Need asssitance on openSSO/Access Manager-policy agent on tomcat 5.5

I'm asking here because there is no help from openSSO forum.
I know that openSSO is quite the same with java access manager,
so I assume that openSSO is identical to java access manager.
I'm very much new to the policy agent and I've tried to test it for my own web application, but it doesn't seems to work.
Here is my situation :
I'm using 2 servers:
1. server using windows XP, installed with tomcat 5.5 and opensso inside (acts as openSSO server).
I set the IP to be 192.168.0.3 and tomcat web server will be listening on port 8080
2. server using windows XP, installed with tomcat 5.5 and my web application inside, and the policy agent.
I set the IP to be 192.168.0.1 and tomcat web server will be listening on port 7070
my web application is named "akademis" and I can acess it with the usual method on address http://192.168.0.1:7070/akademis.
I install the policy agent on global web.xml of tomcat configuration and I don't change anything on web.xml of my application.
when I tried to acess the http://192.168.0.1:7070/akademis , I wa redirected to openSSO login page correctly and I entered username and password(username:amadmin). I passed the login page and being redirected to the page that I wanted, but it doesn't do correctly cause I got a HTTP message of 403 (forbidden).
I got some clue in the policy agent logs :
a. the amFilter log
09/30/2006 01:08:25:890 PM ICT: Thread[http-7070-Processor25,5,main]
09/30/2006 01:09:14:515 PM ICT: Thread[http-7070-Processor25,5,main]
ERROR: URLFailoverHelper: No URL is available at this time
09/30/2006 01:09:14:515 PM ICT: Thread[http-7070-Processor25,5,main]
ERROR: AmFilter: Error while delegating to inbound handler: SSO Task Handler, access will be denied
[AgentException Stack]
com.sun.identity.agents.arch.AgentException: No URL is available at this time
at com.sun.identity.agents.common.URLFailoverHelper.getAvailableURL(URLFailoverHelper.java:133)
at com.sun.identity.agents.filter.AmFilterRequestContext.getLoginURL(AmFilterRequestContext.java:748)
at com.sun.identity.agents.filter.AmFilterRequestContext.getAuthRedirectURL(AmFilterRequestContext.java:285)
at com.sun.identity.agents.filter.AmFilterRequestContext.getAuthRedirectURL(AmFilterRequestContext.java:258)
at com.sun.identity.agents.filter.AmFilterRequestContext.getAuthRedirectResult(AmFilterRequestContext.java:363)
at com.sun.identity.agents.filter.AmFilterRequestContext.getAuthRedirectResult(AmFilterRequestContext.java:345)
at com.sun.identity.agents.filter.SSOTaskHandler.doSSOLogin(SSOTaskHandler.java:210)
at com.sun.identity.agents.filter.SSOTaskHandler.process(SSOTaskHandler.java:98)
at com.sun.identity.agents.filter.AmFilter.processTaskHandlers(AmFilter.java:185)
at com.sun.identity.agents.filter.AmFilter.isAccessAllowed(AmFilter.java:152)
at com.sun.identity.agents.filter.AmAgentBaseFilter.doFilter(AmAgentBaseFilter.java:38)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:202)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:213)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:178)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:126)
at org.apache.catalina.cluster.tcp.ReplicationValve.invoke(ReplicationValve.java:346)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:105)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:107)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:148)
at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:869)
at org.apache.coyote.http11.Http11BaseProtocol$Http11ConnectionHandler.processConnection(Http11BaseProtocol.java:664)
at org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket(PoolTcpEndpoint.java:527)
at org.apache.tomcat.util.net.LeaderFollowerWorkerThread.runIt(LeaderFollowerWorkerThread.java:80)
at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:684)
at java.lang.Thread.run(Thread.java:595)
b. the amLog
09/30/2006 01:08:09:921 PM ICT: Thread[main,5,main]
09/30/2006 01:08:10:078 PM ICT: Thread[main,5,main]
ERROR: RemoteHandler.getLogHostURL(): 'null' is malformed. null
I think the reson that I failed is not in the openSSO/java access manager, because I get passed the login page, and also in the amFilter log of the policy agent I see an error of "No URL is available at this time" .
Is there anyone can help me on this problem ? I'll be very glad if somebody can help me.
thanks

Please try the fix as suggested in the following and let us know the results.
http://support.microsoft.com/default.aspx?scid=kb;EN-US;196271
http://forum.java.sun.com/thread.jspa?threadID=346820&messageID=1436761
Thanks,
Subba

Similar Messages

Access Manager Policy Agent and Oracle AS

Hi,
my system uses Oracle Application Server. The security dept use Sun Access Manager. I need to integrate the security of the Oracle system with the policy agent. Where this gets a little confusing is that one of my developers tells me that this is difficult to implement and that Sun arent planning on supporting the Oracle AS in future.
What I would like is some clarification from the horses mouth so to speak. In particular is it possible to integrate the policy agent and Oracle AS, and are Sun committed to supporting and developing for this.
Thanks,
Andy.

"Where this gets a little confusing is that one of my developers tells me that this is difficult to implement"
"it is NOT an implementation but an integration ! difficult ? why ?"
"and that Sun arent planning on supporting the Oracle AS in future."
There is a PA 2.2 for Oracle 10g ! It is the latest version(2.2 I mean). I don't see any reasons why Sun should not continue. But it is ONLY my point of view...
"What I would like is some clarification from the horses mouth so to speak. In particular is it possible to integrate the policy agent and Oracle AS, and are Sun committed to supporting and developing for this."
Of course it is possible because you can find the PA that will integrate your Oracle AS with a Sun AM.
1) Please read the documentation.
http://docs.sun.com/app/docs/coll/1322.1
Download the one for Oracle and read also the user guide.
PA are very easy to integrate if you know what you do... Espec. und. the AM auth and sso... If you can be helped by a AM guy from your comp. it is welcome... It is a j2ee agent and of course the PA will make what is necessary to redirect you to AM at login time and later to auth. your request...2)
2) Download the soft and do the job :-)
Product Downloads
Sun Java System Access Manager Policy Agent 2.2 for Oracle Application Server 10g
http://www.sun.com/download/products.xml?id=455d52ed
I did plenty of int. with Sun/Bea/Tomcat AS(don't forget there are also webserver agents like Apache PA) with AM and it is not a big deal. Not Oracle, but it is an AS and I don't see why it should be difficult...
Hope this helps a bit.

Access Manager Policy Agent 2.2

Hello
Has anyone experienced the error noted below. This is occurring after Access Manager has validated the
user and redirected the request back to the agent on the protected box.
PolicyEngine: am_policy_evaluate: InternalException in Service::do_update_policy with error message:Policy query failed. and code:6
PolicyAgent: validate_session_policy() status: Access Manager policy service failure (6)
Any help will be greatly appreciated.

Hi,
Are you using a 2.1 agent ? If yes are you using a custom Authentication module ? try setting the com.sun.am.policy.am.library.loginURL if needed. Also check for valid certs if you are using ssl

NSAPI in Access Manager & Policy Agent

Hi all,
May I know is it possible to use NSAPI to be a communication channel between policy agent and access manager?
I have installed Sun One Web Server together with policy agent, access manager is installed in another machine.
I've looked through all related documentation but could not find NSAPI for policy agent or access manager.
Thanks in advance!

Hi all,
May I know is it possible to use NSAPI to be a communication channel between policy agent and access manager?
I have installed Sun One Web Server together with policy agent, access manager is installed in another machine.
I've looked through all related documentation but could not find NSAPI for policy agent or access manager.
Thanks in advance!

Sun Access Manager,Policy Agent 2.2, IIS7?

Hello everybody
Is it possible to protect IIS7 with policy agent 2.2 and Sun Access Manager 7.1?
Policy Agents 3.0 (for Open SSO) works with Sun Access Manager 7.1?
regards!
Alex Dávila

Tanks handat
I found
http://download.oracle.com/docs/cd/E19575-01/820-5816/galtf/index.html
http://download.oracle.com/docs/cd/E19681-01/821-0267/gfxhz.html#scrolltoc
greetings
alex davila

Chaining Access Manager Policy Agents

Hi,
Can we chain access manager agents, so we can pass the authentication details on to other apache server web agents.
Step 1 - to configure a reverse proxy which uses the Access Manager & Agent to authenticate (This works ok)..
The reverse proxy directs to a Secure Global Desktop (SGD) server which i want to use the above authentication.
Step 2 - get the SGD server authenticating with Access Manager and the Apache Web Agent (this works ok).
Step 3 - My question is can the web agent on the back end SGD server use the authentication credentials from the initial Reverse Proxy Access manager log in?
This is what i am seeing at the moment.
- I login to the reverse proxy via Access Manager and it then picks a back end SGD server.
- It then looks like the Access Manager sits there trying to connect to the SGD server.
- When it times out the URL in the browser is a bit confusing.. Its https://<sgd server>:<reverse proxy port> The port should be the sgd server port.
It looks like the AM credentials and environment are ok (iPlanetDirectoryPro and REMOTE_USER).. because after it times out trying to connect to the sgd server with the wrong port number, I change this to be the correct SGD server address in the browser, and it automatically logs in like in Step 2 above.
So my question really is can the authentication details provided at the first level apache web agent be passed down to other apache web server agents running on other servers?
Any ideas.
Thanks,
Carl

Hi,
Can we chain access manager agents, so we can pass the authentication details on to other apache server web agents.
Step 1 - to configure a reverse proxy which uses the Access Manager & Agent to authenticate (This works ok)..
The reverse proxy directs to a Secure Global Desktop (SGD) server which i want to use the above authentication.
Step 2 - get the SGD server authenticating with Access Manager and the Apache Web Agent (this works ok).
Step 3 - My question is can the web agent on the back end SGD server use the authentication credentials from the initial Reverse Proxy Access manager log in?
This is what i am seeing at the moment.
- I login to the reverse proxy via Access Manager and it then picks a back end SGD server.
- It then looks like the Access Manager sits there trying to connect to the SGD server.
- When it times out the URL in the browser is a bit confusing.. Its https://<sgd server>:<reverse proxy port> The port should be the sgd server port.
It looks like the AM credentials and environment are ok (iPlanetDirectoryPro and REMOTE_USER).. because after it times out trying to connect to the sgd server with the wrong port number, I change this to be the correct SGD server address in the browser, and it automatically logs in like in Step 2 above.
So my question really is can the authentication details provided at the first level apache web agent be passed down to other apache web server agents running on other servers?
Any ideas.
Thanks,
Carl

Access Manager Policy Agent 2.2 for Oracle 10g

I Installed AM Policy Agent 2.2 on Oracle App Server 10g (10.1.3). After install I don't get the redirect to the AM login page. The agent does not appear to be activated. When I restart the Oracle App server I expect to see logs entries from the agent in <agenthome>/logs/debug, but I don't get any log entries.
The agent was installed as oracle (same as the 10g server).
Entries in the 10g global application.xml for the agent:
ibrary path="/opt/AMAgent/j2ee_agents/am_oracle1012_agent/agent_001/config">
</library>
<library path="/opt/AMAgent/j2ee_agents/am_oracle1012_agent/locale">
</library>
<library path="/opt/AMAgent/j2ee_agents/am_oracle1012_agent/lib/agent.jar">
</library>
<library path="/opt/AMAgent/j2ee_agents/am_oracle1012_agent/lib/amclientsdk.jar">
</library>
AMAgent.properties settings:
com.iplanet.services.debug.level=message
com.sun.identity.agents.config.filter.mode = URL_POLICY
My goal is to protect all apps with SSO and basic url policies.
Any ideas on what I'm doing wrong? missing?

Hi,
have you added the agent filter for the application you are trying to protect
<filter>
<filter-name>Agent</filter-name>
<display-name>Agent</display-name>
<filter-class>
com.sun.identity.agents.filter.AmAgentFilter
</filter-class>
</filter>
<filter-mapping>
<filter-name>Agent</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>

Novell Access Manager J2EE Agent Installation

First post and first time attempting to install NETIQ unto my desktop. I'm a little confused as to the section of "Novell Access Manager J2EE Agent Installation" and what to enter for my Admin Console IP Address, username, password, & Application Server IP Address?... I'm not sure as to where to get this information from,..so if anyone could assist me, I'd greatly appreciate it very much, thanks in advance.

kpjones76,
It appears that in the past few days you have not received a response to your
posting. That concerns us, and has triggered this automated reply.
Has your problem been resolved? If not, you might try one of the following options:
- Visit http://support.novell.com and search the knowledgebase and/or check all
the other self support options and support programs available.
- You could also try posting your message again. Make sure it is posted in the
correct newsgroup. (http://forums.novell.com)
Be sure to read the forum FAQ about what to expect in the way of responses:
http://forums.novell.com/faq.php
If this is a reply to a duplicate posting, please ignore and accept our apologies
and rest assured we will issue a stern reprimand to our posting bot.
Good luck!
Your Novell Product Support Forums Team
http://forums.novell.com/

Policy Agent Install - Tomcat problems

Hello,
After trying to install policy agent on many different OS with no success, I had to finally ask here:
I followed the instructions and did the following on Debian, Fedora, and Win server 2003:
1.downloaded the policy agent for tomcat
2.stopped tomcat
3.decompressed the j2ee agents folder to the root of the system,
4 run the agentadmin -install
5. put the agentapp folder in the webapps directory
6. started tomcat...
get the same error on three OS about it not finding AMRealm,
I found someone pointing out that setagentclasspath could fix this,
but I see all the classpaths there, so I went I start moving some classes to the tomcat/lib dir
then the AMRealm error went away but many others came in.
What I'm doing wrong !!

I'm having the same problem with windows 2003 server Enterprise Edition. (installer complains about web server instance directory, is not 6.0 or 6.1...)
You said that "Policy Agent 2.1 does *NOT* work with MS Windows 2003 Server Enterprise edition". But does Policy Agent 2.2 work with Windows 2003 Server Enterprise edition?
Thanks for your help!!!

Weblogic9.2 Opensso Access Manager 7.5

Hi,
I configured the Access Manager in weblogic9.2. I downloaded the Agent from Sun for weblogic 9.2. Then I deployed the sampleApplication that comes with the agent and configured users, role etc according to the Readme.txt.
I am always getting Invalid Session ID exception. I read java.net docs and sun's forums and tried to configure accordingly, but with no luck.
I am using the default Flat File store that Access Manager has.
I have been trying to see if there is any docs that show step by step process of how to attach User to role, URL Policy to Role/ groups/ varous authentication mechanisms.
Please let me know if the OpenSSO is tested on Weblogic 9.2 and whether anything special I might have to do to make it work.
Thank you

302 is a redirect. Probably citrix is trying to access a URL on itself and is getting the redirect instead of the content it expects. Analyze the PA and web server logs and see what requests it is making. Add those URL's to the PA's not enforced list

Oracle access manager - Policy domain - Return Type

Hi,
I have a requirement where I need to return few LDAP parameter values through Policy domain while redirecting. But the return type should be propertytype and not headervar or cookie. This is SSO integration with websphere using JAAS subject. We have inhouse TAI connector developed for integration between websphere and oracle access manager.
Please help me to resolve this issue.
Regards,
Prashant

Hi Prashant,
OAM can return any type that you want, and OAM will set the name/value for that type - you can put "propertytype" in the type column, and the name and return attribute in the respective fields. "Cookie" and "HeaderVar" are the only types used by OAM WebGates, but your AccessGate (custom in-house connector) should be able to retrieve the values of propertytype that OAM sets.
Regards,
Colin

Example to use Query String in Oracle Access Manager Policy.

Hi All,
Can any one please tell me what is the use of Query String and Query String Variable in OAM Policy?
If possible please explain with a sample example.
Thanks in Advance.
Siva Pokuri.

Query string is used to protect URL with complete query string.
Ex: in case you want to protect http://hi.com/first.html?uid=abc&pqr=123 URL then you will specify query string as uid=abc&pqr=123.
In case you want to protect a URL with one of the query parameter as xyz and you do not care of other query parameters, then query string variables are used.
Ex: in case you want to protect http://hi.com/first.html?uid=abc&pqr=123 and http://hi.com/first.html?uid=abc&pqr=456 both with same policy then you will create a policy to protect first.html and in query string variables you will specify uid=abc.
Let me know if you have any problems in understanding this.
Thanks
Kiran Thakkar

Access Manager 7.1, Webserver 7.0 and Policy Agent 2.2 Logging behaviour

Hi,
I have a cluster setup with access manager (2 instances currently). I have a single webserver running access manager policy agent which points to the access manager cluster. Everything works fine, until the Agent session times out, whereupon it can no longer log to the access manager cluster.
i.e. it attempts to write a log entry like this:
2009-04-23 15:40:10.491 Debug 7720:2e7af0 LogService: BaseService::doRequest(): Using server: https://
am.blah.com:443/amserver/loggingservice.
<logRecWrite reqid="57"><log logName="amAuthLog.webserver.blah.com.80" sid="AQIC5wM2LY4SfczdB
6jEQSaqXL52vqgWNfqxVOf2teEx+b0=@AAJTSQACMTEAAlNLAAk0OTA4MTcyMzQAAlMxAAIwMg==#"></log><logRecord><level>8
00</level><recMsg>VXNlciBtb21lcjEgd2FzIGFsbG93ZWQgYWNjZXNzIHRvIGh0dHA6Ly9lcTAwMXRtLmVxLnNlcnZlci1jb21wbG
V4LmNvbTo4MC91d2MvaW5kZXguanNwLg==</recMsg><logInfoMap><logInfo><infoKey>LoginIDSid</infoKey><infoValue>
AQIC5wM2LY4Sfcy3bA/gJl2v7ArZCHla8Bj9bRVx4P6nSN0=@AAJTSQACMTEAAlNLAAstMTAxNzc2NjM2NQACUzEAAjAx#</infoValu
e></logInfo></logInfoMap></logRecord></logRecWrite>]]></Request>
</RequestSet>
and receives an error as follows:
2009-04-23 15:40:10.631MaxDebug 7720:2e7af0 LogService: <?xml version="1.0" encoding="UTF-8" standalone=
"yes"?>
<ResponseSet vers="1.0" svcid="iplanet.webtop.service.logging" reqid="74">
<Response><![CDATA[UNAUTHORIZED]]></Response>
</ResponseSet>
Investigation in the access manager logs shows that the agent session is no longer valid. As a result, I have two questions:
1. How can I make it stop trying to log remotely ? I have this set in the AMAgent.properties: com.sun.am.log.level = all:4
2. How do I exclude agents from the default session expiry times ?
Regards,
Michael Ward.

1. Set com.sun.am.policy.agents.config.audit.accesstype = LOG_NONE
2. Not sure if I understand this. Typically agent itself has to authenticate with the server and that agent session doesn't get expire anytime soon.
-Subba

Securing web services with Sun Access Manager

Hi!
I have gone through some documentation about Sun Access Manager, and I'm a little bit confused.
What I want is to secure some web services which are deployed on a BEA WebLogic 9.1 server (WLS). Two solutions are possible: To install some kind of plugin into WLS or to place some kind of proxy in front of WLS. In both cases, the purpose would be to authenticate the caller based on some kind of ticket (SAML or similar) and authorize access to the web service.
I have read about the "Sun Java System Access Manager Policy Agent 2.2 for Weblogic 9.1" (those guys really like long names....), but in this documentation web services aren't mentioned at all. They only seem to care about HTTP requests from a browser.
I have also read about the Policy Agent 2.2 in the documentation called "Sun Java System Access Manager Policy Agent 2.2 Guide for Sun Java System Application Server 9.0/Web Services" (puh...). This document explicitly talks about securing web services the way I want.
My questions are:
1) Is it possible to secure WLS based web services in the same way using the Policy Agent for WLS?
2) Are there any documentation/tutorials/etc?
Thanks in advance :-)
Anders

what you need is a webservices agent that would enable you to "protect" your webservice provider, which I assume is on a BEA weblogic provider.
the "Sun Java System Access Manager Policy Agent 2.2 for Weblogic 9.1" is "NOT" awebservices agent, but a normal J2EE policy agent.
So.. having said that. here's what I'd recommend.
1. install the webservices agent on bea weblogic. (note: NOT the J2EE policy agent)
2. configure it to use your access manager instance for authentication.
3. configure your webservices client to use the webservice provider. (note: you'd need the webservices APi's available on the client too... so the quick dirty method would be to install the webservices agent on your client too....) you can later bundle the webservices client independently and provide your"customers" with a webservices client bundle...
4. voila... your webservices are not "protected" by acces manager ;-)

Policy Agent on Sun Application Server 9.1

I'm attempting to deploy the Access Manager Policy Agent to Sun Application Server 9.1 and I'm running into some issues.
Environment:
amhost - Access Manager 7.0 on Sun Webserver can do both http and https
ashost - Access Manager Policy AGent 2.2 on Sun Application Server 9.1
If everything is set to http:
When i attempt to access a simple servlet application (Headersnooper) I am redirected the the access manager server and when authentication is successful I see the browser attempting to redirect back to the application server and I see the following error in the Policy Agent debug logs amJAXRPC:
11/13/2007 02:46:18:055 PM EST: Thread[httpSSLWorkerThread-8080-79,10,Grizzly]
JAXRPCHelper: Connection to URL: https://ssodev.queensu.ca:443/amserver/jaxrpc/SMSObjectIF failed
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:150)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1518)
at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:174)
at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:168)
Why would it think to attempt to connect to https when everything in the agent is configured for http?
Any thoughts or recommendations would be appreciated.

Hi,
One thing that could help is to look at the info in the agent logs, first increase Debug Logging Level, then restart the agent server and click thru your app, then look in agent runtime logs which should have more descriptive errors. For more detail on how to do this, try http://wikis.sun.com/display/OpenSSO/GlassFishAgentTrouble#GlassFishAgentTrouble-generaltips
You could look on this page, which is mostly based on GlassFish server but could help for other servers as well.
http://wikis.sun.com/display/OpenSSO/GlassFishAgentTrouble
I have not installed either of the policy agents you mentioned. But with some of the other agents, like the Sun App server 9 (GlassFish) agent, it comes with a sample application, and I find that this is the best way to ensure your setup is good and you are following all steps etc. Once sample app is up, you can try your own apps with confidence.
Since you already have the SJSAS 9 installed, maybe you could create a new domain and download/install the SJSAS 9 policy agent on the new domain. Then try out the sample app?
Or if those other agents have a sample app then try it out.
hth,
Sean

Need asssitance on openSSO/Access Manager-policy agent on tomcat 5.5

Similar Messages

Maybe you are looking for