Policy Server Guides › Policy Server Configuration Guide › Administrative User Interface Management › SiteMinder Administrators › Restoring Administrator Access

Restoring Administrator Access

An administrator with full access to the Policy Server can restore permissions when an administrator account becomes inadvertently modified or deleted. The two administrators with these permissions include the following:

• The default SiteMinder super user account (siteminder). If you are using the policy store to store administrator identities, use the siteminder account to restore permissions.
• The super user account that is established when the external administrator store connection is configured. If you are using an external store to store administrator identities, use the external super user to restore permissions.

If you cannot access the default administrator accounts, do the following:

• Use the smreg utility to change the password of the default SiteMinder super user account.
• Use the XPSSecurity utility to make any user in the external administrator store a super user.

  Note: For more information about using either utility, see the Policy Server Administration Guide.

How the Web Agent and Policy Server Calculate Time

For each system that has a Policy Server or Web Agent installed, you must set the system clock for the time zone appropriate to that system’s geographical location. Policy Servers and Web Agents use the time zones to calculate time relative to Greenwich Mean Time (GMT).

The following figure shows how the Policy Server executes a policy relative to time. A resource is stored on a Web Server in Massachusetts and is protected by a Policy Server in California. The policy allows access to the resource between 9:00 a.m. and 5:00 p.m. However, the user in Massachusetts can still access the resource at 6:00 p.m. because the policy is based on the Policy Server’s time zone, Pacific Standard Time (PST), which is 3 hours behind the Web Agent’s time zone, Eastern Standard Time (EST).

Note: For Windows systems, the time zone and the time of day that you set in the Date/Time control panel must agree. For example, to reset a system in the USA from Eastern Standard Time to Pacific Time, you must set the system’s clock back three hours and change the time zone to Pacific Standard Time. If these two settings do not match, single sign-on across multiple domains and agent key management will not work properly.