OpenSSOAgentConfiguration.template revision 20d6346411620e69843780ad0526325cd7ad94ee
4d237bbe075b1d2c19428cd954d721d65b31f67cwrowe#
ec79b29695b183f794264bbb578c51e93d1f9b1emartin# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
1a5f954324f2584984fc9cee7a7a8ebe8ef39aeajim#
b39ba1ea90cd1940dcd9e8d0f18c1ff02c187ac1jim# Copyright (c) 2008 Sun Microsystems Inc. All Rights Reserved
fb8ee8b7a3a2503b95bf47685f9083e0b9834e6fminfrin#
fb8ee8b7a3a2503b95bf47685f9083e0b9834e6fminfrin# The contents of this file are subject to the terms
fb8ee8b7a3a2503b95bf47685f9083e0b9834e6fminfrin# of the Common Development and Distribution License
fb8ee8b7a3a2503b95bf47685f9083e0b9834e6fminfrin# (the License). You may not use this file except in
a72211e92bab814bfa28ee086ca9b2a1a6095c92chrisd# compliance with the License.
a72211e92bab814bfa28ee086ca9b2a1a6095c92chrisd#
a72211e92bab814bfa28ee086ca9b2a1a6095c92chrisd# You can obtain a copy of the License at
a72211e92bab814bfa28ee086ca9b2a1a6095c92chrisd# https://opensso.dev.java.net/public/CDDLv1.0.html or
a72211e92bab814bfa28ee086ca9b2a1a6095c92chrisd# opensso/legal/CDDLv1.0.txt
a72211e92bab814bfa28ee086ca9b2a1a6095c92chrisd# See the License for the specific language governing
a72211e92bab814bfa28ee086ca9b2a1a6095c92chrisd# permission and limitations under the License.
a72211e92bab814bfa28ee086ca9b2a1a6095c92chrisd#
5c5e7695fc1e44bebba6b339494a2df4e69b86fcjim# When distributing Covered Code, include this CDDL
5c5e7695fc1e44bebba6b339494a2df4e69b86fcjim# Header Notice in each file and include the License file
5c5e7695fc1e44bebba6b339494a2df4e69b86fcjim# at opensso/legal/CDDLv1.0.txt.
4228aba3de67f3d9cce68f7a915d5435faa43adarpluem# If applicable, add the following below the CDDL Header,
4228aba3de67f3d9cce68f7a915d5435faa43adarpluem# with the fields enclosed by brackets [] replaced by
4228aba3de67f3d9cce68f7a915d5435faa43adarpluem# your own identifying information:
78a20a6e7ad3a0229900ee54c7d11a65f647b663niq# "Portions Copyrighted [year] [name of copyright owner]"
9582ad6e149d28b118d4e8571101ecb6f85e0191niq#
9582ad6e149d28b118d4e8571101ecb6f85e0191niq# $Id: OpenSSOAgentConfiguration.template,v 1.2 2009/10/15 23:35:04 leiming Exp $
9582ad6e149d28b118d4e8571101ecb6f85e0191niq#
78a20a6e7ad3a0229900ee54c7d11a65f647b663niq# Portions Copyrighted 2010-2014 ForgeRock AS.
d56bacbfefa5aa883ce5162a115747372fc38d13chrisd
d56bacbfefa5aa883ce5162a115747372fc38d13chrisd#------------------------------------------------------------------------------
d56bacbfefa5aa883ce5162a115747372fc38d13chrisd# Configuration Property File
d56bacbfefa5aa883ce5162a115747372fc38d13chrisd#
d56bacbfefa5aa883ce5162a115747372fc38d13chrisd# OpenAM Policy Agent for:
e1a26e8050bf62459a7ef1c5064b714811767417rpluem# GlassFish 2.1
e1a26e8050bf62459a7ef1c5064b714811767417rpluem#
e1a26e8050bf62459a7ef1c5064b714811767417rpluem# Version: ${project.version}
fcee7ee83b1e48f2655c79f176d1ea7627e19937chrisd
fcee7ee83b1e48f2655c79f176d1ea7627e19937chrisd#------------------------------------------------------------------------------
fcee7ee83b1e48f2655c79f176d1ea7627e19937chrisd#
fcee7ee83b1e48f2655c79f176d1ea7627e19937chrisd# THIS FILE PROVIDES THE CONFIGURATION SETTINGS NECESSARY FOR THE AGENT
53feccc94b923e12db1df6f7069676590097ba2frpluem# TO FUNCTION CORRECTLY. PLEASE REFER TO THE DOCUMENTATION BEFORE
53feccc94b923e12db1df6f7069676590097ba2frpluem# MODIFYING ANY OF THE VALUES IN THIS FILE.
53feccc94b923e12db1df6f7069676590097ba2frpluem#
b39ba1ea90cd1940dcd9e8d0f18c1ff02c187ac1jim# Note:
b39ba1ea90cd1940dcd9e8d0f18c1ff02c187ac1jim# Data present in this file provides the necessary configuration
b39ba1ea90cd1940dcd9e8d0f18c1ff02c187ac1jim# settings needed by Agent to work correctly. Invalid configuration
b39ba1ea90cd1940dcd9e8d0f18c1ff02c187ac1jim# data present in this file can lead to malfunction of the Agent, the
d64dd2fd4516c2b1b664c5e59c0628d9aff26984covener# application, and the Application Server.
d64dd2fd4516c2b1b664c5e59c0628d9aff26984covener#
d64dd2fd4516c2b1b664c5e59c0628d9aff26984covener# WARNING: The contents of this file are classified as an UNSTABLE
ed0d39878e79220baaa50c15b79b1fdf877cb919niq# interface by Sun Microsystems, Inc. As such, they are subject to
1e911973bcb9df6701a4c16c037771ecf25ade13niq# significant, incompatible changes in any future release of the
1e911973bcb9df6701a4c16c037771ecf25ade13niq# software.
1e911973bcb9df6701a4c16c037771ecf25ade13niq#
1e911973bcb9df6701a4c16c037771ecf25ade13niq# INVALID CONFIGURATION SETTINGS MAY RESULT IN MALFUNCTION OF THE ENTIRE
1e911973bcb9df6701a4c16c037771ecf25ade13niq# SYSTEM.
1e911973bcb9df6701a4c16c037771ecf25ade13niq#------------------------------------------------------------------------------
a55905a382027bdcc3a29248db4176527d36aa9ajim
a55905a382027bdcc3a29248db4176527d36aa9ajim#------------------------------------------------------------------------------
a55905a382027bdcc3a29248db4176527d36aa9ajim# General Notes about the Agent Configuration
a55905a382027bdcc3a29248db4176527d36aa9ajim# -------------------------------------------
5fbd1e97905738791e7359ccbc9b02e913948d2erpluem#
5fbd1e97905738791e7359ccbc9b02e913948d2erpluem# HOT-SWAP MECHANISM:
5fbd1e97905738791e7359ccbc9b02e913948d2erpluem# Certain property keys in this configuration are hot-swap enabled.
5fbd1e97905738791e7359ccbc9b02e913948d2erpluem# The value for these keys when altered are dynamically loaded by the
ca33b922ae8ad1b24a8235b656b0ac6f82915355jim# Agent such that it is not necessary to restart the Application
e74519466f1905e7a1b3d34396fbb82717153c90jim# Server in order for these changes to take effect. However, in cases
e74519466f1905e7a1b3d34396fbb82717153c90jim# where the key is explicitly identified as not enabled for hot-swap
e74519466f1905e7a1b3d34396fbb82717153c90jim# or in cases when the hot-swap mechanism is disabled on the system,
ca33b922ae8ad1b24a8235b656b0ac6f82915355jim# the Application Server must be restarted for the changes to take
ca33b922ae8ad1b24a8235b656b0ac6f82915355jim# effect. Please refer to the Agent documentation to further learn
b842b65e0618c5535233b197f03dc917d184adb3jim# about hot-swap configuration of the Agent.
b842b65e0618c5535233b197f03dc917d184adb3jim#
b842b65e0618c5535233b197f03dc917d184adb3jim# LIST CONSTRUCTS:
b842b65e0618c5535233b197f03dc917d184adb3jim# Certain property keys in this configuration are specified as lists.
e47d58d5d983426584c8d16416c50f5c58070746dirkx# A list construct is defined as follows:
e47d58d5d983426584c8d16416c50f5c58070746dirkx#
e47d58d5d983426584c8d16416c50f5c58070746dirkx# Format:
e47d58d5d983426584c8d16416c50f5c58070746dirkx# <key>[<index>]=<value>
33aad3911b15cb5d523075f7df829274fe298a13dirkx#
33aad3911b15cb5d523075f7df829274fe298a13dirkx# Where:
76f68128bb8fcea0f772d522c05dc7ec872040c2dirkx# key : is the configuration key
33aad3911b15cb5d523075f7df829274fe298a13dirkx# index : is a positive number starting from 0 that increments by 1
433dcb1fbaae82d36634f5120bff71a04296904ddirkx# for every value specified in this list.
433dcb1fbaae82d36634f5120bff71a04296904ddirkx# value : is one of the values specified in this list.
433dcb1fbaae82d36634f5120bff71a04296904ddirkx#
433dcb1fbaae82d36634f5120bff71a04296904ddirkx# Notes:
433dcb1fbaae82d36634f5120bff71a04296904ddirkx# - Please refer the Agent documentation for full details on usage.
433dcb1fbaae82d36634f5120bff71a04296904ddirkx#
46a47c67296c52323632d5ae9d7c86bf87027a5frpluem# Example:
46a47c67296c52323632d5ae9d7c86bf87027a5frpluem# com.sun.identity.agents.config.example[0] = value0
46a47c67296c52323632d5ae9d7c86bf87027a5frpluem# com.sun.identity.agents.config.example[1] = value1
edb2ad8387e30473e5be09714189441ef94d7f29rpluem# com.sun.identity.agents.config.example[2] = value2
edb2ad8387e30473e5be09714189441ef94d7f29rpluem#
edb2ad8387e30473e5be09714189441ef94d7f29rpluem# MAP CONSTRUCTS:
edb2ad8387e30473e5be09714189441ef94d7f29rpluem# Certain property keys in this configuration are specified as Maps.
56d3f6035b11f7d2074bcb8368dca5dfd12f9087jim# A Map construct is defined as follows:
56d3f6035b11f7d2074bcb8368dca5dfd12f9087jim#
64bf71725ee015894b1724bc0dd198e5e24424ecrpluem# Format:
64bf71725ee015894b1724bc0dd198e5e24424ecrpluem# <key>[<name>]=<value>
64bf71725ee015894b1724bc0dd198e5e24424ecrpluem#
d7fcc79b0bee660d71b0cccfe9bbc2765ee6420erederpj# Where:
d7fcc79b0bee660d71b0cccfe9bbc2765ee6420erederpj# key : is the configuration key
d7fcc79b0bee660d71b0cccfe9bbc2765ee6420erederpj# name : is a string that forms the lookup key as available in the
d7fcc79b0bee660d71b0cccfe9bbc2765ee6420erederpj# Map
d7fcc79b0bee660d71b0cccfe9bbc2765ee6420erederpj# value : is the value associated with the name in the Map
d7fcc79b0bee660d71b0cccfe9bbc2765ee6420erederpj#
5e48e0ef81c0736649fd7d2884837b32ed678750rpluem# Notes:
5e48e0ef81c0736649fd7d2884837b32ed678750rpluem# - Please refer the Agent documentation for full details on usage.
5e48e0ef81c0736649fd7d2884837b32ed678750rpluem#
cb9999606fbbda475b7b40e164699731521e9eb1niq# Example:
cb9999606fbbda475b7b40e164699731521e9eb1niq# com.sun.identity.agents.config.example[AL] = ALABAMA
cb9999606fbbda475b7b40e164699731521e9eb1niq# com.sun.identity.agents.config.example[AK] = ALASKA
33159d1d1291b676697c154830134500e793e66bcovener# com.sun.identity.agents.config.example[AZ] = ARIZONA
33159d1d1291b676697c154830134500e793e66bcovener#
33159d1d1291b676697c154830134500e793e66bcovener# APPLICATION SPECIFIC/GLOBAL CONFIGURATION:
33159d1d1291b676697c154830134500e793e66bcovener# Certain property keys in this configuration can be specified per
c002c44ee5c7e7258f4ba5c162461c24a0c179c2dirkx# protected application. This implies that the Agent will use
c002c44ee5c7e7258f4ba5c162461c24a0c179c2dirkx# different values of the same configuration key for different
c002c44ee5c7e7258f4ba5c162461c24a0c179c2dirkx# applications as defined in this configuration file. Properties
40beb03c240a9c60805388592f1005d9bf9d2362fuankg# which are not specified per protected applications are called Global
65cb7f00eca6689c8a89dc809359991ade1285bcwrowe# properties. Application specific properties are defined as follows:
65cb7f00eca6689c8a89dc809359991ade1285bcwrowe#
65cb7f00eca6689c8a89dc809359991ade1285bcwrowe# Format:
65cb7f00eca6689c8a89dc809359991ade1285bcwrowe# <key>[<appname>]=<value>
65cb7f00eca6689c8a89dc809359991ade1285bcwrowe#
475311484e1d0f01d41e0f48bfecf1f4bca2ff07rpluem# Where:
475311484e1d0f01d41e0f48bfecf1f4bca2ff07rpluem# key : is the configuration key
475311484e1d0f01d41e0f48bfecf1f4bca2ff07rpluem# appname : is the Application name to which this configuration
ef79eba84348e4f8c99402de06afa2237a856049rpluem# belongs. The application name is the context path of
ef79eba84348e4f8c99402de06afa2237a856049rpluem# the application without the leading forward slash
ef79eba84348e4f8c99402de06afa2237a856049rpluem# character. In case when the application has been
0d529159d06aec095a1e0612e2d629c98dc75512rpluem# deployed at the root-context of the server, the
0d529159d06aec095a1e0612e2d629c98dc75512rpluem# application name should be specified as
0d529159d06aec095a1e0612e2d629c98dc75512rpluem# 'DefaultWebApp'.
39c7699ec0799d394d3f67145d4a12ed82f587b8jorton# value : the value that will be used by the Agent when
39c7699ec0799d394d3f67145d4a12ed82f587b8jorton# protecting the application identified by the given
39c7699ec0799d394d3f67145d4a12ed82f587b8jorton# application name.
3511969853863eeb6e80018afe63831e5bf81447rpluem#
3511969853863eeb6e80018afe63831e5bf81447rpluem# Notes:
3511969853863eeb6e80018afe63831e5bf81447rpluem# - When an application specific configuration is not present, the
c6d33447e28403a90ad817dba4df75fae785be28pquerna# Agent uses different mechanisms to identify a default value. There
c6d33447e28403a90ad817dba4df75fae785be28pquerna# could be configurations where the default value is used as the
439ccf2a084e1da566548931c585cbcc3a9e7f4cminfrin# value specified for the same key without any application specific
439ccf2a084e1da566548931c585cbcc3a9e7f4cminfrin# suffix '[<appname>]'. For example, if the following configuration
439ccf2a084e1da566548931c585cbcc3a9e7f4cminfrin# keys are present:
439ccf2a084e1da566548931c585cbcc3a9e7f4cminfrin#
439ccf2a084e1da566548931c585cbcc3a9e7f4cminfrin# com.sun.identity.agents.config.example[Portal] = value1
439ccf2a084e1da566548931c585cbcc3a9e7f4cminfrin# com.sun.identity.agents.config.example[DefaultWebApp] = value2
4ede070ca63bd4c48045e35a7192582769770290jorton# com.sun.identity.agents.config.example = value3
4ede070ca63bd4c48045e35a7192582769770290jorton#
795c9499a77c25695bcb9710ed67bbe51492e181rpluem# then, for applications other than the ones deployed on the root
795c9499a77c25695bcb9710ed67bbe51492e181rpluem# context and the context '/Portal', the value of this key will
795c9499a77c25695bcb9710ed67bbe51492e181rpluem# default to 'value3'.
a72ba68ecbbc61e4b513e50d6000245c33f753dcwrowe#
a72ba68ecbbc61e4b513e50d6000245c33f753dcwrowe# - Application Specific configuration properties must follow the
7a079e0cd696baca90ac43e325f64582e2945c68wrowe# rules and syntax of the MAP construct of configuration entries as
a72ba68ecbbc61e4b513e50d6000245c33f753dcwrowe# defined above.
62c53a0dab4c85bfc6a5ab9abfb1b269d9f7458dniq#
62c53a0dab4c85bfc6a5ab9abfb1b269d9f7458dniq# Example:
62c53a0dab4c85bfc6a5ab9abfb1b269d9f7458dniq# com.sun.identity.agents.config.example[Portal] = value1
11a0edf478ca9c59d80bf73491d89cf019259feeniq# com.sun.identity.agents.config.example[BankApp] = value2
11a0edf478ca9c59d80bf73491d89cf019259feeniq# com.sun.identity.agents.config.example[DefaultWebApp] = value3
11a0edf478ca9c59d80bf73491d89cf019259feeniq#------------------------------------------------------------------------------
06446302a0a3e40cd8807bb25467c8f776cf2fbatrawick
06446302a0a3e40cd8807bb25467c8f776cf2fbatrawick#
06446302a0a3e40cd8807bb25467c8f776cf2fbatrawick# FILTER OPERATION MODE
06446302a0a3e40cd8807bb25467c8f776cf2fbatrawick# Specifies the mode of operation of the Filter. Valid value is one of:
ecc1538af1c08282fc2773d2eb3f1a54251862f9minfrin# NONE, SSO_ONLY, URL_POLICY, J2EE_POLICY, ALL. This property can also be
ecc1538af1c08282fc2773d2eb3f1a54251862f9minfrin# specified as an application specific property. However, the global
ecc1538af1c08282fc2773d2eb3f1a54251862f9minfrin# property must always be present.
ecc1538af1c08282fc2773d2eb3f1a54251862f9minfrin# WARNING:
3f5585f7f4a7d74f2f94ec729ea8c1879d419e35rederpj# WHEN THIS PROPERTY IS SET TO 'NONE', THE AGENT WILL GRANT ACCESS TO
3f5585f7f4a7d74f2f94ec729ea8c1879d419e35rederpj# ALL PROTECTED RESOURCES. THIS MODE OF OPERATION SHOULD NOT BE USED
3f5585f7f4a7d74f2f94ec729ea8c1879d419e35rederpj# IN DEPLOYED PRODUCTION SYSTEMS AT ANY TIME AS IT CAN RESULT IN
3f5585f7f4a7d74f2f94ec729ea8c1879d419e35rederpj# UNAUTHORIZED ACCESS TO PROTECTED SYSTEM RESOURCES. THIS MODE OF
3f5585f7f4a7d74f2f94ec729ea8c1879d419e35rederpj# OPERATION IS PROVIDED ONLY TO FACILITATE TROUBLESHOOTING OF THE
e4b96ba15dc8b2b27d251d53e29b86da32cd5066pquerna# APPLICATION IN A WELL CONTROLLED DEVELOPMENT AND TEST ENVIRONMENT
e4b96ba15dc8b2b27d251d53e29b86da32cd5066pquerna# AND SHOULD NOT BE USED IN ANY OTHER ENVIRONMENT.
81bd9331da3bd0f53255d52b1475480ff3a4b395trawick# Hot-Swap Enabled: No
81bd9331da3bd0f53255d52b1475480ff3a4b395trawick# Example:
81bd9331da3bd0f53255d52b1475480ff3a4b395trawick# com.sun.identity.agents.config.filter.mode = ALL
cd3bbd6d2df78d6c75e5d159a81ef8bdd5f70df9trawick# com.sun.identity.agents.config.filter.mode[BankApp] = URL_POLICY
cd3bbd6d2df78d6c75e5d159a81ef8bdd5f70df9trawick#
cd3bbd6d2df78d6c75e5d159a81ef8bdd5f70df9trawickcom.sun.identity.agents.config.filter.mode = ALL
cd3bbd6d2df78d6c75e5d159a81ef8bdd5f70df9trawick
108ebbb87b2a46f4416ec507824471a483c39fe1sctemme#
108ebbb87b2a46f4416ec507824471a483c39fe1sctemme# USER MAPPING PROPERTIES
108ebbb87b2a46f4416ec507824471a483c39fe1sctemme# - user.mapping.mode: Specifies the mechanism by which the user-ID
108ebbb87b2a46f4416ec507824471a483c39fe1sctemme# to be used on the protected server for the authenticated user is
7abe34dd5a20fc8fde09dca9116b88e6ddfd55ddjorton# determined by the Agent. Value of this is one of: USER_ID,
7abe34dd5a20fc8fde09dca9116b88e6ddfd55ddjorton# PROFILE_ATTRIBUTE, HTTP_HEADER, SESSION_PROPERTY.
7abe34dd5a20fc8fde09dca9116b88e6ddfd55ddjorton# - user.attribute.name: Specifies the name of the profile attribute,
10d486b9267800c5e376c22f6c0d45dc2ae86f67chrisd# or HTTP header, or Session property which contains the user-ID to
10d486b9267800c5e376c22f6c0d45dc2ae86f67chrisd# be used on the protected server for the authenticated user. This
10d486b9267800c5e376c22f6c0d45dc2ae86f67chrisd# property is not used if the value of user.mapping.mode is set to
10d486b9267800c5e376c22f6c0d45dc2ae86f67chrisd# USER_ID.
3e155218733389e7b1ea3a9ffd0aea533fd929cechrisd# - user.principal: A flag that indicates that the principal of the
3e155218733389e7b1ea3a9ffd0aea533fd929cechrisd# authenticated user be used instead of just the user-ID for
3e155218733389e7b1ea3a9ffd0aea533fd929cechrisd# authenticating the user on the protected server. This property is
3e155218733389e7b1ea3a9ffd0aea533fd929cechrisd# applicable if the user.mapping.mode is set to USER_ID.
dd6199828976e6c7850ca6abd7a1ceba99e9ed16chrisd# - user.token: Specifies a session property name which contains the
dd6199828976e6c7850ca6abd7a1ceba99e9ed16chrisd# user-ID of the authenticated user in session. This property is used
dd6199828976e6c7850ca6abd7a1ceba99e9ed16chrisd# when the user.mapping.mode is set to USER_ID and the user.principal
dd6199828976e6c7850ca6abd7a1ceba99e9ed16chrisd# flag is set to false.
ab43b4a17b2ac31ccb1cf280be8c42a8a314cecbjorton# Hot-Swap Enabled: Yes
ab43b4a17b2ac31ccb1cf280be8c42a8a314cecbjorton# Examples:
ab43b4a17b2ac31ccb1cf280be8c42a8a314cecbjorton# com.sun.identity.agents.config.user.mapping.mode = PROFILE_ATTRIBUTE
67139e2d50d1e11558d87f7042f61cb04bb0d1d2jim# com.sun.identity.agents.config.user.attribute.name = employeenumber
f3a5934ca0fb0f0f813bd9d9d06af8937e3f401fjim#
67139e2d50d1e11558d87f7042f61cb04bb0d1d2jimcom.sun.identity.agents.config.user.mapping.mode = USER_ID
67139e2d50d1e11558d87f7042f61cb04bb0d1d2jimcom.sun.identity.agents.config.user.attribute.name = employeenumber
67139e2d50d1e11558d87f7042f61cb04bb0d1d2jimcom.sun.identity.agents.config.user.principal = false
a4ab95921be8ce5de50913cd6505d41b672eb375minfrincom.sun.identity.agents.config.user.token = UserToken
a4ab95921be8ce5de50913cd6505d41b672eb375minfrin
a4ab95921be8ce5de50913cd6505d41b672eb375minfrin#
a4ab95921be8ce5de50913cd6505d41b672eb375minfrin# CLIENT IDENTIFICATION PROPERTIES
e605dd6afa940f799c873ffeaa5e25fa4ea9a2c8minfrin# - client.ip.header: Specifies a HTTP header name that holds the IP
e605dd6afa940f799c873ffeaa5e25fa4ea9a2c8minfrin# address of the client. May be left blank if not used.
e605dd6afa940f799c873ffeaa5e25fa4ea9a2c8minfrin# - client.hostname.header: Specifies a HTTP header name that holds the
e605dd6afa940f799c873ffeaa5e25fa4ea9a2c8minfrin# Hostname of the client. May be left blank if not used.
e605dd6afa940f799c873ffeaa5e25fa4ea9a2c8minfrin# Hot-Swap Enabled: Yes
50c06405bc48121db2913925549407fd3e79bcedmturk# Example:
50c06405bc48121db2913925549407fd3e79bcedmturk# com.sun.identity.agents.config.client.ip.header = X-Proxy-Client-IP
dec02391360e503cd3437d16bed765dc653b9de5minfrin# com.sun.identity.agents.config.client.hostname.header = X-Proxy-Client-Host
dec02391360e503cd3437d16bed765dc653b9de5minfrin#
dec02391360e503cd3437d16bed765dc653b9de5minfrincom.sun.identity.agents.config.client.ip.header =
dec02391360e503cd3437d16bed765dc653b9de5minfrincom.sun.identity.agents.config.client.hostname.header =
dec02391360e503cd3437d16bed765dc653b9de5minfrin
1b27a3a26f18191db7ecb4d536cb121ba9520a8eniq#
1b27a3a26f18191db7ecb4d536cb121ba9520a8eniq# CONFIGURATION RELOAD INTERVAL
686ce4eade942e515b1725d0c9751da36b759a6ctrawick# Specifies the interval in seconds between configuration reloads. When
686ce4eade942e515b1725d0c9751da36b759a6ctrawick# set to 0, the hot-swap mechanism will be disabled.
686ce4eade942e515b1725d0c9751da36b759a6ctrawick# Hot-Swap Enabled: Yes
1ce78cf71b5baaf2c1ab48e818cb1f2397df5010trawick#
4bd465052c4a0c8d41e573ee7a90c312d980355fchrisdcom.sun.identity.agents.config.load.interval = 3600
4bd465052c4a0c8d41e573ee7a90c312d980355fchrisd
4bd465052c4a0c8d41e573ee7a90c312d980355fchrisd#
4bd465052c4a0c8d41e573ee7a90c312d980355fchrisd# LOCALE IDENTIFICATION PROPERTIES
4bd465052c4a0c8d41e573ee7a90c312d980355fchrisd# - locale.language: Specifies the language code for identifying the Locale
4bd465052c4a0c8d41e573ee7a90c312d980355fchrisd# of operation.
4bd465052c4a0c8d41e573ee7a90c312d980355fchrisd# - locale.country: Specifies the country code for identifying the Locale of
27b38d4191d5f638165e2a77ec6e6f567bd7784dniq# operation.
27b38d4191d5f638165e2a77ec6e6f567bd7784dniq# Hot-Swap Enabled: No
27b38d4191d5f638165e2a77ec6e6f567bd7784dniq#
a87e2a23083aa62229307482afbb3b802a0c2105mturkcom.sun.identity.agents.config.locale.language = en
a87e2a23083aa62229307482afbb3b802a0c2105mturkcom.sun.identity.agents.config.locale.country = US
a87e2a23083aa62229307482afbb3b802a0c2105mturk
a87e2a23083aa62229307482afbb3b802a0c2105mturk#
a87e2a23083aa62229307482afbb3b802a0c2105mturk# AUDIT LOG PROPERTIES
a87e2a23083aa62229307482afbb3b802a0c2105mturk# - audit.accesstype: Specifies the access type which will be logged by the
8fd638698262130d00458b2c95548f6f94875847rpluem# Agent. Valid value is one of: LOG_NONE, LOG_ALLOW, LOG_DENY, LOG_BOTH.
534611d341a1a48b93c7a1fd5e333dbd261527d3rpluem# - log.disposition: Specifies the audit log mode that the Agent will use
534611d341a1a48b93c7a1fd5e333dbd261527d3rpluem# when writing audit log messages. Valid value is one of: LOCAL, REMOTE,
534611d341a1a48b93c7a1fd5e333dbd261527d3rpluem# ALL.
e99dfd55d29a7b4209b814efc7270d0b74ccee74niq# - remote.logfile: Specifies the file name to be used on the remote server
c3c8103039e36494987aff50451896459826a361rpluem# if the log.disposition is set to REMOTE or ALL.
e99dfd55d29a7b4209b814efc7270d0b74ccee74niq# - local.log.rotate: A flag that indicates if the rotation of audit log
127aef4ce9f7b6b32a95c5ed9a93b796d18755e6rpluem# local file is enabled or disabled.
127aef4ce9f7b6b32a95c5ed9a93b796d18755e6rpluem# - local.log.size: The size in bytes of the local audit log file, beyond
127aef4ce9f7b6b32a95c5ed9a93b796d18755e6rpluem# which the Agent should rotate the log file.
127aef4ce9f7b6b32a95c5ed9a93b796d18755e6rpluem# Hot-Swap Enabled: Yes
79d4b708d021714647aab8b138ae671ed24765cewrowe#
79d4b708d021714647aab8b138ae671ed24765cewrowecom.sun.identity.agents.config.audit.accesstype = LOG_NONE
79d4b708d021714647aab8b138ae671ed24765cewrowecom.sun.identity.agents.config.log.disposition = REMOTE
79d4b708d021714647aab8b138ae671ed24765cewrowecom.sun.identity.agents.config.remote.logfile = @AUDIT_LOG_FILENAME@
79d4b708d021714647aab8b138ae671ed24765cewrowecom.sun.identity.agents.config.local.log.rotate = false
88d0e50f16b21d4d0af0a48da7ad28fb5991834crpluemcom.sun.identity.agents.config.local.log.size = 52428800
88d0e50f16b21d4d0af0a48da7ad28fb5991834crpluem
88d0e50f16b21d4d0af0a48da7ad28fb5991834crpluem#
88d0e50f16b21d4d0af0a48da7ad28fb5991834crpluem# WEB SERVICE PROCESSING PROPERTIES
15264721069299ec26493e21d56bf8ff7faf6f0drpluem# - webservice.enable: A flag that specifies if Web Service processing is
15264721069299ec26493e21d56bf8ff7faf6f0drpluem# enabled or disabled.
15264721069299ec26493e21d56bf8ff7faf6f0drpluem# - webservice.endpoint: A list of Web Application end points that represent
11e1b16b907afb7de0678e28fe4849d9029e2df8rpluem# Web Services.
25a81ea1bca1c89cda713c4d23660e487b1488a0rpluem# - webservice.process.get.enable: A flag that indicates if the processing
25a81ea1bca1c89cda713c4d23660e487b1488a0rpluem# of HTTP GET requests for Web Service endpoints is enabled or disabled.
25a81ea1bca1c89cda713c4d23660e487b1488a0rpluem# - webservice.authenticator: An implementation class that can be used to
48fa058fe468025347930610ac2473094fa0f4e4chrisd# authenticate web-service requests.
48fa058fe468025347930610ac2473094fa0f4e4chrisd# - webservice.internalerror.content: The name of file that contains content
48fa058fe468025347930610ac2473094fa0f4e4chrisd# used by the Agent to generate an internal error fault for clients.
3ec4328f079d8867cc323155e59678ad9437914frooneg# - webservice.autherror.content: The name of file that contains content
3ec4328f079d8867cc323155e59678ad9437914frooneg# used by the Agent to generate an authorization error fault for clients.
3ec4328f079d8867cc323155e59678ad9437914frooneg# Hot-Swap Enabled: Yes
de0d0b50c96fae59c28e09fed61b0d15cfa4147bchrisd#
de0d0b50c96fae59c28e09fed61b0d15cfa4147bchrisdcom.sun.identity.agents.config.webservice.enable = false
de0d0b50c96fae59c28e09fed61b0d15cfa4147bchrisdcom.sun.identity.agents.config.webservice.endpoint[0] =
de0d0b50c96fae59c28e09fed61b0d15cfa4147bchrisdcom.sun.identity.agents.config.webservice.process.get.enable = true
de0d0b50c96fae59c28e09fed61b0d15cfa4147bchrisdcom.sun.identity.agents.config.webservice.authenticator =
de0d0b50c96fae59c28e09fed61b0d15cfa4147bchrisdcom.sun.identity.agents.config.webservice.internalerror.content = WSInternalErrorContent.txt
de0d0b50c96fae59c28e09fed61b0d15cfa4147bchrisdcom.sun.identity.agents.config.webservice.autherror.content = WSAuthErrorContent.txt
cd59ac5e8f739afbdcd523c649550f7dce1709ceniq
db78659055df54243bca678c35bd2ce7e31a9237rooneg#
edf6757df85878dc8ce11fb3840ee4cde6de5b2frooneg# ACCESS DENIED URI
db78659055df54243bca678c35bd2ce7e31a9237rooneg# An application specific (MAP) property that specifies the URI used by
95817edd05387a5276f51fcd5db79fc21b89b55brooneg# the Agent to block unauthorized access requests. May be left unspecified
95817edd05387a5276f51fcd5db79fc21b89b55brooneg# if not available. A global value can also be specified.
95817edd05387a5276f51fcd5db79fc21b89b55brooneg# Example:
63689d77e084e36b8194fb6df5adfc0344965e01trawick# com.sun.identity.agents.config.access.denied.uri[BankApp] = /BankApp/accessdenied.html
63689d77e084e36b8194fb6df5adfc0344965e01trawick# com.sun.identity.agents.config.access.denied.uri = /accessdenied.html
63689d77e084e36b8194fb6df5adfc0344965e01trawick# Hot-Swap Enabled: Yes
63689d77e084e36b8194fb6df5adfc0344965e01trawick#
69c36bbae91de0e99a682aaae9d6fa61fceb2771bnicholescom.sun.identity.agents.config.access.denied.uri[] =
69c36bbae91de0e99a682aaae9d6fa61fceb2771bnicholes
69c36bbae91de0e99a682aaae9d6fa61fceb2771bnicholes#
69c36bbae91de0e99a682aaae9d6fa61fceb2771bnicholes# FORM LOGIN PROCESSING PROPERTIES
a1a615ca49b162d71d88089210395c9a9cfeb539rpluem# - login.form: A LIST property used by the Agent to identify login
8b67b9d3ce40755d1b58971198a02b2749d8e13dbnicholes# request and take appropriate action. Each entry should be the
8b67b9d3ce40755d1b58971198a02b2749d8e13dbnicholes# absolute URI of the resource specified in the web.xml deployment
8b67b9d3ce40755d1b58971198a02b2749d8e13dbnicholes# descriptor of the protected application in the element
69c36bbae91de0e99a682aaae9d6fa61fceb2771bnicholes# form-login-page.
a1a615ca49b162d71d88089210395c9a9cfeb539rpluem# - login.error.uri: A LIST property used by the Agent to identify
69c36bbae91de0e99a682aaae9d6fa61fceb2771bnicholes# error page request and take appropriate action. Each entry should
69c36bbae91de0e99a682aaae9d6fa61fceb2771bnicholes# be the absolute URI of the resource specified in the web.xml
69c36bbae91de0e99a682aaae9d6fa61fceb2771bnicholes# deployment descriptor of the protected application in the element
69c36bbae91de0e99a682aaae9d6fa61fceb2771bnicholes# form-error-page.
a1a615ca49b162d71d88089210395c9a9cfeb539rpluem# - login.use.internal: A flag that specifies if the Agent should use
69c36bbae91de0e99a682aaae9d6fa61fceb2771bnicholes# internal content for handling form login requests.
69c36bbae91de0e99a682aaae9d6fa61fceb2771bnicholes# - login.content.file: Specifies the name or complete path of the file
69c36bbae91de0e99a682aaae9d6fa61fceb2771bnicholes# that will be used by the Agent for handling form login requests if
69c36bbae91de0e99a682aaae9d6fa61fceb2771bnicholes# the login.use.internal flag is set to true.
69c36bbae91de0e99a682aaae9d6fa61fceb2771bnicholes# Hot-Swap Enabled: Yes
69c36bbae91de0e99a682aaae9d6fa61fceb2771bnicholes# Examples:
69c36bbae91de0e99a682aaae9d6fa61fceb2771bnicholes# com.sun.identity.agents.config.login.form[0] = /BankApp/jsp/login.jsp
69c36bbae91de0e99a682aaae9d6fa61fceb2771bnicholes# com.sun.identity.agents.config.login.error.uri[0] = /BankApp/jsp/error.jsp
69c36bbae91de0e99a682aaae9d6fa61fceb2771bnicholes#
69c36bbae91de0e99a682aaae9d6fa61fceb2771bnicholescom.sun.identity.agents.config.login.form[0] =
69c36bbae91de0e99a682aaae9d6fa61fceb2771bnicholescom.sun.identity.agents.config.login.error.uri[0] =
69c36bbae91de0e99a682aaae9d6fa61fceb2771bnicholescom.sun.identity.agents.config.login.use.internal = true
69c36bbae91de0e99a682aaae9d6fa61fceb2771bnicholescom.sun.identity.agents.config.login.content.file = FormLoginContent.txt
a1a615ca49b162d71d88089210395c9a9cfeb539rpluem
1b0dce86d7fc8a5aa4c89b05255be26e508c615crpluem#
1b0dce86d7fc8a5aa4c89b05255be26e508c615crpluem# LOCAL AUTHENTICATION PROCESSING PROPERTIES
1b0dce86d7fc8a5aa4c89b05255be26e508c615crpluem# - auth.handler: A MAP property that specifies application
1b0dce86d7fc8a5aa4c89b05255be26e508c615crpluem# specific Authentication Handler to be used by the the
edc5389f50ce4153e6192740f3c7a188c8cf8d67niq# Agent in order to authenticate the logged on user with the
edc5389f50ce4153e6192740f3c7a188c8cf8d67niq# Application server for the particular application.
6c05afd314b4ddd545d63b4ff5de822cc30eec79trawick# - logout.handler: A MAP property that specifies the application
6c05afd314b4ddd545d63b4ff5de822cc30eec79trawick# specific Logout Handler to be used by the Agent in order to logout
6c05afd314b4ddd545d63b4ff5de822cc30eec79trawick# the logged on user within the Application server for the
13cd67e9c1dacbd6b9f040bda337c725cedd98f3brianp# particular application.
13cd67e9c1dacbd6b9f040bda337c725cedd98f3brianp# - verification.handler: A MAP property that specifies the application
a623efbff95aab78da9e030524b0fa69b054f6d0brianp# specific local verification handler used by the agent to validate
a623efbff95aab78da9e030524b0fa69b054f6d0brianp# the user credentials with the local repository.
a623efbff95aab78da9e030524b0fa69b054f6d0brianp# Hot-Swap Enabled: Yes
a623efbff95aab78da9e030524b0fa69b054f6d0brianp# Example:
a623efbff95aab78da9e030524b0fa69b054f6d0brianp# com.sun.identity.agents.config.auth.handler[BankApp] = BankAuthHandler
a623efbff95aab78da9e030524b0fa69b054f6d0brianp# com.sun.identity.agents.config.logout.handler[BankApp] = BankLogoutHandler
0b4b04d8621478ba59f0a6ba2950ddc02ab92b58colm# com.sun.identity.agents.config.verification.handler[BankApp] = BankVerificationHandler
0b4b04d8621478ba59f0a6ba2950ddc02ab92b58colm#
0b4b04d8621478ba59f0a6ba2950ddc02ab92b58colmcom.sun.identity.agents.config.auth.handler[] =
2f1bb5376c5c4022383bb729679ca751dd75a2eabrianpcom.sun.identity.agents.config.logout.handler[] =
2f1bb5376c5c4022383bb729679ca751dd75a2eabrianpcom.sun.identity.agents.config.verification.handler[] =
ad862ab5716726a2d72a292ba1dfb29566c86153brianp
ad862ab5716726a2d72a292ba1dfb29566c86153brianp#
ad862ab5716726a2d72a292ba1dfb29566c86153brianp# HTTP SESSION BINDING
17d53ea32c4968e47733f1c2c063ae07d280efd6jerenkrantz# Its default value is false so the agent will not invalidate http session,
17d53ea32c4968e47733f1c2c063ae07d280efd6jerenkrantz# and session data will be maintained.
17d53ea32c4968e47733f1c2c063ae07d280efd6jerenkrantz# If its value is true, then the agent will invalidate the http session when
2d5532b13110a8d85653da92e97795b09cc25cc2trawick# the agent identifies that login has failed, user does not have SSO session
b38565306421ff53e9f7499bc728d6df5cec294dpquerna# or pincipal user name does not match SSO user name.
b38565306421ff53e9f7499bc728d6df5cec294dpquerna# Hot-Swap Enabled: Yes
b38565306421ff53e9f7499bc728d6df5cec294dpquernacom.sun.identity.agents.config.httpsession.binding = false
b38565306421ff53e9f7499bc728d6df5cec294dpquerna
74499a117b3b2cd9666715a14f90c0e5d1a4ee8ajim#
74499a117b3b2cd9666715a14f90c0e5d1a4ee8ajim# GOTO PARAMETER NAME
cfa64348224b66dd1c9979b809406c4d15b1c137fielding# This property has been deprecated.
74499a117b3b2cd9666715a14f90c0e5d1a4ee8ajim# Specifies the goto Parameter name to be used by the Agent when
cfa64348224b66dd1c9979b809406c4d15b1c137fielding# redirecting the user to the appropriate authentication service. The
74499a117b3b2cd9666715a14f90c0e5d1a4ee8ajim# value of this parameter is used by the authentication service to
cfa64348224b66dd1c9979b809406c4d15b1c137fielding# redirect the user to the original requested destination.
74499a117b3b2cd9666715a14f90c0e5d1a4ee8ajim# Valid Values:
cfa64348224b66dd1c9979b809406c4d15b1c137fielding# A string value that represents the goto parameter name.
74499a117b3b2cd9666715a14f90c0e5d1a4ee8ajim# Hot-Swap Enabled: Yes
cfa64348224b66dd1c9979b809406c4d15b1c137fielding#
74499a117b3b2cd9666715a14f90c0e5d1a4ee8ajimcom.sun.identity.agents.config.redirect.param = goto
cfa64348224b66dd1c9979b809406c4d15b1c137fielding
74499a117b3b2cd9666715a14f90c0e5d1a4ee8ajim#
# LOGIN URL
# Specifies the login URLs to be used by the Agent to redirect
# incoming users without sufficient credentials to the OpenAM
# authentication service.
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.login.url[0] = @AM_SERVICES_PROTO@://@AM_SERVICES_HOST@:@AM_SERVICES_PORT@@AM_SERVICES_DEPLOY_URI@/UI/Login
#
# LOGOUT URL
# Specifies the logout URLs to be used by the Agent to log out
# the authenticated users from the OpenAM authentication service.
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.logout.url[0] = @AM_SERVICES_PROTO@://@AM_SERVICES_HOST@:@AM_SERVICES_PORT@@AM_SERVICES_DEPLOY_URI@/UI/Logout
#
# LOGIN URL, LOGOUT URL, or CDSSO URLs PROPERTIES
# - login.url.prioritized: specifies if the failover sequence for Login URLs
# or CDSSO URLs should be prioritized as defined in the list with the lowest
# index having the highest priority.
# - login.url.probe.enabled: specifies if agent will check the availability
# of these urls before redirecting to them.
# Default value is true for backward compability, but suggests to set it
# to false (server will not be checked) in production deployment where agent
# often can not access login url directly.
# - login.url.probe.timeout: this is the connect timeout value in milliseconds
# when login.url.probe.enabled is set to true (or server will be checked).
# - logout.url.prioritized: specifies if the failover sequence for Logout
# URLs should be prioritized as defined in the list with the lowest
# index having the highest priority.
# - logout.url.probe.enabled: specifies if agent will check the availability
# of these urls before redirecting to them.
# Default value is true for backward compability, but suggests to set it
# to false (server will not be checked) in production deployment where agent
# often can not access logout url directly.
# - logout.url.probe.timeout: this is the connect timeout value in milliseconds
# when logout.url.probe.enabled is set to true (or server will be checked).
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.login.url.prioritized = true
com.sun.identity.agents.config.login.url.probe.enabled = true
com.sun.identity.agents.config.login.url.probe.timeout = 2000
com.sun.identity.agents.config.logout.url.prioritized = true
com.sun.identity.agents.config.logout.url.probe.enabled = true
com.sun.identity.agents.config.logout.url.probe.timeout = 2000
#
# AGENT SERVER PROPERTIES
# - agent.host: The host name identifying the Agent protected server to
# the client browsers if different from the actual host name. May be
# left blank if not used.
# - agent.port: The port number identifying the Agent protected server
# listening port to the client browsers if different from the actual
# listening port. May be left blank if not used.
# - agent.protocol: The protocol being used (http/https) by the client
# browsers to communicate with the Agent protected server if different
# from the actual protocol used by the server.
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.agent.host =
com.sun.identity.agents.config.agent.port =
com.sun.identity.agents.config.agent.protocol =
#
# LOGIN ATTEMPT LIMIT
# Specifies the number of login attempts that a user can make without
# success using a single browser session which will trigger the
# blocking of the user request. Setting this value to 0 disables this
# feature.
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.login.attempt.limit = 0
# SSO Cache Enable Flag:
# This property specifies if the SSO Cache is active for the agent. This cache
# is used through public APIs exposed by the agent SDK.
# Valid Values: true, false
# Hot-Swap Enabled: Yes
com.sun.identity.agents.config.amsso.cache.enable = true
#
# COOKIE RESET PROCESSING PROPERTIES
# - cookie.reset.enable: A flag that specifies if cookie reset processing
# is enabled or disabled.
# - cookie.reset.name: A list of cookie names that will be reset by the
# Agent if cookie reset processing is enabled.
# - cookie.reset.domain: A MAP property with the key being the cookie name
# specified in cookie.reset.name property and the value being the domain
# of this cookie to be used when a reset event occurs.
# - cookie.reset.path: A MAP property with the key being the cookie name
# specified in cookie.reset.name property and the value being the path
# of this cookie to be used when a reset event occurs.
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.cookie.reset.enable = false
com.sun.identity.agents.config.cookie.reset.name[0] =
com.sun.identity.agents.config.cookie.reset.domain[] =
com.sun.identity.agents.config.cookie.reset.path[] =
#
# CDSSO PROCESSING PROPERTIES
# - cdsso.enable: A flag that specifies if CDSSO processing is
# enabled or disabled.
# - cdsso.redirect.uri: An intermediate URI that is used by the
# Agent for processing CDSSO requests.
# - cdsso.cdcservlet.url: A LIST of URLs of the available CDSSO controllers
# that may be used by the Agent for CDSSO processing.
# - cdsso.clock.skew: Specifies a time in seconds to be used by the
# Agent to determine the validity of the CDSSO AuthnResponse assertion.
# - cdsso.trusted.id.providers: This property specifies the OpenAM
# Server/ID providers that should be trusted by the agent, when evaluating
# the CDC Liberty Responses. Used when a Load Balancer/Firewall is between
# the agent & server.
# - cdsso.domain: This property specifies the domains for which cookies have
# to be set in a CDSSO scenario. If this property is left blank then the
# fully qualified cookie domain for the agent server will be used for
# setting the cookie domain. In such case it is a host cookie instead of
# a domain cookie.
# Example:
# com.sun.identity.agents.config.cdsso.domain[0] = .sun.com
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.cdsso.enable = false
com.sun.identity.agents.config.cdsso.redirect.uri = @AGENT_APP_URI@/sunwCDSSORedirectURI
com.sun.identity.agents.config.cdsso.cdcservlet.url[0] = @AM_SERVICES_PROTO@://@AM_SERVICES_HOST@:@AM_SERVICES_PORT@@AM_SERVICES_DEPLOY_URI@/cdcservlet
com.sun.identity.agents.config.cdsso.clock.skew = 0
com.sun.identity.agents.config.cdsso.trusted.id.provider[0] = @AM_SERVICES_PROTO@://@AM_SERVICES_HOST@:@AM_SERVICES_PORT@@AM_SERVICES_DEPLOY_URI@/cdcservlet
#com.sun.identity.agents.config.cdsso.domain[0] =
#
# LOGOUT PROCESSING PROPERTIES
# - logout.application.handler: An application specific (MAP) property
# that identifies a handler to be used for logout processing.
# - logout.uri: An application specific (MAP) property that identifies
# a request URI which indicates a logout event.
# - logout.request.param: An application specific (MAP) property that
# identifies a parameter which when present in the HTTP request
# indicates a logout event.
# - logout.introspect.enabled: A flag that when set allows the Agent
# to search HTTP request body to locate logout parameter.
# - logout.entry.uri: An application specific (MAP) property that identifies
# a URI to be used as an entry point after successful logout and
# subsequent successful authentication if applicable.
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.logout.application.handler[] =
com.sun.identity.agents.config.logout.uri[] =
com.sun.identity.agents.config.logout.request.param[] =
com.sun.identity.agents.config.logout.introspect.enabled = false
com.sun.identity.agents.config.logout.entry.uri[] =
#
# FQDN PROCESSING PROPERTIES
# - fqdn.check.enable: A flag that indicates if FQDN checking is enabled
# or not.
# - fqdn.default: A hostname that represents the default FQDN to be
# used by the Agent when necessary.
# - fqdn.mapping: A MAP property that specifies a mapping from an invalid
# FQDN entry specified as the key to a valid FQDN entry specified as
# its value.
# Hot-Swap Enabled: Yes
# Examples of fqdn.mapping:
# com.sun.identity.agents.config.fqdn.mapping[myserver]=myserver.mydomain.com
#
com.sun.identity.agents.config.fqdn.check.enable = true
com.sun.identity.agents.config.fqdn.default = @AGENT_HOST@
com.sun.identity.agents.config.fqdn.mapping[] =
#
# LEGACY USER AGENT PROCESSING PROPERTIES
# These three properties have been deprecated:
# - legacy.support.enable: A flag that specifies if legacy user agent
# support is enabled or disabled.
# - legacy.user.agent: A LIST of user agent header values that identify
# legacy browsers. Entries in this list can have wild card character '*'.
# - legacy.redirect.uri: An intermediate URI used by the Agent to
# redirect legacy user agent requests.
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.legacy.support.enable = false
com.sun.identity.agents.config.legacy.user.agent[0] = Mozilla/4.7*
com.sun.identity.agents.config.legacy.redirect.uri = @AGENT_APP_URI@/sunwLegacySupportURI
#
# CUSTOM RESPONSE HEADERS
# A MAP property that specifies the custom headers that are set by
# the Agent on the client browser. The key is the header name and the
# value represents the header value.
# Hot-Swap Enabled: Yes
# Example:
# com.sun.identity.agents.config.response.header[Cache-Control] = no-cache
#
com.sun.identity.agents.config.response.header[] =
#
# REDIRECT ATTEMPT LIMIT
# Specifies the number of successive single point redirects that a
# user can make using a single browser session which will trigger the
# blocking of the user request. When set to 0 this feature is disabled.
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.redirect.attempt.limit = 0
#
# PORT CHECK PROCESSING PROPERTIES
# - port.check.enable: A flag that indicates if port check functionality
# is enabled or disabled.
# - port.check.file: Specifies the name or complete path of a file that
# has the necessary content needed to handle requests that need port
# correction.
# - port.check.setting: A MAP of port versus protocol entries with the
# key being the listening port number and value being the listening
# protocol to be used by the Agent to identify requests with invalid
# port numbers.
# Hot-Swap Enabled: Yes
# Example of port.check.setting:
# com.sun.identity.agents.config.port.check.setting[80] = http
# com.sun.identity.agents.config.port.check.setting[443] = https
#
com.sun.identity.agents.config.port.check.enable = false
com.sun.identity.agents.config.port.check.file = PortCheckContent.txt
com.sun.identity.agents.config.port.check.setting[@AGENT_PREF_PORT@] = @AGENT_PREF_PROTO@
#
# NOT-ENFORCED URI PROCESSING PROPERTIES
# - notenforced.uri: A LIST of URIs for which protection is not enforced
# by the Agent.
# - notenforced.uri.invert: A flag that specifies if the list of URIs
# specified by the property notenforced.uri should be inverted. When
# set to true, it indicates that the URIs specified should be enforced
# and all other URIs should be not enforced by the Agent. Entries in
# this list can have wild card character '*'.
# - notenforced.uri.cache.enable: A flag that specifies if the caching of
# of not-enforced URI list evaluation results is enabled or disabled.
# - notenforced.uri.cache.size: The size of the cache to be used if
# caching of not-enforced URI list evaluation results is enabled.
# - notenforced.refresh.session.idletime: A flag that specifies if the opensso
# session idle time is reset or not when accessing the not enforced URIs.
# Hot-Swap Enabled: Yes
# Example of notenforced.uri:
# com.sun.identity.agents.config.notenforced.uri[0]=*.gif
# com.sun.identity.agents.config.notenforced.uri[1]=/public/*
# com.sun.identity.agents.config.notenforced.uri[2]=/images/*
#
com.sun.identity.agents.config.notenforced.uri[0] =
com.sun.identity.agents.config.notenforced.uri.invert = false
com.sun.identity.agents.config.notenforced.uri.cache.enable = true
com.sun.identity.agents.config.notenforced.uri.cache.size = 1000
com.sun.identity.agents.config.notenforced.refresh.session.idletime = false
#
# NOT-ENFORCED CLIENT IP PROCESSING PROPERTIES
# - notenforced.ip: A LIST of client IP addresses for which protection is
# not enforced by the Agent.
# - notenforced.ip.invert: A flag that specifies if the list of client IP
# addresses specified by the property notenforced.ip should be inverted.
# When set to true, it indicates that the client IP addresses specified
# should be enforced and all other client IPs should be not enforced by
# the Agent. Entries in this list can have wild card character '*'.
# - notenforced.ip.cache.enable: A flag that specifies if the caching of
# of not-enforced IP list evaluation results is enabled or disabled.
# - notenforced.ip.cache.size: The size of the cache to be used if
# caching of not-enforced IP list evaluation results is enabled.
# Hot-Swap Enabled: Yes
# Example of notenforced.ip:
# com.sun.identity.agents.config.notenforced.ip[0]=192.18.145.*
# com.sun.identity.agents.config.notenforced.ip[1]=192.18.146.123
#
com.sun.identity.agents.config.notenforced.ip[0] =
com.sun.identity.agents.config.notenforced.ip.invert = false
com.sun.identity.agents.config.notenforced.ip.cache.enable = true
com.sun.identity.agents.config.notenforced.ip.cache.size = 1000
#
# COMMON ATTRIBUTE FETCH PROCESSING PROPERTIES
# - attribute.cookie.separator: A character that will be used to separate
# multiple values of the same attribute when it is being set as a cookie.
# - attribute.cookie.encode: A flag that indicates if the value of the
# attribute should be URL encoded before being set as a cookie.
# - attribute.date.format: The format of date attribute values to be used
# when the attribute is being set as HTTP header. This format is based
# on the definition as provided in java.text.SimpleDateFormat.
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.attribute.cookie.separator = |
com.sun.identity.agents.config.attribute.date.format = EEE, d MMM yyyy hh:mm:ss z
com.sun.identity.agents.config.attribute.cookie.encode = true
#
# PROFILE ATTRIBUTE PROCESSING PROPERTIES
# - profile.attribute.fetch.mode: The mode of fetching profile attributes.
# This value is one of: NONE, HTTP_HEADER, REQUEST_ATTRIBUTE, HTTP_COOKIE
# - profile.attribute.mapping: A MAP that specifies the profile attributes to
# be populated under specific names for the currently authenticated user.
# The key is the profile attribute name and the value is the name under
# which that attribute will be made available.
# Hot-Swap Enabled: Yes
# Example of profile.attribute.mapping:
# com.sun.identity.agents.config.profile.attribute.mapping[cn]=CUSTOM-Common-Name
# com.sun.identity.agents.config.profile.attribute.mapping[mail]=CUSTOM-Email
#
com.sun.identity.agents.config.profile.attribute.fetch.mode = NONE
com.sun.identity.agents.config.profile.attribute.mapping[] =
#
# SESSION ATTRIBUTE PROCESSING PROPERTIES
# - session.attribute.fetch.mode: The mode of fetching session attributes.
# This value is one of: NONE, HTTP_HEADER, REQUEST_ATTRIBUTE, HTTP_COOKIE
# - session.attribute.mapping: A MAP that specifies the session attributes to
# be populated under specific names for the currently authenticated user.
# The key is the session attribute name and the value is the name under
# which that attribute will be made available.
# Hot-Swap Enabled: Yes
# Example of session.attribute.mapping:
# com.sun.identity.agents.config.session.attribute.mapping[UserToken]=CUSTOM-userid
#
com.sun.identity.agents.config.session.attribute.fetch.mode = NONE
com.sun.identity.agents.config.session.attribute.mapping[] =
#
# RESPONSE ATTRIBUTE PROCESSING PROPERTIES
# - response.attribute.fetch.mode: The mode of fetching policy response
# attributes. This value is one of: NONE, HTTP_HEADER, REQUEST_ATTRIBUTE,
# HTTP_COOKIE
# - response.attribute.mapping: A MAP that specifies the policy response
# attributes to be populated under specific names for the currently
# authenticated user. The key is the policy response attribute name and
# the value is the name under which that attribute will be made available.
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.response.attribute.fetch.mode = NONE
com.sun.identity.agents.config.response.attribute.mapping[] =
#
# BYPASS PRINCIPAL LIST
# This property specifies a list of principals that is bypassed by the
# Agent for authentication and search purposes.
# Hot-Swap Enabled: Yes
# Example:
# com.sun.identity.agents.config.bypass.principal[0] = guest
# com.sun.identity.agents.config.bypass.principal[1] = testuser
#
com.sun.identity.agents.config.bypass.principal[0] =
#
# PRIVILEGED ATTRIBUTE PROCESSING PROPERTIES
# - default.privileged.attribute: A list of privileged attributes that will
# be granted to all users who have a valid OpenAM session.
# - privileged.attribute.type: A list of privileged attribute types that will
# be fetched for each user.
# - privileged.attribute.tolowercase : A MAP property that specifies if the
# privileged attribute types should be converted to lowercase.
# - privileged.session.attribute: A list of session property names which
# hold privileged attributes for the authenticated user.
# Hot-Swap Enabled: Yes
# Examples:
# com.sun.identity.agents.config.default.privileged.attribute[0] = AUTHENTICATED_USERS
# com.sun.identity.agents.config.privileged.attribute.type[0] = Group
# com.sun.identity.agents.config.privileged.attribute.tolowercase[Group] = false
# com.sun.identity.agents.config.privileged.session.attribute[0] = UserToken
# com.sun.identity.agents.config.privileged.attribute.mapping.enable=true
# com.sun.identity.agents.config.privileged.attribute.mapping[id\=manager,ou\=group,dc\=openam,dc\=forgerock,dc\=org] = am_manager_role
# com.sun.identity.agents.config.privileged.attribute.mapping[id\=employee,ou\=group,dc\=openam,dc\=forgerock,dc\=org] = am_employee_role
#
com.sun.identity.agents.config.default.privileged.attribute[0] = AUTHENTICATED_USERS
com.sun.identity.agents.config.privileged.attribute.type[0] = Group
com.sun.identity.agents.config.privileged.attribute.type[1] = Role
com.sun.identity.agents.config.privileged.attribute.tolowercase[Group] = false
com.sun.identity.agents.config.privileged.attribute.tolowercase[Role] = false
com.sun.identity.agents.config.privileged.session.attribute[0] =
com.sun.identity.agents.config.privileged.attribute.mapping.enable = true
com.sun.identity.agents.config.privileged.attribute.mapping[] =
#
# SSO TOKEN COOKIE NAME
# The name of the SSO Token cookie used between the OpenAM server and
# the Agent.
# Hot-Swap Enabled: No
com.iplanet.am.cookie.name=iPlanetDirectoryPro
#
# SESSION CLIENT PROPERTIES
# - com.iplanet.am.session.client.polling.enable: A flag that specifies if
# the session client must use polling for updating session information
# and not depend upon server notifications.
# - com.iplanet.am.session.client.polling.period: Specifies the time in
# seconds after which the session client will request update of cached
# session information from the server.
#
# Note: the notification url to be used by the Agent to receive session
# notifications is com.sun.identity.client.notification.url
# Hot-Swap Enabled: No
#
com.iplanet.am.session.client.polling.enable=false
com.iplanet.am.session.client.polling.period=180
#
# ENCRYPTION PROVIDER
# Specifies the encryption provider implementation to be used by the Agent.
# Hot-Swap Enabled: No
#
com.iplanet.security.encryptor=com.iplanet.services.util.JCEEncryption
#
# USER DATA CACHE PROPERTIES
# - com.sun.identity.idm.remote.notification.enabled: A flag that is used to
# enable/disable the notifications for amsdk and IdRepo Caches. If set to
# true notifications are enabled and disabled if set to false.
# - com.iplanet.am.sdk.remote.pollingTime: Cache update time in minutes for
# user management data. If set to '0' no updates happen. This property
# takes effect only if no notification url is provided by
# 'com.sun.identity.client.notification.url' or if notifications are
# disabled. (i.e., com.sun.identity.idm.remote.notification.enabled=false)
# Hot-Swap Enabled: No
#
com.sun.identity.idm.remote.notification.enabled=true
com.iplanet.am.sdk.remote.pollingTime=1
#
# SERVICE DATA CACHE PROPERTIES
# - com.sun.identity.sm.notification.enabled: A flag that is used to
# enable/disable the notifications for service management caches. If set to
# true notifications are enabled and disabled if set to false.
# - com.sun.identity.sm.cacheTime: Cache update time in minutes for service
# configuration data. If set to '0' no updates happen. This property
# takes effect only if no notification url is provided by
# 'com.sun.identity.client.notification.url' or if notifications are
# disabled. (i.e., com.sun.identity.sm.notification.enabled=false).
# Hot-Swap Enabled: No
#
com.sun.identity.sm.notification.enabled=true
com.sun.identity.sm.cacheTime=1
#
# AUTHENTICATION SERVICE PROPERTIES
# Server protocol, host and port to be used by Authentication Service.
# Hot-Swap Enabled: No
#
com.iplanet.am.server.protocol=@AM_SERVICES_PROTO@
com.iplanet.am.server.host=@AM_SERVICES_HOST@
com.iplanet.am.server.port=@AM_SERVICES_PORT@
#
# POLICY CLIENT PROPERTIES
# - com.sun.identity.agents.notification.enabled: A flag that specifies
# if notifications are enabled or disabled for remote policy client.
# - com.sun.identity.agents.polling.interval: The duration in minutes
# after which the cached entries are refreshed by remote policy client.
# - com.sun.identity.policy.client.cacheMode: The mode of caching to be
# used by remote policy client. Valid value is one of: subtree, self.
# Cache mode subtree is recommended for a small number of policy rules
# In all other cases, cacheMode self is recommended.
# - com.sun.identity.policy.client.booleanActionValues : boolean action
# values for policy action names.
# format : serviceName|actionName|trueValue|falseValue
# - com.sun.identity.policy.client.resourceComparators: Resource Comparators
# to be used for different service names.
# - com.sun.identity.policy.client.clockSkew: Specifies time in seconds
# which is allowed to accommodate the time difference between the
# OpenAM server machine and the remote policy client machine.
#
# Note: the Notification URL for remote policy client is set by the
# property com.sun.identity.client.notification.url.
# Hot-Swap Enabled: No
#
com.sun.identity.agents.notification.enabled=true
com.sun.identity.agents.polling.interval=3
com.sun.identity.policy.client.cacheMode=subtree
com.sun.identity.policy.client.booleanActionValues=iPlanetAMWebAgentService|GET|allow|deny:iPlanetAMWebAgentService|POST|allow|deny
com.sun.identity.policy.client.resourceComparators=serviceType=iPlanetAMWebAgentService|class=com.sun.identity.policy.plugins.HttpURLResourceName|wildcard=*|delimiter=/|caseSensitive=false
com.sun.identity.policy.client.clockSkew=10
#
# URL POLICY ENVIRONMENT VARIABLE PROPERTIES
# - com.sun.identity.agents.config.policy.env.get.param: A list of HTTP GET
# request parameters whose names and values will be set in the environment
# map for URL policy evaluation at AM server. The key in the map is in the
# format of GET.<parameter-name>, the map value is a set of string values
# of the parameter.
# - com.sun.identity.agents.config.policy.env.post.param: A list of HTTP POST
# request parameters whose names and values will be set in the environment
# map for URL policy evaluation at AM server. The key in the map is in the
# format of POST.<parameter-name>, the map value is a set of string values
# of the parameter.
# - com.sun.identity.agents.config.policy.env.jsession.param: A list of
# HTTP SESSION attributes whose names and values will be set in the
# environment map for URL policy evaluation at AM server. The key in the
# map is in the format of JSESSION.<parameter-name>, the map value is a
# set that contains the string value of the parameter.
# Hot-Swap Enabled: Yes
#
# Examples:
# com.sun.identity.agents.config.policy.env.get.param[0]=name
# com.sun.identity.agents.config.policy.env.get.param[1]=phonenumber
# com.sun.identity.agents.config.policy.env.jsession.param[0]=cardnumber
# Assuming HTTP GET request parameters "name" and "phonenumber" have their
# values as "bob" and "1-800-123-4567" respectively. There is a HTTP Session
# attribute "cardnumber" with its value as "12345678".
# In the map, the following will be set:
# GET.name => [bob]
# GET.phonenumber => [1-800-123-4567]
# JSESSION.cardnumber => [12345678]
#
com.sun.identity.agents.config.policy.env.get.param[0]=
com.sun.identity.agents.config.policy.env.post.param[0]=
com.sun.identity.agents.config.policy.env.jsession.param[0]=
# AGENT NOTIFICATION URL PROPERTY
# -com.sun.identity.client.notification.url: URL for agent to receive
# notifications from the OpenAM server for session, policy, and
# configuration changes.
# Hot-Swap Enabled: No
#
com.sun.identity.client.notification.url=@AGENT_PREF_PROTO@://@AGENT_HOST@:@AGENT_PREF_PORT@@AGENT_APP_URI@/notification
#
# DEBUG SERVICE PROPERTY
# - com.iplanet.services.debug.level: Specifies the debug level to be used.
# The value is one of: off, error, warning, message.
# Hot-Swap Enabled: Yes
#
com.iplanet.services.debug.level=@DEBUG_LEVEL@
#
# IGNORE REQUEST URL PATH INFO
# The path info will be stripped from the request URL while doing Not Enforced
# List check and url policy evaluation if the value is set to true.
#
# Hot-Swap Enabled: Yes
#
com.sun.identity.agents.config.ignore.path.info = false