OpenAM policy framework defines Subject, Condition, Referral
and ResponseProvider interfaces to let developers implement their
own plugins to extend the functionality. This sample illustrates
the steps involved.
Write java source java files implementing Subject,
Condition, Referral or ResponseProvider interface. See the sample
files: SampleSubject.java,
SampleCondition.java,
SampleReferral.java,
SampleResponseProvider.java
Compile the source files to create class files. You would
have to include opensso.jar and opesnsso-sharedlib.jar in
classpath at compilation time.
Pacakge the compiled classes into jar file, let us call it
policy-plugins.jar.
Explode opensso.war file.
Add the policy-plugins.jar file to WEB-INF/lib directory.
You could alernatively copy the custom plugin classes to
WEB-INF/classes maintaining directory structure corresponding
to the the java package of the plugin classes.
Update WEB-INF/classes/amPolicy.properties to add l10n
values for the new i18n keys used by iPlanetAMPolicyService.
Note : The new i18n keys and their respective values refered here
are the ones you would be using in "amPolicy_mod.xml" at step 9.
Update WEB-INF/classes/amPolicyConfig.properties to add
l10n values for the new i18n keys used by
iPlanetAMPolicyConfigService.
Note : The new i18n keys and their respective values refered here
are the ones you would be using at step 10.
Recreate the war file and redeploy the war file.
Steps 1
through 8 have been already taken care of for the sample
plugins included in OpenAM distribution.
Register the new plugins with iPlanetAMPolicyService using
ssoadm command. Assuming password.txt file has
the password of amadmin
ssoadm create-svc -X <amPolicy_mod.xml >-u amadmin -f
<password.txt>
See the sample amPolicy_mod.xml.
Notice the new i18keys referred in the xml file. Corresponding
l10n values should be added in amPolicy.properties
Register the new plugins as choice values in
iPlanetAMPolicyConfigService using ssoadm command.
You can also use openam console to do the previous setp:
Login as amadmin or administrator at the realm, navigate to the
realm, services, policy configuration and enable or disable the
selection of the plugin. You would have to do this step using
console for the realms that have been already created.
Restart the webapp or the container
You can now add the instances of the new plugins while
defining policies using either console of ssoadm commad. The new
plugins would be availabe as choices in right policy management
pages in the console.
To disable the custom plugins from being added newly to
policies, using openam console navigate to Access Control >
Realm > Services | Policy Configuration and deselect the
appropriate custom plugins and save the Policy Configuration
properties page for exisiting realms. If you navigate to
Configuration > Global > Policy Configuration and do this,
the custom plugins would be deselected for the realms that would
be created subsequently.
Copy the custom plugin classes to <TOOLS_HOME>/classes
maintaining directory structure corresponding
to the the java package of the plugin classes.
You can copy the classes of bundled custom
sample plugins from explosed openam.war,
WEB-INF/classes/com/sun/identity/samples/policy.
This is required if you would use ssoadm to export or
add policies.
Note : <TOOLS_HOME> is the ssoadm home directory
from where you would be running ssoadm CLI tool.
