Installation and Upgrade Guides › Web Agent Installation Guide for IIS › Configure a SiteMinder Agent for IIS or Web Agent on an IIS Web Server › How to Configure a SiteMinder Agent for IIS Manually › Run the smreghost.exe Command on your IIS 7.x Web Server

Run the smreghost.exe Command on your IIS 7.x Web Server

The SiteMinder Web Agent Configuration wizard, and the silent/unattended configuration mode register Web Agents as trusted hosts with SiteMinder Policy Servers.

For manual configurations of SiteMinder Web Agents, run the following command to register a trusted host:

web_agent_home\bin\smreghost.exe

web_agent_home

Indicates the directory where the SiteMinder Agent is installed on your web server.

Default (Windows 32-bit installations of SiteMinder IIS Web Agents only): C:\Program Files\CA\webagent

Default (Windows 64-bit installations [SiteMinder Web Agents for IIS only]): C:\Program Files\CA\webagent\win64

Default (Windows 32-bit applications operating on 64-bit systems [Wow64 with SiteMinder Web Agents for IIS only]): C:\Program Files (x86)\webagent\win32

To run the smreghost.exe command on your IIS 7.x web server

1. Open a command prompt window.

   Important! Before running a SiteMinder utility or executable on Windows Server 2008, open the command line window with administrator permissions. Open the command line window this way, even if your account has administrator privileges.

2. Run the smreghost command. Use the information from your Web Agent Configuration worksheet as values for the following arguments:

   Note: Separate each command argument from its value with a space. Surround any values that contain spaces with double quotes (").

   -i policy_server_IP_ address:port

   Indicates the IP address of the Policy Server where you are registering this host. Specify the port of the authentication server only if you are not using the default port.

   If you specify a port number, which can be a non-default port, that port is used for all three Policy Server processes (authentication, authorization, accounting). The Policy Server responds to any Agent request on any port.

   Use a colon between the IP address and non-default port number, as shown in the following examples.

   Default: (ports) 44441,44442,44443

   Example: (IPv4 non-default port of 55555) -i 127.0.0.1:55555

   Example: (IPv4 default ports) -i 127.0.0.1

   Example: (IPv6 non-default port of 55555) -i [2001:DB8::/32][:55555]

   Example: (IPv6 default ports) -i [2001:DB8::/32]

   -u administrator_username

   Indicates the name of the SiteMinder administrator with the rights to register a trusted host.

   -p Administrator_password

   Indicates the password of the Administrator who is allowed to register a trusted host.

   -hn hostname_for_registration

   Indicates the name of the host to be registered. This can be any name that identifies the host, but it must be unique. After registration, this name is placed in the Trusted Host list in the Administrative UI.

   -hc host_config_object

   Indicates the name of the Host Configuration Object configured at the Policy Server. This object must exist on the Policy Server before you can register a trusted host.

   -sh shared_secret

   Specifies the shared secret for the agent, which is stored in the SmHost.conf file on the local web server. This argument changes the shared secret on only the local web server. The Policy Server is not contacted.

   -rs

   Specifies whether the shared secret will be updated (rolled over) automatically by the Policy server. This argument instructs the Policy Server to update the shared secret.

   -f path_to_host_config_file

   (Optional) Indicates the full path to the file that contains the registration data. The default file is SmHost.conf. If you do not specify a path, the file is installed in the location where you are running the smreghost tool.

   If you use the same name as an existing host configuration file, the tool backs up the original and adds a .bk extension to the backup file name.

   -cf FIPS mode

   Specifies one of the following FIPS modes:

   • COMPAT--Specifies non-FIPS mode, which lets the Policy Server and the Agents read and write information using the existing SiteMinder encryption algorithms. If your organization does not require the use of FIPS-compliant algorithms, the Policy Server and the Agents can operate in non-FIPS mode without further configuration.
   • MIGRATE--Specifies FIPS-migration mode, which is used when you are upgrading an earlier version of SiteMinder to full-FIPS mode. The Policy Server and the Agents continue to use the existing SiteMinder encryption algorithms as you migrate your environment to use only FIPS 140-2 approved algorithms.
   • ONLY--Specifies full-FIPS mode, which requires that the Policy Server and Web Agents read and write information using only FIPS 140-2 algorithms.

   Important! A SiteMinder installation that is running in Full FIPS mode cannot interoperate with, or be backward compatible to, earlier versions of SiteMinder, including all agents, custom software using older versions of the Agent API, and custom software using PM APIs or any other API that the Policy Server exposes. You must re-link all such software with the corresponding versions of the respective SDKs to achieve the required support for Full FIPS mode.

   If this switch is not used, or you use the switch without specifying a mode, the default setting is used.

   Default: COMPAT

   Note: More information on the FIPS Certified Module and the algorithms being used; the data that is being protected; and the SiteMinder Cryptographic Boundary exists in the Policy Server Administration Guide.

   -o

   Overwrites an existing trusted host. If you do not use this argument, you will have to delete the existing trusted host with the Administrative UI before using the smreghost command. We recommend using the smreghost command with this argument.

   Your Web Agent is registered as a trusted host.