–time.

How to Install the Administrative UI

The following sections explain how to install the Administrative UI using the prerequisite installer as part of the stand-alone installation option.

Review Prerequisite Information

Consider the following items before you install the Administrative UI:

• You install the Administrative UI using the installation media on the Technical Support site.

  Note: For a list of installation media names, see the Policy Server Release Notes.

• If you are using the stand-alone option to install, the following procedures apply. If you are installing to an existing application server infrastructure, see Installing the Administrative UI to an Existing Application Server.
• (Windows) Run the installer from the Administrative UI host system. Do not run the installer from a mapped network share or UNC path.
• The installation zip contains the prerequisite installer and the Administrative UI installer.
  • If you are running the prerequisite installer on Windows, be sure that both executables are in the same location. The prerequisite installer automatically starts the Administrative UI installer to complete the installation.
  • If you are running the prerequisite installer on UNIX, be sure that both executables are in the same location. However, you manually start the Administrative UI installer to complete the installation. The prerequisite installer does not automatically start the Administrative UI installer.
• The installation zip contains a layout.properties file at the same level as the installation media. If you moved the installation media after extracting the installation zip, move the properties file to the same location or the installation fails.
• (Red Hat Linux) The Red Hat 6 operating system relies on entropy for performance. Increase entropy before installing the component. Without sufficient entropy, the installation can take an exceedingly long time to complete. Use the following commands to set a symbolic link:

  mv /dev/random /dev/random.org
  ln -s /dev/urandom /dev/random
  

• (UNIX) Depending on your permissions, run the following command to add executable permissions to the directory that contains the installation media:

  chmod -R+x directory
  

  directory

  Specifies the directory that contains the installation media.

• (UNIX) If you execute the Administrative UI installer across different subnets, it can crash. Install the Administrative UI directly on the host system.

More information:

Install the Administrative UI

Locate the Installation Media

Installation Media Names

Install and Register the Administrative UI (Windows)

Run the prerequisite installer followed by the Administrative UI installer.

Follow these steps:

1. Exit all applications that are running.
2. Navigate to the installation media.
3. Double-click prerequisite_installation_media.

   prerequisite_installation_media

   Specifies the Administrative UI prerequisite installer executable.

   The installer starts.

4. Click Install.

   The required components are installed.

5. Click Done.

   The Administrative UI installer starts.

6. Follow the prompts and click Install.

   The Administrative UI is installed. The CA SiteMinder® Administrative UI login screen appears.

7. Type siteminder in the User Name field.
8. Type the siteminder account password in the Password field.

   Note: If your superuser account password contains dollar‑sign ($) characters, replace each instance of the dollar-sign character with $DOLLAR$. For example, if the CA SiteMinder® superuser account password is $password, enter $DOLLAR$password in the Password field.

9. Type the fully qualified Policy Server host name in the Server field.

   Consider the following points:

   • You can enter a valid IPv4 address or IPv6 address.
   • If you do not specify a port, the registration defaults to 44442, which is the default Policy Server authentication port.

   The Administrative UI opens and is registered with the Policy Server.

More information:

Installation Media Names

Install the Administrative UI (UNIX Systems)

Install the Administrative UI and prerequisite components to provide a console for management. This procedure describes how to install the Administrative UI on UNIX systems.

These instructions are for GUI and Console mode installations. The steps for the two modes are the same, with the following exceptions for Console Mode:

• Console mode instructions include the command -i console.
• Select an option by entering a corresponding number.
• Press ENTER after each step to proceed through the process.
• Type BACK to visit the previous step.

Follow these steps:

1. Exit all applications that are running.
2. Open a shell and navigate to the installation media.
3. Enter one of the following commands:

   GUI mode

   ./prerequisite_installation_media
   

   Console mode

   ./prerequisite_installation_media -i console
   

   prerequisite_installation_media

   Specifies the Administrative UI prerequisite installer executable.

   The installer starts.

4. Click Install.

   The required components are installed. The prerequisite installer prompts you to run the Administrative UI installer.

5. Enter one of the following command:

   GUI mode

   ./installation_media
   

   Console mode

   ./installation_media -i console
   

   installation_media

   Specifies the Administrative UI installer executable.

   The Administrative UI installer starts.

6. Follow the prompts and click Install.

   The Administrative UI is installed.

   Note: You cannot use the Administrative UI until you register it with a Policy Server.

After a successful UNIX installation, start the application server manually and log into the Administrative UI to complete the registration. For more information, see How to Register the Administrative UI.

Troubleshoot the Administrative UI Installation

Use the following files to troubleshoot the Administrative UI installation:

• Administrative_UI_Prerequisite_Installer_InstallLog.log

  If you used the stand–alone installation option, this log lists the number of successes, warnings, non–fatal errors, and errors that occurred during the prerequisite installation. Individual installation actions are listed with the respective status.

  Location: administrative_ui_home\CA\SiteMinder\adminui\install_config_info

  administrative_ui_home

  Specifies the Administrative UI installation path.

• CA_SiteMinder_Administrative_UI_InstallLog.log

  This log lists the number of successes, warnings, non–fatal errors, and errors that occurred during the Administrative UI installation. Individual installation actions are listed with the respective status.

  Location: administrative_ui_home\CA\SiteMinder\adminui\install_config_info

  administrative_ui_home

  Specifies the Administrative UI installation path.

How to Register the Administrative UI

You are required to register the Administrative UI before it can be used to manage CA SiteMinder® objects. Registering the Administrative UI creates a trusted connection between the Administrative UI and a Policy Server. Consider the following items:

• (UNIX) You are required to start the application server manually and log in to the Administrative UI to complete the registration.
• (Windows) The CA SiteMinder® Administrative UI login screen appears and the application server starts automatically after installing the Administrative UI to Windows. These actions let you register the Administrative UI immediately. If you did not register the Administrative UI immediately after installing it, complete the following process:

Follow these steps:

1. For versions before r12.52 SP1, Create the FIPS Environment Variable.
2. Start the application server.
3. Register the Administrative UI.

More information:

How to Register the Administrative UI

Create the FIPS Environment Variable

If your environment meets both of the following criteria, creating the FIPs environment variable is required to register the Administrative UI for the first–time:

• The Policy Server to which you are registering is operating in FIPs–only mode.
• The Administrative UI is not installed on the Policy Server host system.

Follow these steps:

1. Complete one of the following steps:
   • (Windows) Log into the Administrative UI host system as an administrative user.
   • (UNIX) Log into the Administrative UI host system as the user that installed the Administrative UI.
2. Set the following environment variable:

   CA_SM_PS_FIPS140=ONLY

   Note: For more information about setting environment variables, see your OS–specific documentation.

3. Verify that Windows or the UNIX shells that runs the Administrative UI correctly recognizes the CA_SM_PS_FIPS140 variable.

Start the Application Server

If you used the stand-alone option to install the Administrative UI, the following procedure applies. If you installed the Administrative UI to a system with an existing application server, go to the instructions for installing the Administrative UI to an existing application server.

To start the application server

1. From the Administrative UI host system, do one of the following:
   • Windows—Open the Microsoft Services console.

     The application server automatically starts after installing the Administrative UI on Windows. You do not have to start the application server after installation.

   • UNIX—Navigate to install_home/CA/siteminder/adminui/bin

     install_home.

     Specifies the Administrative UI installation path.

2. Do one of the following:
   • Windows—Start the CA SiteMinder® Administrative UI service.
   • UNIX—Type run.sh and press Enter.

   The application server is started.

More information:

Installing the Administrative UI to an Existing Application Server

Start the Application Server

Register the Administrative UI

Register the Administrative UI with a Policy Server to begin managing your environment.

Follow these steps:

1. Complete one of the following steps:
   • Windows:
     • (Recommended) Use the Administrative UI shortcut to open the Administrative UI. Using the shortcut registers the Administrative UI over SSL. If you do not have access to the shortcut, open a web browser and go to the following location:

       https://host:8443/iam/siteminder/adminui

       Note: A self–signed certificate that is valid for ten years is created and used for the connection. The certificate is created with an RSA 2048 key strength.

     • Open a web browser and go to the following location:

       http://host:8080/iam/siteminder/adminui

   • UNIX:
     • (Recommended) Open a web browser and go to the following location to register the Administrative UI over SSL:

       https://host:8443/iam/siteminder/adminui

     • Open a browser and go to the following location:

       http://host:8080/iam/siteminder/adminui

       Note: If the host system does not have a web browser, you can remotely access the login screen.

     host

     Specifies the fully qualified Administrative UI host system name.

     The CA SiteMinder® Administrative UI login screen appears.

2. Enter the following value in the User Name field:

   siteminder
   

3. Type the CA SiteMinder® superuser account password in the Password field.

   Note: If your superuser account password contains dollar‑sign ($) characters, replace each instance of the dollar-sign character with $DOLLAR$. For example, if the CA SiteMinder® superuser account password is $password, enter $DOLLAR$password in the Password field.

4. Type the fully qualified Policy Server host name in the Server field.

   Consider the following items:

   • You can enter a valid IPv4 address or IPv6 address.
   • If you do not specify a port, the registration defaults to 44442, which is the default Policy Server authentication port.

   The Administrative UI opens and is registered with the Policy Server.

More information:

Registration Not on File Error Appears

Registering the Administrative UI using HTTPS

Registering the Administrative UI using HTTPS

If you register the Administrative UI using HTTPS, modify the context.xml file of the application server to enable secure cookies.

Follow these steps:

1. Shut down the application server.
2. Navigate to the following location:

   user_console.war\WEB-INF

3. Open the context.xml file.
4. Add the following parameter to the SessionCookie tag:

   secure="true"

5. Save and close the file.
6. Restart the application server.

   The context.xml file is updated and secure cookies are enabled.

More information:

Start the Application Server

Stop the Application Server

Stop the Application Server

If you used the stand-alone option to install the Administrative UI, the following procedure applies. If you installed the Administrative UI to a system with an existing application server, go to the instructions for installing the Administrative UI to an existing application server.

To stop the application server

1. From the Administrative UI host, do one of the following:
   • Windows—Open the Microsoft Services console.
   • UNIX—Navigate to install_home/CA/siteminder/adminui/bin

     administrative_ui_install.

     Specifies the Administrative UI installation path.

2. Do one of the following:
   • Windows—Stop the CA SiteMinder® Administrative UI service.
   • UNIX—Type shutdown.sh and press Enter.

   The application server is stopped.

More information:

Installing the Administrative UI to an Existing Application Server

Stop the Application Server

Administrator Credentials

By default, the Administrative UI uses the policy store as its source for CA SiteMinder® administrator credentials. You can configure the Administrative UI to use an external store, for example, a corporate directory.

Note: For more information about configuring an external administrator user store, see the Policy Server Configuration Guide.

More information:

How to Configure an External Administrator Store