Installation and Upgrade Guides › Policy Server Installation Guide › Installing the Policy Server on UNIX Systems

Installing the Policy Server on UNIX Systems

Installation Road Map

The following diagram illustrates a sample CA SiteMinder® installation and lists the order in which you install and configure each component. Consider the following items:

• Confirm that the Policy Server host system meets the minimum system requirements. We recommend doing so before installing the Policy Server.
• A dotted line surrounds the Policy Server. Install this component now.

  

More information:

Policy Server System Requirements

Policy Server

Solaris 10 Zone Support

A CA SiteMinder® Policy Server is supported in the following zones:

• Global zones
• Sparse-root zones
• Whole-root zones

Consider the following scenarios when planning to run one or more Policy Servers in a Solaris 10 environment.

Global Zone Support

A global zone configuration limits the implementation to a single Policy Server instance across all zones. Specifically:

• Only a single Policy Server instance is supported on the global zone.
• A Policy Server instance is not supported on a sparse-root zone if there is another Policy Server instance on the global zone.
• A Policy Server instance is not supported on a whole-root zone if there is another Policy Server instance on the global zone.

Example: Global zone support

Note: Web Agents, however, may run concurrently in any zone.

Sparse-root Zone Support

A sparse-root zone configuration supports multiple Policy Server instances running on multiple sparse-root zones. Specifically:

• Only one Policy Server instance is supported on each sparse-root zone.
• Concurrent Policy Server instances are supported on sparse-root zones and whole-root zones, so long as there is only one Policy Server instance on each sparse-root or whole-root zone.
• Policy Server instances are not supported running concurrently on the global zone and on sparse-root zones.

Example: Sparse-root zone support

Note: Web Agents, however, may run concurrently in any zone.

Whole-root Zone Support

A whole-root zone configuration supports multiple Policy Server instances running on multiple whole-root zones. Specifically:

• Only one Policy Server instance is supported on each whole-root zone.
• Concurrent Policy Server instances are supported on whole-root zones and sparse-root zones, so long as there is only one Policy Server instance on each whole-root zone or sparse-root zone.
• Policy Server instances are not supported running concurrently on the global zone and on whole-root zones.

Example: Whole-root zone support

Note: Web Agents, however, may run concurrently in any zone.

How to Prepare for the Policy Server Installation

Before you install the Policy Server on a UNIX system, complete the following steps, if applicable:

1. Determine if the Policy Server host system meets the minimum operating system patch requirements. For more information, see the Policy Server Release Notes.
2. (Red Hat Linux) The Red Hat operating system relies on entropy for performance. Increase entropy before installing the component. Without sufficient entropy, the installation can take an exceedingly long time to complete. We recommend that you use the following command to set a symbolic link:

   mv /dev/random /dev/random.org
   

   ln -s /dev/urandom /dev/random
   

3. (Linux) Be sure that the required Linux libraries are installed to the Policy Server host system.
4. Create a New UNIX Account.
5. Modify the UNIX System Parameters.
6. Unset the Localization Variables.
7. Unset the LANG Environment Variable.

Required Linux Libraries

Certain library files are required for components operating on Linux operating environments. Failure to install the correct libraries can cause the following error:

java.lang.UnsatisfiedLinkError 

If you are installing, configuring, or upgrading a Linux version of this component, the following libraries are required on the host system:

Red Hat 5.x:

compat–gcc-34-c++-3.4.6-patch_version.I386

libstdc++-4.x.x-x.el5.i686.rpm

Red Hat 6.x:

libstdc++-4.x.x-x.el6.i686.rpm

Additionally, for Red Hat 6.x (64-bit):

Note: All the RPM packages that are required for 64-bit Red Hat 6.x are 32-bit packages.

libXau-1.0.5-1.el6.i686.rpm

libxcb-1.5-1.el6.i686.rpm

compat-db42-4.2.52-15.el6.i686.rpm

compat-db43-4.3.29-15.el6.i686.rpm

libX11-1.3-2.el6.i686.rpm

libXrender-0.9.5-1.el6.i686.rpm

libexpat.so.1 (provided by expat-2.0.1-11.el6_2.i686.rpm)

libfreetype.so.6 (provided by freetype-2.3.11-6.el6_2.9.i686.rpm)

libfontconfig.so.1 (provided by fontconfig-2.8.0-3.el6.i686.rpm)

libICE-1.0.6-1.el6.i686.rpm

libuuid-2.17.2-12.7.el6.i686.rpm

libSM-1.1.0-7.1.el6.i686.rpm

libXext-1.1-3.el6.i686.rpm

compat-libstdc++-33-3.2.3-69.el6.i686.rpm

compat-db-4.6.21-15.el6.i686.rpm

libXi-1.3-3.el6.i686.rpm

libXtst-1.0.99.2-3.el6.i686.rpm

libXft-2.1.13-4.1.el6.i686.rpm

libXt-1.0.7-1.el6.i686.rpm

libXp-1.0.0-15.1.el6.i686.rpm

Korn Shell (ksh) Package Required on Linux

The ksh Korn shell is required during Policy Server installation and upgrade on Linux platforms. Verify that the appropriate version for your Linux environment is installed.

Red Hat 5.x 32-bit

ksh-20100621-12.el5.i386.rpm

Red Hat 5.x 64-bit

ksh-20100621-12.el5.x86_64.rpm

Red Hat 6.x 32-bit

ksh-20100621-16.el6.i686.rpm

Red Hat 6.x 64-bit

ksh-20100621-16.el6.x86_64.rpm

Create a New UNIX Account

Create a UNIX account with the default shell as ksh. Name the account as follows:

smuser

Important! Do not use the installer to configure the OneView Monitor UI on the following web servers:

• Oracle iPlanet
• Apache on Linux

The installer modifies the configuration files of the web server. The new UNIX account does not have the required root privileges.

After you install the Policy Server, use the Policy Server Configuration Wizard as root to configure the OneView Monitor UI.

Modify the UNIX System Parameters

When the Policy Server is placed under load, it opens a large number of sockets and files. If the default limit parameters are not adequate for the load, a large number of sockets and files can become a problem. Modify the default limit parameters to avoid associated problems.

To view the default limit parameters, type the following command in a shell window:

ulimit -a

The system displays a message similar to the following example:

$ ulimit -a

time(seconds)

unlimited

file(blocks)

unlimited

data(kbytes

2097148

stack(kbytes)

8192

coredump(blocks)

unlimited

nofiles(descriptors)

256

vmemory(kbytes)

unlimited

In the example, the nofiles parameter is set to 256. The parameter is the total number of files (sockets + files descriptors) that this shell and its descendants have been allocated. If this parameter is not set high enough, the Policy Server returns numerous socket errors. The most common socket error is 10024, or too many open files.

Increase the nofiles parameter value for proper Policy Server operation under load. You can change this value by running the following command:

ulimit -n

For example, to set the value to 1024, place the following command in the profile file of the smuser account:

ulimit -n 1024

The Policy Server is bound by the nofiles parameter in the smuser account ulimit for the number of connections to it.

Unset Localization Variables

The LC_* variables are sometimes set by default in the profile file of the smuser account. Use of the LC_* environment variables are not permitted. Unset them before installing the Policy Server.

To unset the LC_* environment variables, open the profile file of the smuser account and unset them.

Unset the LANG Environment Variable

The LANG environment variable is not permitted. Unset it before installing the Policy Server.

To unset the variable, add the unset LANG command to the profile file of the smuser account.

Before You Install the Policy Server

Consider the following items before installing the Policy Server:

• Free space in /tmp—The Policy Server installation requires 3 GB of free space in the /tmp directory.
• System path length—If the system path length exceeds 1024 characters, the Policy Server installation fails. The limitation applies to both included or excluded CA SiteMinder® added directories.

  Note: For best results, we recommend that you install CA SiteMinder® to a location such that the installation path does not exceed 700 characters.

• Telnet or other terminal emulation software—If you are going to install the Policy Server using Telnet or other terminal emulation software, complete the installation using a console window. If you install in GUI Mode, a Java exception occurs and the installer exits.
• Exceed X-windows application—Running the Policy Server installer or the Policy Server Configuration Wizard (ca-ps-config.bin) using an Exceed X-windows application can truncate text in the window. The limitation is due to unavailable fonts in Exceed and has no affect on the Policy Server installation or configuration.
• Environment variables—The Policy Server installation modifies environment variables.

How to Install the Policy Server

To install the Policy Server, complete the following steps:

1. Review the Policy Server component considerations.
2. Review the policy store considerations.
3. Review the FIPS considerations.
4. Gather information for the Policy Server installer.
5. Run the Policy Server installer.
6. (Linux) If Security–Enhanced Linux is enabled, add CA SiteMinder®–specific exceptions.
7. (Optional) If you configured SNMP, restart the SNMP daemon.
8. (Optional) If you do not use the Policy Server installer to configure a policy store, manually configure the policy store.

Policy Server Component Considerations

In addition to the Policy Server, the installer can install and configure the following components. Review the following items before installing the Policy Server:

• OneView Monitor UI

  The OneView Monitor enables the monitoring of CA SiteMinder® components.

  Note: To use the OneView Monitor, you must have the supported Java SDK and ServletExec/AS installed on the system.

• SNMP

  You must have the following items to enable SNMP support:

  • The password of the root user.
  • A native SunSolstice Master Agent.
• Policy store

  Note: The key store and certificate data store are automatically configured and collocated with the policy.

• Audit logs

  You can store audit logs in either a relational database or a text file. After you install the Policy Server, audit logging is set to a text file and not to ODBC by default.

Note: For a list of supported CA and third-party components, refer to the CA SiteMinder® 12.52 Platform Support Matrix on the Technical Support site.

More information:

Locate the Platform Support Matrix

Certificate Data Store

Policy Store

Policy Store Considerations

Consider the following items before running the Policy Server installer or the Policy Server Configuration wizard:

• The Policy Server installer and the Policy Server Configuration wizard can automatically configure one of the following stores as a policy store:
  • Microsoft Active Directory Lightweight Directory Services (AD LDS)

    Note: Be sure that you have met the prerequisites for configuring AD LDS as a policy store.

  • Oracle^® Directory Enterprise Edition (formerly Sun Java^™ System Directory Server)

    Important! The Policy Server installer and the Policy Server Configuration wizard cannot automatically configure a policy store that is being connected to using an SSL connection.

  • Microsoft SQL Server^®
  • Oracle RDBMS
• (RDB policy store) The Policy Server installer or the Policy Server Configuration Wizard use specific database information to create the policy store data source. The Policy Server uses this data source to communicate with the policy store. Consider the following items:
  • The name of data source is CA CA SiteMinder® DSN.
  • The installer saves the data source to the system_odbc.ini file, which is located in siteminder_home/db.

    siteminder_home

    Specifies the Policy Server installation path.

• (RDB policy store) Verify that the database server that is to host the policy store is configured to store objects in UTF–8 form. This configuration avoids possible policy store corruption.
  • (Oracle) Be sure that the database is configured to store objects in UTF–8 form. Oracle supports unicode within many of their character sets. For more information about configuring your database to store objects in UTF–8 form, see your vendor–specific documentation.
  • (SQL Server) Be sure that the database is configured using the default collation (SQL_Latin1_General_CP1_CI_AS). Using a collation that is case–sensitive can result in unexpected behaviors. For more information about configuring your database to store objects using the default collation, see your vendor–specific documentation.
• The certificate data store is automatically collocated with the policy store.
• You manually configure any other supported directory server or relational database as a policy store after installing the Policy Server. Configuring a policy store manually is detailed in this document.

More information:

Configuring CA SiteMinder® Data Stores in a Relational Database

FIPS Considerations

The Policy Server uses certified Federal Information Processing Standard (FIPS) 140-2 compliant cryptographic libraries. FIPS is a US government computer security standard that is used to accredit cryptographic modules that meet the Advanced Encryption Standard (AES). The libraries provide a FIPS mode of operation when a CA SiteMinder® environment only uses FIPS-compliant algorithms to encrypt sensitive data.

You can install the Policy Server in one of the following FIPS modes of operation.

Note: The FIPS mode a Policy Server operates in is system-specific. For more information, see the CA SiteMinder® 12.52 Platform Support Matrix on the Technical Support site.

• FIPS-compatibility mode—The default FIPS mode of operation during the installation is FIPS-compatibility mode. In FIPS-compatibility mode, the environment uses existing CA SiteMinder® algorithms to encrypt sensitive data and is compatible with previous versions CA SiteMinder®:
  • The use of FIPS-compliant algorithms in your environment is optional.
  • If your organization does not require the use of FIPS-compliant algorithms, install the Policy Server in FIPS-compatibility mode. No further configuration is required.
• FIPS-migration mode—FIPS-migration mode lets you transition an 12.52 environment running in FIPS-compatibility mode to FIPS-only mode.

  In FIPS-migration mode, the 12.52 Policy Server continues to use existing CA SiteMinder® encryption algorithms as you migrate the 12.52 environment to use only FIPS-compliant algorithms.

  Install the Policy Server in FIPS-migration mode if you are in the process of configuring the existing environment to use only FIPS-compliant algorithms.

• FIPS-only mode—In FIPS-only mode, the environment only uses FIPS-compliant algorithms to encrypt sensitive data.

  Install the Policy Server in FIPS-only mode if the existing environment is upgraded to 12.52 and the existing environment is configured to use only FIPS-compliant algorithms.

  Important! A 12.52 environment that is running in FIPS-only mode cannot operate with versions of CA SiteMinder® that do not also fully support FIPS (that is, versions before r12.0). This restriction applies to all agents, custom software using older versions of the Agent API, and custom software using PM APIs or any other API that the Policy Server exposes. Relink all such software with the 12.52 versions of the respective SDKs to achieve the required FIPS support.

Note: For more information about migrating an environment to use only FIPS-compliant algorithms, see the Upgrade Guide.

More information:

Locate the Platform Support Matrix

Gather Information for the Installer

The Policy Server installer requires specific information to install the Policy Server and any optional components.

Note: Installation worksheets are provided to help you gather and record information prior to installing or configuring Policy Server components using the Policy Server Installation Wizard or the Policy Server Configuration Wizard. You may want to print these worksheets and use them to record required information prior to running either wizard.

Required Information

Gather the following required information before running the Policy Server installer or the Configuration wizard.

• JRE location—Identify the folder in which the installer can locate the supported JRE. Verify that the JRE is set correctly in the PATH variable. If the JRE is not set correctly in the PATH variable, the installer cannot locate it.
• Policy Server Installation location—Determine where the installer must install the Policy Server.
• Encryption key value—Determine the encryption key value. An encryption key is a case-sensitive, alphanumeric key that secures the data sent between the Policy Server and the policy store. All Policy Servers that share a policy store are required to use the same encryption key. For stronger protection, define a long encryption key.

  Limits: 6 to 24 characters.

• Advanced Authentication Server Encryption key value ‑ Determine the encryption key value. An encryption key is a case–sensitive, alphanumeric key that secures the data sent between the Policy Server and the advanced authentication server (running on the CA SiteMinder® SPS). The CA SiteMinder® SPS and all Policy Servers share the same key. For stronger protection, define a long encryption key.
  Limits: 6 to 24 characters.

Active Directory LDS Server Information

Gather the following required information to configure Microsoft Active Directory LDS as a policy store:

• System IP address—Identify the IP address of the directory server host system.
• Port number—Identify the port number on which the directory server is listening.
• Root DN of the application partition—Identify the root DN location of the application partition in the directory server where the policy store schema data must be installed.

  Example: dc=ca,dc=com

• Administrator domain name—Identify the full domain name, including the guid value, of the directory administrator.

  Example: CN=user1,CN=people,CN=Configuration,CN=guid

• Administrator password—Identify the password of the directory administrator.
• Alternate user account—By default, CA SiteMinder® uses the administrator account to communicate with the directory server. However, you can use a different user account to administer the policy store. Identify the complete administrator DN and password to configure CA SiteMinder® to use an alternative user account to administer the policy store.

  Note: This user must have the necessary permissions to modify attributes and change passwords.

• CA SiteMinder® superuser password—The default CA SiteMinder® superuser account has maximum permissions. Determine the password for the default superuser account. The name of the default account is:

  siteminder
  

  Limits:

  • The password must contain at least six (6) characters and cannot exceed 24 characters.
  • The password cannot include an ampersand (&) or an asterisk (*).
  • If the password contains a space, enclose the passphrase with quotation marks.

  Note: We recommend that you do not use the default superuser for day-to-day operations. Rather, use the default superuser to access the Administrative UI for the first–time and then create an administrator with superuser permissions.

Oracle Directory Server Information

Gather the following required information to configure Oracle Directory Server to function as a policy store:

• System IP address—Determine the IP address of the Oracle Directory Server host system.
• Directory instance port number—Determine the port number for the Oracle Directory Server instance.

  Default: 389

• Root DN—Identify the root DN of the Oracle Directory Server.

  Example: o=yourorg.com

• Administrator account—Identify the user name (Bind DN) for the LDAP administrator account.

  Example: cn=Directory Manager

• Administrator password—Identify the password for the Oracle Directory Server administrator.
• Alternate LDAP administrator—By default, CA SiteMinder® uses the LDAP administrator account to communicate with the LDAP server. However, you can use a different LDAP user account to administer the policy store. Identify the complete administrator DN and password to configure CA SiteMinder® in this way.

  Note: This user must have the necessary permissions to modify attributes and change passwords.

• CA SiteMinder® superuser password—The default CA SiteMinder® superuser account has maximum permissions. Determine the password for the default superuser account. The name of the default account is:

  siteminder
  

  Limits:

  • The password must contain at least six (6) characters and cannot exceed 24 characters.
  • The password cannot include an ampersand (&) or an asterisk (*).
  • If the password contains a space, enclose the passphrase with quotation marks.

  Note: We recommend that you do not use the default superuser for day-to-day operations. Rather, use the default superuser to access the Administrative UI for the first–time and then create an administrator with superuser permissions.

Microsoft SQL Server Information

To configure Microsoft SQL Server as a policy store, gather the following required information:

Database server name

Identify the IP address or name of the database host system.

Note: For more information about IPv6 support, see the CA SiteMinder® Platform Support Matrix.

Database name

Identify the named instance or the name of the database that is to function as the policy store.

Database port

Identify the port on which the database is listening.

Database administrator user name and password

Identify the name and password of an administrator account with permission to do the following operations:

• Create schema
• Create, read, modify, and delete objects.

Note: If the CA SiteMinder® schema is already present in the database, the wizard does not require the credentials of a database administrator with create permission. For more information, see Configure a SQL Server Policy Store.

CA SiteMinder® superuser password

The default CA SiteMinder® superuser account has maximum permissions. Determine the password for the default superuser account. The name of the default account is:

siteminder

Limits:

• The password must contain at least six (6) characters and cannot exceed 24 characters.
• The password cannot include an ampersand (&) or an asterisk (*).
• If the password contains a space, enclose the passphrase with quotation marks.

Note: We recommend that you do not use the default superuser for day-to-day operations. Rather, use the default superuser to access the Administrative UI for the first–time and then create an administrator with superuser permissions.

Oracle RDBMS Information

Gather the following required information to configure Oracle RDBMS as a policy store.

Database server name

Identify the IP address or the name of the database host system.

Note: For more information about IPv6 support, see the CA SiteMinder® Platform Support Matrix.

Database service name

Identify the service name of the database that is to function as the policy store.

Database port

Identify the port on which the database is listening.

Database administrator user name

Identify the name of an administrator account with permission to do the following operations:

• Create schema
• Create, read, modify, and delete objects.

Database administrator password

Identify the password of the administrator account.

CA SiteMinder® superuser password

The default CA SiteMinder® superuser account has maximum permissions. Determine the password for the default superuser account. The name of the default account is:

siteminder

Limits:

• The password must contain at least six (6) characters and cannot exceed 24 characters.
• The password cannot include an ampersand (&) or an asterisk (*).
• If the password contains a space, enclose the passphrase with quotation marks.

Note: We recommend that you do not use the default superuser for day-to-day operations. Rather, use the default superuser to access the Administrative UI for the first–time and then create an administrator with superuser permissions.

OneView Monitor Information

You only have to gather OneView Monitor information if you plan on configuring the OneView Monitor.

Gather the following required information to configure the OneView Monitor. You can use the OneView Monitor Information Worksheet to record your values.

• JDK path—Identify the path to the required JDK version.
• ServletExec installation directory—Identify ServletExec installation directory.

  Example: /usr/local/NewAtlanta/ServletExecAS

• ServletExec port number—Determine the port number for the ServletExec instance.
• Sun Java System administrator directory—Determine the following information:
  • The installed location of the Sun Java System.
  • The installed location of the Sun Java System Web servers.

  Example: /sunjavasystem_home/location

  sunjavasystem home

  Specifies the installed location of the Sun Java System.

  location

  Specifies the installed location of the Sun Java System Web servers.

• Multiple ServletExec instances—If you have multiple ServletExec instances, determine the instance to which you want to configure the OneView Monitor GUI.

Install the Policy Server in GUI Mode

Install the Policy Server using the installation media on the Technical Support site. Consider the following items:

• Be sure that you have executable permissions. To add executable permissions to the installation media, run the following command:

  chmod +x installation_media
  

  installation_media

  Specifies the Policy Server installer executable.

• If you execute the Policy Server installer across different subnets, it can crash. Install the Policy Server directly on the host system to avoid the problem.

Follow these steps:

1. Exit all foreground applications.
2. Open a shell and navigate to the installation media.
3. Enter the following command:

   ./ca-ps-12.5-cr-unix_version
   

   cr

   Specifies the cumulative release number. The base r12.5 release does not include a cumulative release number.

   unix_version

   Specifies the UNIX version: sol or linux.

   The installer starts.

   Note: For a list of installation media names, see the Policy Server Release Notes.

4. Use the system and component information you have gathered to install the Policy Server.

   Consider the following items when running the installer:

   • If you are installing the Policy Server for the first–time on this system, do not configure the OneView Monitor UI. The installer modifies the configuration files of the web server that is to host the UI. The smuser account does not have the required root privileges. After you install the Policy Server, use the Policy Server Configuration Wizard as root to configure the OneView Monitor UI.
   • The installer prompts you to select a FIPS mode of operation. For more information about which FIPS mode to select, see FIPS Considerations.
   • If you are configuring a policy store manually, clear the Policy Store option when selecting components. For more information about which stores can be automatically configured as a policy store, see Policy Store Considerations.
   • If you are initializing a policy store, you are prompted to enter a password for the default CA SiteMinder® user account. The default account name is:

     siteminder
     

   • You are prompted to install the default certificate authority (CA) certificates to the certificate data store. You can add additional certificates and private keys to the certificate data store after installation.
   • If you are using IPv6 addresses, surround entries with brackets.

     Example:

     [2001:db8::1428:57ab]
     

   • If you cut and paste path information into the wizard, enter a character to enable the Next button.
5. Review the installation settings and click Install.

   The Policy Server and all selected components are installed and configured.

   Note: The installation can take several minutes.

6. Click Done.

   The installer closes.

7. (Optional) If you did not use the installer to configure a policy store, manually configure the policy.

Note: If you experience problems during the installation, you can locate the installation log file and the policy store details file in siteminder_home/siteminder/install_config_info.

siteminder_home

Specifies the Policy Server installation path.

More information:

Locate the Installation Media

Troubleshoot the Policy Server Installation

Installation Media Names

Install the Policy Server in Console Mode

Install the Policy Server using the installation media on the Technical Support site. Consider the following items:

• Be sure that you have executable permissions. To add executable permissions to the installation media, run the following command:

  chmod +x installation_media
  

  installation_media

  Specifies the Policy Server installer executable.

• If you execute the Policy Server installer across different subnets, it can crash. Install the Policy Server directly on the host system to avoid the problem.

Follow these steps:

1. Exit all applications that are running.
2. Open a shell and navigate to the installation media.
3. Run the following command:

   ./ca-ps-12.5-cr-unix_version -i console
   

   cr

   Specifies the cumulative release number. The base r12.5 release does not include a cumulative release number.

   unix_version

   Specifies the UNIX version: sol or linux.

   The installer starts.

   Note: For a list of installation media names, see the Policy Server Release Notes.

4. Use the system and component information you have gathered to install the Policy Server.

   Consider the following items when entering information:

   • If you are installing the Policy Server for the first–time on this system, do not configure the OneView Monitor UI. The installer modifies the configuration files of the web server that is to host the UI. The smuser account does not have the required root privileges. After you install the Policy Server, use the Policy Server Configuration Wizard as root to configure the OneView Monitor UI.
   • The installer prompts you to select a FIPS mode of operation. For more information about which FIPS mode to select, see FIPS Considerations.
   • The installer prompts you to select components you want to configure. Separate entries with commas (,). To select none of the features, enter only a comma.
   • If you are configuring a policy store manually, do not select Policy Store. For more information about which stores can be automatically configured as a policy store, see Policy Store Considerations.
   • If you are initializing a policy store, you are prompted to enter a password for the default CA SiteMinder® user account. The default account name is:

     siteminder
     

   • You are prompted to install the default certificate authority (CA) certificates to the certificate data store. You can add additional certificates and private keys to the certificate data store after installation.
   • If you are using IPv6 addresses, surround entries with brackets.

     Example:

     [2001:db8::1428:57ab]
     

   • Only initialize the policy store when configuring a new policy store instance.
5. Review the installation settings and press Enter.

   The Policy Server and all selected components are installed and configured.

   Note: The installation can take several minutes.

6. Press Enter.

   The installer closes.

7. (Optional) If you did not use the installer to configure a policy store, manually configure the policy.

Note: If you experience problems during the installation, you can locate the installation log file and the policy store details file in siteminder_home/siteminder/install_config_info.

siteminder_home

Specifies the Policy Server installation path.

More information:

Locate the Installation Media

Troubleshoot the Policy Server Installation

Installation Media Names

Add Exceptions to Security–Enhanced Linux

If Security–Enhanced Linux is enabled on the Policy Server host system, add CA SiteMinder®–exceptions to the environment. Adding the exceptions prevents Security–Enhanced Linux text relocation denials.

Follow these steps:

1. Log in to the Policy Sever host system.
2. Open a shell and run the following command:

   chcon -t textrel_shlib_t /siteminder_home/lib/*
   

   siteminder_home

   Specifies the Policy Server installation path.

3. Run the following command:

   chcon -t textrel_shlib_t /JDK_home/lib/i386/*
   

   JDK_home

   Specifies the required JDK installation path.

4. Run the following command:

   chcon -t textrel_shlib_t /JDK_home/lib/i386/server/*
   

   JDK_home

   Specifies the required JDK installation path.

   CA SiteMinder®–specific exceptions have been added.

Troubleshoot the Policy Server Installation

Use the following files to troubleshoot the Policy Server installation:

• CA_SiteMinder_Policy_Server_release_InstallLog.log

  The installation log contains a summary section that lists the number of successes, warnings, non–fatal errors, and errors that occurred during the installation. Individual installation actions are listed with the respective status.

  release

  Specifies the Policy Server release.

  Location: siteminder_home\siteminder\install_config_info

• ca-ps-details.log

  The policy store log details the policy store status.

  Location: siteminder_home\siteminder\install_config_info

• smps.log

  The smps.log is created when you start the Policy Server. This log contains the following line if the Policy Server installed successfully:

  [Info] Journaling thread started, will delete commands older than 60 minutes.
  

  Location: siteminder_home\siteminder\log

  siteminder_home

  Specifies the Policy Server installation path.

Restart the SNMP Daemon

You only have to restart the SNMP daemon if you configured SNMP during the Policy Server installation.

To restart the SNMP daemon

1. Enter S76snmpdx stop in /etc/rc3.d.

   The SNMP daemon stops.

2. Enter S76snmpdx start in /etc/rc3.d.

   The SNMP daemon starts.

Configure a Policy Store

If you did not use the Policy Server installer to configure a policy store automatically, manually configure a supported LDAP directory server or relational database as a policy store.

Configure Auto Startup

You configure auto startup to ensure that the Policy Server restarts automatically when the UNIX system is rebooted.

Follow these steps:

1. Modify the S98M script by replacing every instance of the string “nete_ps_root” with an explicit path to the SiteMinder installation directory.

   Example: /export/ca/siteminder

2. Change the directory to the siteminder installation directory.
3. Enter su and press ENTER.

   Note: Do not use the suse command.

   You are prompted for a password.

4. Enter the root password and press ENTER.
5. Enter $ cp S98sm /etc/rc2.d and press ENTER.

   s98sm automatically calls the stop-all and start-all executables, which stop and start the Policy Server service when the UNIX system is rebooted.

Note: If you are using a local LDAP directory server as a policy store, you must configure the LDAP directory to start automatically before starting the Policy Server automatically.

Unattended Policy Server Installation

After the Policy Server is manually installed on one machine, you can reinstall it or install it on a separate machine using an unattended installation mode. An unattended installation lets you install or uninstall the Policy Server without any user interaction.

The installer provides a ca-ps-installer.properties template file that lets you define installation variables. The default parameters, passwords, and paths in this file reflect the information you entered during the initial Policy Server installation. In this file, you can either store encrypted or plain text passwords. If you are using encrypted passwords, for example, a shared secret and CA SiteMinder® Super User, you must use the same ones that you entered during the initial installation since they are encrypted in the file and cannot be modified. However, you can use plain text passwords by modifying the file.

More information:

How to Run an Unattended Policy Server Install