This section contains the following topics:
Agent Installation Compared to Agent Configuration
How to Install and Configure the Agent for Oracle iPlanet on Windows
The concepts of installation and configuration have specific meanings when used to describe CA SiteMinder® agents.
Installation means installing the CA SiteMinder® agent software on a computer system. For example, installing an agent creates directories and copies the CA SiteMinder® agent software and other settings to the computer.
Configuration occurs after installation and means the act of preparing the CA SiteMinder® agent software for a specific web server on a computer. This preparation includes registering the agent with CA SiteMinder® Policy Servers, and creating a runtime server instance for the web server that is installed on the computer.
Use the wizard-based installation and configuration programs to install and configure your agent on your first web server. The wizard-based programs create a .properties file.
Use the .properties file and the respective executable file to install or configure the agent silently on additional web servers.
Installing and configuring the CA SiteMinder® Agent for Oracle iPlanet involves several separate procedures. To install and configure the Agent for Oracle iPlanet, use the following process:
Gather the following information about your web server before running the installation program for the CA SiteMinder® agent:
Specifies the location of the CA SiteMinder® agent binary files on your web server. The web_agent_home variable is set to this location.
Limit: CA SiteMinder® requires the name "webagent" for the bottom directory in the path.
The installation program for the CA SiteMinder® agent installs the agent on one computer at a time using the Windows operating environment. This installation program can be run in wizard or console modes. The wizard and console-based installation programs also create a .properties file for subsequent installations and configurations using the unattended or silent method with the same settings.
For example, suppose the Agents in your environment use the same web server version, installation directory, Agent Configuration Object and Policy Servers. Use the installation wizard or console-based installation program for your first installation. Afterwards, you could create your own script to run the installation program with the .properties file the wizard or console-based installation program created.
Follow these steps:
executable_file_name.exe -i console
Gather the following information about your CA SiteMinder® environment before running the configuration program for the CA SiteMinder® agent:
Indicates whether you want to register a trusted host. This registration creates a trusted host object in the CA SiteMinder® Policy Server and an SmHost.conf file on the web server. The agent uses this information to make an initial connection to CA SiteMinder® Policy Servers when it starts. Register each agent instance as a trusted host only once.
Default:Yes
Limits: Yes, No
Specifies the name of a CA SiteMinder® user with Administrative privileges that is already defined in the CA SiteMinder® Policy Server. This CA SiteMinder® user account requires privileges to register trusted hosts.
Specifies a password for the Admin User Name that is already defined in the CA SiteMinder® Policy Server.
Repeats the password entered in the Admin Password field. This value verifies the password for the Admin User Name already defined in the CA SiteMinder® Policy Server.
Specifies a unique name for the trusted host you are registering. This trusted host object is stored on the CA SiteMinder® Policy Server.
Specifies the name of a Host Configuration Object that is already defined in the CA SiteMinder® Policy Server. After the agent initially connects to a Policy Server (using the SmHost.conf file settings), subsequent connections use the settings from the Host Configuration Object.
Specifies the Internet Protocol address of the Policy Servers to which the agent attempts to connect upon startup. If your Policy Server is behind a firewall, specify a port number also.
If a hardware load balancer is configured to expose Policy Servers in your environment through a single Virtual IP Address (VIP), enter the VIP. For more information, see the Policy Server Administration Guide.
Example: (IPV4) 192.168.1.105
Example: (IPV4 with the port number) 192.168.1.105:44443
Example: (IPV6) 2001:DB8::/32
Example: (IPV6) [2001:DB8::/32]:44443
Specifies one of the following algorithms:
Uses algorithms existing in previous versions of CA SiteMinder® to encrypt sensitive data and is compatible with previous versions of CA SiteMinder®. If your organization does not require the use of FIPS-compliant algorithms, use this option.
Allows a transition from FIPS-compatibility mode to FIPS-only mode. In FIPS-migration mode, CA SiteMinder® environment continues to use existing CA SiteMinder® encryption algorithms as you reencrypt existing sensitive data using FIPS-compliant algorithms.
Uses only FIPS-compliant algorithms to encrypt sensitive data in the CA SiteMinder® environment. This setting does not interoperate with, nor is backwards-compatible with, previous versions of CA SiteMinder®.
Default: FIPS Compatibility/AES Compatibility
Note: FIPS is a US government computer security standard that accredits cryptographic modules which meet the Advanced Encryption Standard (AES).
Important! Use a compatible FIPS/AES mode (or a combination of compatible modes) for both the CA SiteMinder® agent and the CA SiteMinder® Policy Server.
Specifies the name of the SmHost.conf file which contains the settings the Web Agent uses to make initial connections to a CA SiteMinder® Policy Server.
Default: SmHost.conf
Specifies the directory where the SmHost.conf file is stored.
Default: web_agent_home\config
Select this check box to change the shared secret that the CA SiteMinder® Policy Server uses to encrypt communications to the Web Agents.
Indicates the web server instances that the configuration program finds on the computer. Select the check boxes of the instances you want to configure. Clear the check boxes of those instances from which you want to remove CA SiteMinder® protection.
Specifies the name of an agent configuration object (ACO) already defined on the Policy Server.
Default: AgentObj
Specifies the advanced authentication scheme for the web server instances you selected previously.
After gathering the information for your agent configuration, run the agent configuration program. This program creates an agent runtime instance for the web servers running on your computer.
This configuration program is wizard or console based, depending on the option you select. Running the configuration program in the wizard or console modes once creates a properties file. Use the properties file to run unattended configurations on other computers with same operating environment in the future.
Follow these steps:
web_agent_home\install_config_info
Indicates the directory where the CA SiteMinder® agent is installed on your web server.
Default (Windows 32-bit installations only): C:\Program Files\CA\webagent
Default (Windows 64-bit installations only): C:\Program Files\CA\webagent\win64
Default (Windows 32-bit applications operating on 64-bit systems [Wow64]): C:\Program Files (x86)\webagent\win32
ca-wa-config.exe
-i console
The agent runtime instance is created for your web servers.
The unattended or silent installation option can help you automate the installation and configuration process. This method saves time if you have a large CA SiteMinder® environment that uses many agents with identical settings.
For example, suppose the Agents in your environment use the same web server version, installation directory, Agent Configuration Object and Policy Servers. Use the installation wizard or console-based installation program for your first installation. Afterwards, you could create your own script to run the installation program with the .properties file the wizard or console-based installation program created.
Follow these steps:
web_agent_home\install_config_info\ca-wa-installer.properties
Note: If the path contains spaces, surround it with quotes.
Indicates the directory where the CA SiteMinder® agent is installed on your web server.
Default (Windows 32-bit installations only): C:\Program Files\CA\webagent
Default (Windows 64-bit installations only): C:\Program Files\CA\webagent\win64
Default (Windows 32-bit applications operating on 64-bit systems [Wow64]): C:\Program Files (x86)\webagent\win32
Note: To automate this process, create your own customized script to execute these files on your systems. Use any scripting language that you want.
agent_executable -f properties_file -i silent
The CA SiteMinder® agent is installed and configured on the subsequent server silently.
The Agent Configuration Wizard modifies the default obj.conf, and mime.types files that the Oracle iPlanet web server uses.
If you are using version 6.1 of a SunOne web server, and you plan to use the Oracle iPlanet Administration console, apply the changes to these files before using the console. If you do not apply the changes using the console first, the changes that are made for your CA SiteMinder® configuration could be corrupted. If you lose your configuration, run the configuration program again.
Note: The agent adds settings to the obj.conf file of the Oracle iPlanet web server when the Agent is configured to support an advanced authentication scheme. CA SiteMinder® does not remove these settings later. Edit the obj.conf file manually to remove any obsolete settings.
Follow these steps:
A warning message about loading the modified configuration files appears.
The CA SiteMinder® changes are applied.
The CA SiteMinder® Web Agent Configuration wizard only configures the default instance of your Oracle iPlanet web server. To configure a different instance of the Oracle iPlanet web server for CA SiteMinder®, manually edit the obj.conf file that is associated with that server instance. Examples of server instances that need manual configuration include:
Note: The CA SiteMinder® Agent Configuration wizard only modifies the default obj.conf file on the Oracle iPlanet (formerly Sun Java System) web server. To protect other instances or reverse proxy deployments with CA SiteMinder®, copy the CA SiteMinder® settings from the default obj.conf file to any respective instance_name-obj.conf files. For example, your web server created an obj.conf file when you installed it, but you later added a server instance named my_server.example.com. To protect resources on my_server.example.com with CA SiteMinder®, copy the CA SiteMinder® settings the wizard added from the obj.conf file to the my_server.example.com-obj.conf file.
Note: SunOne/Sun Java 7.0 web servers do not require these manual configuration steps.
Follow these steps:
<Object name="default">
AuthTrans fn="SiteMinderAgent"
AuthTrans fn="match-browser" browser="*MSIE*" ssl-unclean-shutdown="true"
NameTrans fn="pfx2dir" from="/siteminderagent/pwcgi" dir="web_agent_home/pw" name="cgi" NameTrans fn="pfx2dir" from="/siteminderagent/pw" dir="web_agent_home/pw" NameTrans fn="pfx2dir" from="/siteminderagent/jpw" dir="web_agent_home/jpw" NameTrans fn="pfx2dir" from="/siteminderagent/redirectjsp" dir="web_agent_home/affwebservices/redirectjsp" NameTrans fn="pfx2dir" from="/siteminderagent/certoptional" dir="web_agent_home/samples" NameTrans fn="pfx2dir" from="/siteminderagent" dir="web_agent_home/samples" NameTrans fn="pfx2dir" from="/siteminderagent/pwservlet" dir=web_agent_home/jpw"
Indicates the directory where the CA SiteMinder® agent is installed on your web server.
Default (Windows 32-bit installations only): C:\Program Files\CA\webagent
Default (Windows 64-bit installations only): C:\Program Files\CA\webagent\win64
Default (Windows 32-bit applications operating on 64-bit systems [Wow64]): C:\Program Files (x86)\webagent\win32
NameTrans fn="ntrans-j2ee" name="j2ee"
PathCheck fn="SmRequireAuth"
NameTrans fn="pfx2dir" from="/mc-icons" dir="C:/Program Files/Sun/WebServer7.0/lib/icons" name="es-internal"
ObjectType fn="force-type" type="text/plain"
Service method="(GET|POST)" fn="SmAdvancedAuth"
The Oracle iPlanet web server is manually configured.
You can improve server performance by modifying the default configuration settings in the httpd.conf file; however, these changes are not required:
Follow these steps:
Note: CA Services can provide assistance with performance-tuning for your particular environment.
Copyright © 2013 CA.
All rights reserved.
|
|