Web Services Security Guides › CA SiteMinder® Agent for JBoss › Install the SiteMinder Agent › Installation Overview

Installation Overview

The following sections describe how to install the SiteMinder Agent for JBoss on Windows and UNIX platforms. The SiteMinder Agent installation includes the following security interceptors:

• Web Application Security Interceptor (SiteMinder functionality)
• Web Service Interceptor (SOA Security Manager functionality)

Note: All components of both interceptors are installed when you run the SiteMinder Agent installation. However, you need only configure the interceptor modules that you want to use.

Install Preparation

Before you install a SiteMinder Agent for JBoss, there are a number of pieces of information you will need and requirements that must be met.

Locate the Platform Support Matrix

Use the Platform Support Matrix to verify that the operating environment and other required third-party components are supported.

Follow these steps:

1. Log in to the CA Support site.
2. Locate the Technical Support section.
3. Enter CA SiteMinder® in the Product Finder field.

   The CA SiteMinder® product page appears.

4. Click Product Status, CA SiteMinder® Family of Products Platform Support Matrices.
5. Locate the SiteMinder Agent for Application Servers 12.52 entry and open open the associated PDF file.

Note: You can download the latest JDK and JRE versions at the Oracle Developer Network.

Software Requirements

Supported versions of the following software are always required before you install the SiteMinder Agent.

• JBoss Enterprise Application Platform. For hardware and software requirements, see the JBoss Enterprise Application Platform documentation.
• One of the following Policy Servers:
  • SiteMinder Policy Server (for web application protection)
  • Policy Server (for web service and, if also licensed for SiteMinder, web application protection)
• Java virtual machine (JVM) with the path to the JVM present in the host environment. For example, on UNIX systems, if the JVM is not in the PATH variable, run the following commands:

  PATH=$PATH:JVM/bin
  export PATH
  

  JVM

  Specifies the location of your Java virtual machine (for example /opt/jre1.5.0_06/bin).

To use the SiteMinder Agent Web Interceptor to validate identities obtained from SiteMinder session cookies during perimeter authentication, the following software is also required:

• SiteMinder Web Agent
• A web server and proxy plug-in supported by SiteMinder and JBoss

  For supported web servers and proxy plug-ins, see:

  • Platform Support Matrices on the Technical Support site.
  • Supported Configurations for JBoss Enterprise Application Platform in the JBoss Enterprise Application Platform documentation.

The following illustration shows where each of these software components is installed in an environment that uses SiteMinder SSO-based perimeter authentication.

For a complete list of supported software, operating systems, Java environments, and prerequisite A product versions, refer to the SiteMinder Agent for Application Servers Platform Support Matrix on the Technical Support site.

Installation Checklist

To install the CA SiteMinder® Agent for JBoss, complete all the steps in the following table. To help ensure proper configuration, follow the steps in order.

Additional Steps for SiteMinder Agent Security Interceptor Installations

Complete the steps outlined in the following table to use the SiteMinder Agent Security Interceptor to validate SiteMinder session cookies obtained by perimeter authentication.

Installation Location References

The following references to the installed location of SiteMinder Agent and JBoss software are used throughout this guide:

SMAGENT_HOME

Refers to the installed location of the SiteMinder Agent for JBoss.

The default location is:

• C:\Program Files\CA\JBossAgent (Windows)
• /CA/JBossAgent (UNIX)

JBOSS_HOME

Refers to the installed location of the JBoss Application Server.

For example, the default location for JBoss Enterprise Application Platform 4.3 is:

• C:\jboss-eap-4.3\jboss-as on Windows
• /jboss-eap-4.3/jboss-as on UNIX

Preconfigure Policy Objects for the SiteMinder Agent

This section describes how to preconfigure policy objects for the SiteMinder Agent for JBoss on the Policy Server.

Policy Object Preconfiguration Overview

Before you install the SiteMinder Agent for JBoss, the Policy Server must be installed and be able to communicate with the system where you plan to install the SiteMinder Agent. Additionally, configure the Policy Server with the following:

• An administrator that has the right to register trusted hosts

  A trusted host is a client computer where one or more SiteMinder Agents are installed. The term trusted host refers to the physical system. There must be an administrator with permission to register trusted hosts with the Policy Server.

  To configure an administrator, see the Administrators chapter of the SiteMinder Policy Server Configuration Guide.

• Agent object/Agent identity

  An Agent object creates an Agent identity by assigning the Agent a name. You define an Agent identity from the Agents object in the Administrative UI. You assign the Agent identity a name and specify the Agent type as a Web Agent.

  The name you assign for the Agent is the same name you specify in the DefaultAgentName parameter for the Agent Configuration Object that you must also define to centrally manage an Agent.

• Host Configuration Object

  This object defines the communication between the trusted host and the Policy Server after the initial connection between the two is made.

  A trusted host is a client computer where one or more SiteMinder Agents can be installed. The term trusted host refers to the physical system, in this case the JBoss Application Server host.

  Do not confuse this object with the trusted host's configuration file, SmHost.conf, which is installed at the trusted host after a successful host registration. The settings in the SmHost.conf file enable the host to connect to a Policy Server for the first connection only. Subsequent connections are governed by the Host Configuration Object.

  For more information, see the SiteMinder Policy Server Configuration Guide.

• Agent Configuration Object

  This object includes the parameters that define the SiteMinder Agent configuration. There are a few required parameters you must set for basic operation.

  The Agent Configuration Object must include a value for the DefaultAgentName parameter. This entry should match an entry you defined in the Agent object.

  For more information, see the SiteMinder Policy Server Configuration Guide.

Preconfigure the Policy Objects

The following is an overview of the configuration procedures to perform on the Policy Server before installing the Agent software:

1. Duplicate or create a new Host Configuration Object, which holds initialization parameters for a Trusted Host. (If upgrading from an earlier Agent install, you can use the existing Host Configuration object).

   The Trusted Host is a server that hosts one or more Agents and handles their connection to the Policy Server.

2. As necessary, add or edit Trusted Host parameters in the Host Configuration Object that you just created.
3. Create an Agent identity for the SiteMinder Agent for JBoss. Select Web Agent as the Agent type for the SiteMinder Agent for JBoss.

   Note: If you are using SiteMinder SSO-based perimeter authentication to validate identities obtained from SiteMinder session cookies, configure separate Agents identities for the SiteMinder Agent for JBoss and the Web Agent on the proxy server.

4. Duplicate an existing or create a new Agent Configuration Object, which holds Agent configuration parameters and can be used to centrally configure a group of Agents.
5. In the Agent Configuration Object you created, verify that the DefaultAgentName parameter is set to specify the Agent identity defined in Step 3.

Apply the Unlimited Cryptography Patch to the JRE

Patch the Java Runtime Environment (JRE) used by the Agent to support unlimited key strength in the Java Cryptography Extension (JCE) package. The patches for all supported platforms are available from the Oracle website.

The files that need to be patched are:

• local_policy.jar
• US_export_policy.jar

The local_policy.jar and US_export_policy.jar files can found be in the following locations:

• Windows

  jre_home\lib\security

• UNIX

  jre_home/lib/security

jre_home

Defines the location of your Java Runtime Environment installation.