<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE chapter [

<!ELEMENT chapter (title|indexterm|para|itemizedlist|section)*>

<!ATTLIST chapter

xml:id CDATA #REQUIRED

xmlns CDATA #REQUIRED

version CDATA #REQUIRED

xml:lang CDATA #REQUIRED

xmlns:xsi CDATA #REQUIRED

xsi:schemaLocation CDATA #REQUIRED

xmlns:xlink CDATA #REQUIRED

xmlns:xinclude CDATA #REQUIRED>

<!ELEMENT title (#PCDATA)>

<!ELEMENT indexterm (primary|secondary|tertiary)*>

<!ELEMENT primary (#PCDATA)>

<!ELEMENT para (literal|link|citetitle|replaceable)*>

<!ELEMENT literal (#PCDATA)>

<!ELEMENT link (citetitle)*>

<!ATTLIST link

xlink:href CDATA #REQUIRED

xlink:role CDATA #IMPLIED

xlink:show CDATA #IMPLIED>

<!ELEMENT itemizedlist (para|listitem)*>

<!ELEMENT listitem (para)*>

<!ELEMENT citetitle (#PCDATA)>

<!ELEMENT section (title|indexterm|para|variablelist)*>

<!ATTLIST section

xml:id CDATA #REQUIRED>

<!ELEMENT secondary (#PCDATA)>

<!ELEMENT tertiary (#PCDATA)>

<!ELEMENT variablelist (varlistentry|para)*>

<!ELEMENT varlistentry (term|listitem)*>

<!ELEMENT term (literal)*>

<!ELEMENT replaceable (#PCDATA)>

]>

<chapter xml:id='chap-endpoints'

xmlns='http://docbook.org/ns/docbook'

version='5.0' xml:lang='en'

xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'

xsi:schemaLocation='http://docbook.org/ns/docbook http://docbook.org/xml/5.0/xsd/docbook.xsd'

xmlns:xlink='http://www.w3.org/1999/xlink'

xmlns:xinclude='http://www.w3.org/2001/XInclude'>

<title>Service Endpoints</title>

<indexterm><primary>Endpoints</primary></indexterm>

<para>A service endpoint is a URL which serves as the access port for a web service. It may be a standard HTML-based

web page, or it may be a *.jsp page.</para>

<para>As every service endpoint is a potential security issue, it may be appropriate to

restrict access to some of those endpoints that you do not use. But be careful.

Some endpoints, such as <literal>isAlive.jsp</literal> in the main /path/to/tomcat/webapps/openam directory, are

essential and should not be blocked or changed.</para>

<para>Given the large number

of available endpoints, this chapter has been organized primarily by subdirectory.

Most of the directories were created when the OpenAM war archive was copied to the appropriate web application

container, such as the webapps/ subdirectory. </para>

<para>OpenAM may expose several hundred service endpoints, listed in this chapter.

Each endpoint shown is listed relative to the deployment URL.

For example, if you have deployed OpenAM at <literal>https://openam.example.com:8443/openam/</literal>,

the full URL to the <literal>isAlive.jsp</literal> endpoint is

<literal>https://openam.example.com:8443/openam/isAlive.jsp</literal>.</para>

<para>OpenAM includes two types of endpoints. One is based on URL patterns, shown with the <literal>url-pattern</literal>

tag. You can find these patterns in the web.xml file, in the /path/to/tomcat/webapps/openam/WEB-INF directory.

The other type is based on *.jsp pages, starting in the main /path/to/tomcat/webapps/openam directory, and also

in many associated subdirectories. If you copied or created a WAR archive to a name other than <literal>openam.war</literal>,

as described in the installation guide, substitute for the second <literal>openam</literal> accordingly.</para>

<para>Some of these endpoints can be applied directly to a URL when you've connected to the OpenAM server;

for example, if you've configured OpenAM on <literal>http://idp.example.com:8080/openam</literal>, you

can log in and review debug options by navigating to <literal>http://idp.example.com:8080/openam/Debug.jsp

</literal></para>

<para>Other endpoints can only be used when called by some option in the OpenAM console. For example, while the

AgentAdd.jsp endpoint exists in the console/agentconfig subdirectory, you would get an error by navigating directly

to a URL such as <literal>http://sp.example.com:8080/openam/console/agentconfig/AgentAdd.jsp</literal>. For that

particluar endpoint, you'll have click through the options required to add an agent. (Access Control &gt;

<replaceable>realm name</replaceable> &gt; Agents &gt; Agent &gt; New)</para>

<para>In general, this chapter does not include dynamic endpoints, such as those that may include security

tokens. The endpoints described in this chapter are based on files included in the installation of an OpenAM

server.</para>

<para>There have been two security advisories related to OpenAM endpoints: <link xlink:show="new"

xlink:href="http://www.forgerock.org/security_advisory1.html">OpenAM Security Advisory #201203</link> and

<link xlink:show="new"

xlink:href="http://www.forgerock.org/security_advisory2.html">OpenAM Security Advisory #201204</link>

</para>

<itemizedlist>

<para>Several options are available for endpoints at risk. Recommendations from the noted security advisories

include the following:</para>

<listitem>

<para>Filter requests to prevent or restrict access to vulnerable endpoints with a reverse proxy or

equivalent hardware device. Such options can be configured to limit access by IP address or

fully-qualified domain name.</para>

</listitem>

<listitem>

<para>Use a patch. If available, download links should be listed in the security advisory. The patch

may be limited to one or more endpoint files.</para>

</listitem>

<!--

<listitem>

<para>Remove access from the configuration. If a problematic endpoint is configured in the web.xml file of

the aforementioned WEB-INF subdirectory, you can remove the section that points to that endpoint.</para>

</listitem>

<listitem>

<para>Remove the endpoint file from the configuration. Some endpoint files, such as proxy.jsp or ssoadm.jsp,

are not essential to the basic operation of OpenAM.</para>

</listitem>

</itemizedlist>

<para>Of course, you can take additional steps to help secure your OpenAM deployment. For more information, see the

the chapter on <link xlink:href="admin-guide#chap-securing"

xlink:role="http://docbook.org/xlink/role/olink">

<citetitle>Securing OpenAM in the Administration Guide</citetitle></link>.</para>

<!--

<section xml:id="jsp-endpoints">

<title>JSP Endpoints</title>

<indexterm>

<primary>Endpoints</primary>

<secondary>JSP</secondary>

</indexterm>

<para>The OpenAM WAR archive includes *.jsp files in a number of different categories. Many are associated with the

applicable subdirectory, such as console/realm. The following sections will examine each *.jsp file, divided by

subdirectories.</para>

<para>In some highlighted cases, the noted *.jsp file appears in the code for one or more .java files. If you remove

the noted *.jsp file from the container, there is a risk that will break some functionality within OpenAM. In other

cases, such as any files related to the GUI installation wizard, the applicable *.jsp file can be safely removed

from a production system.</para>

</section>

<!-- Mark, I guess I need to do something else to set up tertiary numbering? I was hoping that Main Directory

<section xml:id="maindirectory-jsp-endpoints">

<title>Main Directory JSP Endpoints</title>

<indexterm>

<primary>Endpoints</primary>

<secondary>JSP</secondary>

<tertiary>Main Directory</tertiary>

</indexterm>

<para>If you're working in Tomcat, you'll find the endpoints in this subsection in the

/path/to/tomcat/webapps/openam directory. For other web application containers, you may find the endpoints

in a different openam subdirectory.</para>

<variablelist>

<varlistentry>

<term><literal>Debug.jsp</literal></term>

<listitem>

<para>Supports debug logging by service. For more information, see the <citetitle>Administration Guide</citetitle>

chapter on <link xlink:href="admin-guide#chap-monitoring#log-debug-selective-capture"

xlink:role="http://docbook.org/xlink/role/olink">

<citetitle>Debug Logging by Service.</citetitle></link></para>

</listitem>

</varlistentry>

<!-- Don't close the variablelist for each entry. -->

<varlistentry>

<term><literal>encode.jsp</literal></term>

<listitem>

<para>Enables access to a page that encodes text passwords. The algorithm is based on PBEWithMD5AndDES,

password-based encryption (PBE) using the MD5 message-digest algorithm, configured with the data encryption

standard (DES)</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>getServerInfo.jsp</literal></term>

<listitem>

<para>Supports requests for server information. As getServerInfo.jsp is encoded in some .java files, you should

retain getServerInfo.jsp in your deployment.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>isAlive.jsp</literal></term>

<listitem>

<para>Verifies the current status of the OpenAM service; the "Server is ALIVE:" message also verifies

activity on OpenAM systems behind load balancers. This can be a useful tool in a production environment.</para>

<!-- Verified with Allan -->

</listitem>

</varlistentry>

<varlistentry>

<term><literal>nowritewarning.jsp</literal></term>

<listitem>

<para>Displays a permission error message, used by the GUI-based installation wizard.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>proxyidpfinder.jsp</literal></term>

<listitem>

<para>Supports access to a remote identity provider, through the federation broker.</para>

<!-- Per the wiki, consistent with the comments in proxyidpfinder.jsp -->

</listitem>

</varlistentry>

<varlistentry>

<term><literal>services.jsp</literal></term>

<listitem>

<para>Lists active services within OpenAM. The details shown on this page can be used with the

<literal>ssoadm</literal> command to create a second OpenAM server with matching services. Be aware, the

amadmin administrative user is hard-coded into this file. If you change the identity of the administrative user

to something other than amadmin, that user won't have access to services.jsp.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>showServerConfig.jsp</literal></term>

<listitem>

<para>Specifies configuration information for the system, including the URL, the OS, the Java VM, the

configuration directory, and more.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ssoadm.jsp</literal></term>

<listitem>

<para>Supports GUI-based access to the options associated with the <literal>ssoadm</literal> command.

The ssoadm.jsp file is disabled by default. Instructions for enabling this feature are available from

the <citetitle>Administration Guide</citetitle> entry on <link xlink:show="new" xlink:href=

"admin-guide#chap-admin-tools#openam-ssoadm-jsp-overview"

xlink:role="http://docbook.org/xlink/role/olink"><citetitle>OpenAM ssoadm.jsp.</citetitle></link></para>

</listitem>

</varlistentry>

<para>All of the validat*.jsp files near the end of this list relate to testing and verifying federation. It requires

at least one identity

provider (IDP) and one service provider (SP). At least one of these components must be configured remotely to set up

a valid Circle of Trust (COT). If federation does not apply to your configuration, the validat*.jsp files

are not essential to your configuration.</para>

<varlistentry>

<term><literal>validateWait.jsp</literal></term>

<listitem>

<para>May be called by the validator.jsp or validatorMain.jsp files, to display progress in verifying the status

of federation.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>validator.jsp</literal></term>

<listitem>

<para>Refers to the ValidateSAML2 function to identify the realm, IdP and SP for the federation.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>validatorAuthFail.jsp</literal></term>

<listitem>

<para>Starts an "Authentication Failed" message.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>validatorFooter.jsp</literal></term>

<listitem>

<para>Incorporates a "Back to Login" button in validatorMain.jsp.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>validatorMain.jsp</literal></term>

<listitem>

<para>Sets up a federation connectivity test. If you've set up a Federation Circle of Trust, this file is

accessible from the "Test Federation Connectivity" option in the main OpenAM console.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>validatorRpt.jsp</literal></term>

<listitem>

<para>Opens a "Connectivity Test Results" window, specifying the status of a federation circle of trust.

Tests relate to IdP authentication, SP authentication, account linking, single log out, single sign on,

and account unlinking.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>validatorStatus.jsp</literal></term>

<listitem>

<para>Adds information to validator.jsp and validatorMain.jsp with federation status information as it relates

to the currently configured circle of trust.</para>

</listitem>

</varlistentry>

</variablelist>

</section>

<section xml:id="ui-jsp-endpoints">

<title>User Interface JSP Endpoints</title>

<indexterm>

<primary>Endpoints</primary>

<secondary>JSP</secondary>

<tertiary>User Interface</tertiary>

</indexterm>

<para>The endpoints in this section can be found in several com_sun_web_ui/jsp/ subdirectories. These endpoints

appear to

relate to JavaHelp; per OPENAM-806, this functionality was removed from OpenAM, starting with version 9.5.3.

Thus, the endpoints in this section, with one possible exception (Masthead.jsp in the

com_sun_web_ui/jsp/version subdirectory) may no longer serve any purpose.</para>

<!-- Am I being too honest with this paragraph? -->

<variablelist>

<varlistentry>

<term><literal>DateTimeWindow.jsp</literal></term>

<listitem>

<para>The only endopint in the com_sun_web_ui/jsp/datetime subdirectory. May be a legacy endpoint;

it calls a DateTimeWindowViewBean class; the corresponding .java file does not

exist in the current trunk.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>Help.jsp</literal></term>

<listitem>

<para>One of two endpoints in the com_sun_web_ui/jsp/help subdirectory. May be a legacy endpoint;

it calls a HelpViewBean class; the corresponding .java file does not exist in the current trunk.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>Masthead.jsp</literal></term>

<listitem>

<para>One of two endpoints in the com_sun_web_ui/jsp/help subdirectory. Also exists in a slightly

different format in the com_sun_web_ui/jsp/help2 subdirectory, as well as the com_sun_web_ui/

jsp/version subdirectory. May be a legacy endpoint;

it calls a MastheadViewBean class; the Masthead.jsp file and the corresponding

MastheadViewBean.java were last changed in 2004. (However, the Masthead.jsp file in the

com_sun_web_ui/jsp/version subdirectory includes a VersionViewBean.java file that is used by the

Version.jsp endpoint used in the console/base subdirectory.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ButtonNav.jsp</literal></term>

<listitem>

<para>Specifies an endpoint in the com_sun_web_ui/jsp/help2 directory. Points to a

ButtonNavViewBean class; the associated .java file no longer exists in the trunk.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>Help2Ie.jsp</literal></term>

<listitem>

<para>Specifies an endpoint in the com_sun_web_ui/jsp/help2 directory. Points to a

Help2ViewBean class; the associated .java file no longer exists in the trunk.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>Help2Nav4.jsp</literal></term>

<listitem>

<para>Specifies an endpoint in the com_sun_web_ui/jsp/help2 directory. Points to a

Help2ViewBean class; the associated .java file no longer exists in the trunk.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>Help2Nav6up.jsp</literal></term>

<listitem>

<para>Specifies an endpoint in the com_sun_web_ui/jsp/help2 directory. Points to a

Help2ViewBean class; the associated .java file no longer exists in the trunk.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>Navigator.jsp</literal></term>

<listitem>

<para>Specifies an endpoint in the com_sun_web_ui/jsp/help2 directory. Points to a

NavigatorViewBean class; the associated .java file no longer exists in the trunk.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>AdvancedSort.jsp</literal></term>

<listitem>

<para>Specifies an endpoint in the com_sun_web_ui/jsp/table directory.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>Table.jsp</literal></term>

<listitem>

<para>Specifies an endpoint in the com_sun_web_ui/jsp/table directory. Points to a

TableViewBean class; the associated .java file no longer exists in the trunk..</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>WizardWindow.jsp</literal></term>

<listitem>

<para>Points to an endpoint in the com_sun_web_ui/jsp/wizard subdirectory. Points to a

WizardWindowViewBean class, which appears to be unused by any other .jsp file.</para>

</listitem>

</varlistentry>

</variablelist>

</section>

<section xml:id="default-authentication-configuration-jsp-endpoints">

<title>Default Authentication JSP Endpoints</title>

<indexterm>

<primary>Endpoints</primary>

<secondary>JSP</secondary>

<tertiary>Default Authentication Configuration</tertiary>

</indexterm>

<para>Many of the .jsp files in this category can be modified to help you modify the messages that appear to users

in the OpenAM console. Standard messages for most of these endpoints can be found in the amAuth.properties and

amAuthUI.properties files. You'll find the endpoints in this subsection in the config/auth/default

subdirectory.</para>

<!-- For each service endpoint sorted alphanumeric: URI, description -->

<variablelist>

<varlistentry>

<term><literal>account_expired.jsp</literal></term>

<listitem>

<para>Specifies an error page for account expiration. The message

displayed to the user can be modified in the amAuthUI.properties file.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>authException.jsp</literal></term>

<listitem>

<para>Option to Exception.jsp; called if there is an existing resource bundle, as specified in

AuthExceptionViewBean.java.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>auth_error_template.jsp</literal></term>

<listitem>

<para>Specifies an error page for authentication errors. The message

displayed to the user can be modified in the amAuthUI.properties file.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>disclaimer.jsp</literal></term>

<listitem>

<para>Associated with the self-registration module, which can be configured in the OpenAM Console, under

Access Control > Realm Name > Authentication > Module Instances. The default disclaimer is

associated with the disclaimer.notice parameter, defined in the amAuthUI.properties file.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>disclaimerDeclined.jsp</literal></term>

<listitem>

<para>Associated with the self-registration module, which can be configured in the OpenAM Console, under

Access Control > Realm Name > Authentication > Module Instances. The default disclaimer_denied message is

associated with the disclaimer.declined parameter, defined in the amAuthUI.properties file.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>Exception.jsp</literal></term>

<listitem>

<para>Includes the following error message: "Authentication Service is not initialized." Cited by several

other .java files in the code, so it should not be removed in a secure deployment..</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>invalidAuthlevel.jsp</literal></term>

<listitem>

<para>Used to specify an issue with the authentication level. The default invalidauthlevel and contactadmin

messages can be redefined in the amAuthUI.properties file.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>invalidPCookieUserID.jsp</literal></term>

<listitem>

<para>Notes a problem with a specified user name for a cookie, which presumably does not exist in the

relevant domain. The default cookie.notpersistent and contactadmin messages can be modified in the

amAuthUI.properties file.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>invalid_domain.jsp</literal></term>

<listitem>

<para>Displays a "No such Organization found" message when a domain is not defined in the OpenAM database.

Refers to the nosuch.domain parameter in the amAuthUI.properties file.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>login_denied.jsp</literal></term>

<listitem>

<para>Defines the response of OpenAM to a user who enters an undefined profile. Uses the

userhasnosuchprofile.org and contactadmin parameters in the amAuthUI.properties file.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>login_failed_template.jsp</literal></term>

<listitem>

<para>Provides a message in the event of a login failure. The message uses the auth.failed parameter

in the amAuthUI.properties file.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>Login.jsp</literal></term>

<listitem>

<para>Specifies a regular authentication template. As noted in the

<citetitle>Administration Guide</citetitle> entry on <link xlink:show="new" xlink:href=

"admin-guide#chap-securing#secure-openam-administration"

xlink:role="http://docbook.org/xlink/role/olink">

<citetitle>Securing OpenAM Administration</citetitle></link>,

the Login.jsp file may be customized for different deployments.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>Logout.jsp</literal></term>

<listitem>

<para>The Logout.jsp file may also be customized for different deployments.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>maxSessions.jsp</literal></term>

<listitem>

<para>Specifies the message given to users when the number of sessions has hit the preconfigured limit.

The default is 5000, defined in the OpenAM console under Configuration > Servers and Sites >

Default Server Settings > Session. The message uses the session.max.limit parameter defined in the

amAuthUI.properties file.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>membership.jsp</literal></term>

<listitem>

<para>Specifies information for the page associated with the self-registration module.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>Message.jsp</literal></term>

<listitem>

<para>Calls text messages related to the authentication process.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>module_denied.jsp</literal></term>

<listitem>

<para>Includes a message to a target user that he does not have access to a specified module. The message

uses the authmodule.denied parameter defined in the amAuthUI.properties file..</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>module_template.jsp</literal></term>

<listitem>

<para>Adds a page which can be used to help customize appropriate modules.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>new_org.jsp</literal></term>

<listitem>

<para>Includes a warning when a user is trying to access a different realm. The message uses the newOrg.agree

parameter, as defined in the amAuthUI.properties file.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>noConfig.jsp</literal></term>

<listitem>

<para>Specifies the lack of a defined configuration module. The message uses the noconfig.found parameter,

defined in the amAuthUI.properties file.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>OAuthActivate.jsp</literal></term>

<listitem>

<para>Shows a default template for entering an activation code.

Used by OAuth.xml for password changes. As this file is not configured for OAuth2, the file is

deprecated and may be removed from a future release.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>OAuthPwd.jsp</literal></term>

<listitem>

<para>Displays a password change screen, with an option for terms and conditions of service. As this file

is not configured for OAuth2, it is deprecated and may be removed from a future release.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>org_inactive.jsp</literal></term>

<listitem>

<para>Transmits the message that the target organization is not active in the OpenAM database.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>profileError.jsp</literal></term>

<listitem>

<para>Specifies the message that is sent when there's a failure in the use of the self-registration module.

Associated with the profile.error parameter, defined in the amAuthUI.properties file.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>Redirect.jsp</literal></term>

<listitem>

<para>Notes a file used by other code to redirect users for events such as login failures.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>register.jsp</literal></term>

<listitem>

<para>Identifies the page with the self-registration template.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>session_timeout.jsp</literal></term>

<listitem>

<para>Adds a message to a user when a session has gone past its allocated login time. Uses the

session.timeout parameter, defined in the amAuthUI.properties file.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>userDenied.jsp</literal></term>

<listitem>

<para>Associated with role-based authentication. Tells a user when the required role has not been configured

for that user. Message defined by the user.not.inrole parameter, defined in the amAuthUI.prooperties

file.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>user_inactive.jsp</literal></term>

<listitem>

<para>Identifies a message sent to a user that is not currently active in the database. Message defined by

the usernot.active parameter, as shown in the amAuthUI.properties file.</para>

</listitem>

</varlistentry>

</variablelist>

</section>

<section xml:id="default-federation-jsp-endpoints">

<title>Default Federation JSP Endpoints</title>

<indexterm>

<primary>Endpoints</primary>

<secondary>JSP</secondary>

<tertiary>Default Console</tertiary>

</indexterm>

<para>Many of the files in this config/federation/default subdirectory use the com.sun.liberty.LibertyManager

interface. In general, you'll want to keep these files in a production deployment, to support adding to and

deleting users from different Circles Of Trust (COT). Many of these files are customizable for different

organizational interfaces. Interfaces in different languages may be configured in slightly different

subdirectories such as config/federation/default_fr.</para>

<!-- For each service endpoint sorted alphanumeric: URI, description -->

<variablelist>

<varlistentry>

<term><literal>cdclogin.jsp</literal></term>

<listitem>

<para>Supports a non-blank page for cross-domain single sign-ons; associated with a Cross-Domain Controller

(CDC) servlet.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>CommonLogin.jsp</literal></term>

<listitem>

<para>Supports links to login pages of trusted identity providers.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>Error.jsp</literal></term>

<listitem>

<para>Sets up an error message, using the com.sun.liberty.LibertyManager interface.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>Federate.jsp</literal></term>

<listitem>

<para>Supports a connection to providers that can be configured in a federation.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>FederationDone.jsp</literal></term>

<listitem>

<para>Specifies the status of a federation request; the default response is either "The

user has cancelled account federation." or "Federation has been successfully completed with the

remote provider.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>Footer.jsp</literal></term>

<listitem>

<para>Sets up code that you can use to include a custom footer on all pages.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>Header.jsp</literal></term>

<listitem>

<para>Sets up code that you can use to include a custom header on all pages; the default version is

configured with the OpenAM logo.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ListOfCOTs.jsp</literal></term>

<listitem>

<para>When a service provider (SP) belongs to more than one COT, this page prompts

the user to select a preferred identity provider (IDP).</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>LogoutDone.jsp</literal></term>

<listitem>

<para>Specifies success or failure during a logout operation. Where a user has an account on multiple

providers, he may see the following message: "Unable to log the user out from one or more providers

where the user may still have active sessions."</para>

<!-- Based on messages in the code, did not check. -->

</listitem>

</varlistentry>

<varlistentry>

<term><literal>NameRegistration.jsp</literal></term>

<listitem>

<para>Supports registration with a new remote provider; this endpoint is associated with

NameRegistrationDone.jsp.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>NameRegistrationDone.jsp</literal></term>

<listitem>

<para>Displays different messages based on a registration attempt with a remote provider. The message

varies depending on whether the request was successful, a failure, or cancelled.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>Termination.jsp</literal></term>

<listitem>

<para>Supports defederation from an existing remote provider; goes with TerminationDone.jsp.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>TerminationDone.jsp</literal></term>

<listitem>

<para>Displays different messages based on a defederation attempt with a remote provider. The message

varies depending on whether the request was successful, a failure, or cancelled.</para>

</listitem>

</varlistentry>

</variablelist>

</section>

<section xml:id="console-agent-configuration-jsp-endpoints">

<title>Console Agent Configuration JSP Endpoints</title>

<indexterm>

<primary>Endpoints</primary>

<secondary>JSP</secondary>

<tertiary>Console Agent Configuration</tertiary>

</indexterm>

<para>The JSP files in the console/agentconfig subdirectory relate to the configuration of Web Agents. To see

what is done by each JSP file, log into the console as the administrator. Select Access Control >

<replaceable>[Some Realm]</replaceable> >

Agents. Several of the options that appear corresponds to the JSP files in the target subdirectory.</para>

<para>Some of the endpoints include messages from relevant sections of the amConsole.properties file. The agents

in this directory are part of the com.sun.identity.console.agentconfig package.</para>

<para>Several endpoints relate to Web Service Client (WSC) policy agents, which secure outgoing requests and

validate incoming requests from Web Service Providers (WSP). For more information, see the chapter on

<link xlink:href="admin-guide#chap-agents"

xlink:role="http://docbook.org/xlink/role/olink">

<citetitle>Configuring Policy Agent Profiles</citetitle> in the Administrative Guide</link>.</para>

<para>If you are not using agent functionality such as that related to the Security Token Service (STS), the

related endpoints listed in this section may not be essential in a production deployment.</para>

<variablelist>

<varlistentry>

<term><literal>AgentAdd.jsp</literal></term>

<listitem>

<para>Includes a newly created web agent for a specified realm. The AgentAdd page appears in the OpenAM

console after an agent is added to a realm.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>AgentConfigInherit.jsp</literal></term>

<listitem>

<para>Allows an administrator to review default settings for the agent, as configured in the Inheritance

Settings page. Inheritance assumes that agent is part of a previously confiugred group.

To access Inheritance Settings, refer to the <link xlink:href="admin-guide#chap-agents#create-agent-profiles"

xlink:role="http://docbook.org/xlink/role/olink">

<citetitle>Creating Agent Profiles" section of the Administration Guide</citetitle></link>.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>AgentDump.jsp</literal></term>

<listitem>

<para>Displays information about the current configuration of an agent or an agent group,

and how it might be exported.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>AgentExportPolicy.jsp</literal></term>

<listitem>

<para>Shows how the information about an agent may be exported.</para>

<!-- Based on best guess, not sure how to check. -->

</listitem>

</varlistentry>

<varlistentry>

<term><literal>AgentGroup.jsp</literal></term>

<listitem>

<para>Includes a newly created agent group for common web agents within a specified realm.

The AgentGroup page appears in the OpenAM console after an agent is added to a realm.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>AgentGroupMembers.jsp</literal></term>

<listitem>

<para>Supports the display of agents that are members of a specified agent group.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>Agents.jsp</literal></term>

<listitem>

<para>Enables access to a form to specify a new agent to add. The same form is used for every category of

new agents configured from the OpenAM console, when you navigate to Access Control -> [Realm name] ->

Agents.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>Home.jsp</literal></term>

<listitem>

<para>Per comments in the HomeViewBean, this file should forward requests for other agents.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>WebServiceClientEdit.jsp</literal></term>

<listitem>

<para>Includes customizable options for web service clients. Accessible when you edit and then save

or export the configuration for a specific web service client.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>WebServiceProviderEdit.jsp</literal></term>

<listitem>

<para>Includes customizable options for web service providers. Accessible when you edit and then save

or export the configuration for a specific web service provider.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>WebServiceSTSEdit.jsp</literal></term>

<listitem>

<para>Includes customizable options for web service STS providers. Accessible

when you edit and then save or export the configuration for a specific web service STS provider.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>WebServiceUserCredAdd.jsp</literal></term>

<listitem>

<para>Supports the configuration of an WSP agent username and password.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>WebServiceUserCredEdit.jsp</literal></term>

<listitem>

<para>Supports changes to an WSP agent username and password.</para>

</listitem>

</varlistentry>

</variablelist>

</section>

<section xml:id="console-ajax-jsp-endpoints">

<title>Console Ajax JSP Endpoints</title>

<indexterm>

<primary>Endpoints</primary>

<secondary>JSP</secondary>

<tertiary>Console Ajax</tertiary>

</indexterm>

<para>The only JSP file that appears to be active in this subdirectory is AjaxProxy.jsp, which appears to be

used by several other endpoints.</para>

<variablelist>

<varlistentry>

<term><literal>AjaxProxy.jsp</literal></term>

<listitem>

<para>Specifies an element used by several other endpoints, including ConfigureGoogleApps.jsp

and ConfigureSalesForceApps.jsp.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>FileUpload.jsp</literal></term>

<listitem>

<para>Used by the FileUploader.jsp endpoint, described in the section on Federation Console JSP

Endpoints.</para>

</listitem>

</varlistentry>

</variablelist>

</section>

<section xml:id="console-authentication-jsp-endpoints">

<title>Console Authentication JSP Endpoints</title>

<indexterm>

<primary>Endpoints</primary>

<secondary>JSP</secondary>

<tertiary>Console Authentication</tertiary>

</indexterm>

<para>You can find console authentication endpoints in the console/authentication subdirectory. The associated

endpoints relate to authentication settings in a realm. To access these endpoints, navigate to Access Control &gt;

<replaceable>[some realm]</replaceable> &gt; Authentication.</para>

<variablelist>

<varlistentry>

<term><literal>AuthConfig.jsp</literal></term>

<listitem>

<para>Part of the creation of a New Authentication Chain; associated with the Authentication

Chaining section of the Authentication tab for a realm.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>AuthProperties.jsp</literal></term>

<listitem>

<para>Specifies properties that might be configured under the authentication tab for a specific or

top-level realm.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>CoreAttributes.jsp</literal></term>

<listitem>

<para>Associated with the Core section of the Authentication tab of a specific or the top-level

realm. Includes options for Realm Attributes, Persistent Cookies, Account Lockout, and

Post-Authentication Processing.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>EditAuthType.jsp</literal></term>

<listitem>

<para>Supports changes to Module Instances, under the Authentication tab of a specific or the

top-level realm.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>NewAuthConfig.jsp</literal></term>

<listitem>

<para>Associated with the creation of a New Authentication Chain, an option available from the

Authentication Chaining section of the Authentication tab.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>NewAuthInstance.jsp</literal></term>

<listitem>

<para>Supports the implementation of a new authentication module, available from the Module

Instances section of the Authentication tab.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ReorderAuthChains.jsp</literal></term>

<listitem>

<para>Supports a change in sequence of authentication criteria; to access, select an existing

Authentication Chaining service under the Authentication tab for a specified realm.</para>

</listitem>

</varlistentry>

</variablelist>

</section>

<section xml:id="console-base-jsp-endpoints">

<title>Base Console JSP Endpoints</title>

<indexterm>

<primary>Endpoints</primary>

<secondary>JSP</secondary>

<tertiary>Base Console</tertiary>

</indexterm>

<para>The endpoints in this subdirectory (console/base) relate to options associated with the "home page" for the

OpenAM GUI console; in essence, these are the options available when you log in as the administrative user

(typically <literal>amadmin</literal>).</para>

<variablelist>

<varlistentry>

<term><literal>AMAdminFrame.jsp</literal></term>

<listitem>

<para>Defaults to the opening page for the OpenAM console.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>AMInvalidURL.jsp</literal></term>

<listitem>

<para>Provides an "Invalid URL" error message.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>AMLogin.jsp</literal></term>

<listitem>

<para>Redirects users to the default login page; assumes no user is currently logged into OpenAM.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>AMPost.jsp</literal></term>

<listitem>

<para>Endpoint that either returns success of a post or an "Invalid or Missing Input" error.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>AMUncaughtException.jsp</literal></term>

<listitem>

<para>Default uncaught exception error message endpoint: "An error occurred while processing this

request. Contact your administrator."</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>Authenticated.jsp</literal></term>

<listitem>

<para>Displays a "You're logged in" information message.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>CloseWindow.jsp</literal></term>

<listitem>

<para>Endpoint that closes existing windows.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>Message.jsp</literal></term>

<listitem>

<para>Specifies a template endpoint used for messages.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>Version.jsp</literal></term>

<listitem>

<para>Specifies current version information, copyright notice, and licensing.</para>

</listitem>

</varlistentry>

</variablelist>

</section>

<section xml:id="console-delegation-jsp-endpoints">

<title>Delegation Console JSP Endpoints</title>

<indexterm>

<primary>Endpoints</primary>

<secondary>JSP</secondary>

<tertiary>Delegation Console</tertiary>

</indexterm>

<para>The two service endpoints under the console/delegation subdirectory relate to the privileges associated

with configured realms.</para>

<variablelist>

<varlistentry>

<term><literal>Delegation.jsp</literal></term>

<listitem>

<para>Associated with the privileges for a realm. The privileges can be assigned for different

groups of users, as configured via Access Control &gt; <replaceable>[realm]</replaceable> &gt;

Subjects &gt; Group.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>DelegationProperties.jsp</literal></term>

<listitem>

<para>Supports changes in properties for group privileges, described in the Delegation.jsp endpoint.

To get to these properties, select Access Control &gt; <replaceable>[some realm]</replaceable>

&gt; Privileges &gt; <replaceable>[name of group]</replaceable>.</para>

</listitem>

</varlistentry>

</variablelist>

</section>

<section xml:id="console-federation-jsp-endpoints">

<title>Federation Console JSP Endpoints</title>

<indexterm>

<primary>Endpoints</primary>

<secondary>JSP</secondary>

<tertiary>Federation Console</tertiary>

</indexterm>

<para>The JSP files in this section relate to federation, specified in the console/federation subdirectory.

Specifically, when you access the OpenAM GUI console

and click the Federation tab, the variety of options that you select call the JSP files in this directory.

References in each JSP file in that subdirectory are associated with the Federation tab.</para>

<para>Generally, the JSP files in this directory are essential if you want to add or modify federation partners

in your Circles of Trust (COT), SAMLv2 / ID-FF / WS-Federation entity providers, and SAML 1.x configured

partners.</para>

<para>If you're not using the legacy elements of federation, such as Liberty ID-FF, WS-Federation, and SAML 1.x,

you may be able to delete related service endpoints in a more secure deployment.</para>

<para>Many of the endpoints in this section are accessible from the OpenAM console, under the Federation tab.

Some of the endpoints are accessible only after you've created an appropriate entity provider, such as

SAMLv2, ID-FF, or WS-Federation.</para>

<variablelist>

<varlistentry>

<term><literal>CreateCOT.jsp</literal></term>

<listitem>

<para>When you create a Circle of Trust (COT) via Federation &gt; New, you can access the

COT Configuration window. You can then access all configured COTs.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>CreateSAML2MetaData.jsp</literal></term>

<listitem>

<para>Used when creating a new entity provider, configured with the SAML2 protocol.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>FSAuthDomainsEditViewBean.jsp</literal></term>

<listitem>

<para>Associated with an edit of a COT; to access, select a previously configured COT.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>FSSAMLSelectTrustedPartnerType.jsp</literal></term>

<listitem>

<para>Opened when you configure a new Trusted Partner under the SAML 1.x Configuration section.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>FSSAMLService.jsp</literal></term>

<listitem>

<para>Associated with FSSAMLServiceViewBean, which is used by a number of other JSP files in the

console/federation subdirectory.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>FSSAMLSetTrustedPartnerType.jsp</literal></term>

<listitem>

<para>Associated with the FSSAMLSetTrustedPartnersEdit.jsp file; used when you select a configured SAML 1.x

Configuration trusted partner.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>FSSAMLSiteIDAdd.jsp</literal></term>

<listitem>

<para>Supports the addition of a Site ID for a SAML-configured partner.</para>

<!-- Based on best guess; direct access to the URL leads to an Add Site Identifier window; entries lead

</listitem>

</varlistentry>

<varlistentry>

<term><literal>FSSAMLSiteIDEdit.jsp</literal></term>

<listitem>

<para>Supports the modification of a Site ID for a SAML-configured partner.</para>

<!-- Based on best guess; direct access to the URL leads to an Edit Site Identifier window; entries lead

</listitem>

</varlistentry>

<varlistentry>

<term><literal>FSSAMLTargetURLsAdd.jsp</literal></term>

<listitem>

<para>Includes a new POST to a specified URL.</para>

<!-- Based on best guess; direct access to the URL leads to an Add Post to Target URL window; entries lead

</listitem>

</varlistentry>

<varlistentry>

<term><literal>FSSAMLTargetURLsEdit.jsp</literal></term>

<listitem>

<para>Supports editing of a POST to a specified URL.</para>

<!-- Based on best guess; direct access to the URL leads to an Edit Post to Target URL window; entries lead

</listitem>

</varlistentry>

<varlistentry>

<term><literal>FSSAMLTrustedPartnersAdd.jsp</literal></term>

<listitem>

<para>Called when you create a new "trusted partner" in the SAML 1.x Configuration area of the Federation

window.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>FSSAMLTrustedPartersEdit.jsp</literal></term>

<listitem>

<para>Called when you edit an existing "trusted partner" in the SAML 1.x Configuration area of the Federation

window.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>Federation.jsp</literal></term>

<listitem>

<para>Cited when you click New in the "Circle of Trust" section of the Federation window.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>FileUploader.jsp</literal></term>

<listitem>

<para>Called by the ImportEntity.jsp file, to support uploads of metadata files associated with a previously

configured entity provider.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>IDFFAffiliate.jsp</literal></term>

<listitem>

<para>Specifies an IDFF affiliate in a COT.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>IDFFGeneral.jsp</literal></term>

<listitem>

<para>Includes general parameters associated with an IDFF affiliate in a COT. The corresponding

IDFFGeneralViewBean parameter is cited only in this and the IDFFGeneralViewBean.java files.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>IDFFIDP.jsp</literal></term>

<listitem>

<para>Associated with the Identity Provider (IDP) for IDFF.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ISFFSP.jsp</literal></term>

<listitem>

<para>Associated with the Service Provider (SP) for IDFF.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ImportEntity.jsp</literal></term>

<listitem>

<para>Supports the import of pre-existing metadata files which define an entity provider. Allows you to

import metadata from a URL to a desired Realm.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SAMLv2Affiliate.jsp</literal></term>

<listitem>

<para>Enables a view of SAML version 2 affiliates.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SAMLv2AttrAuthority.jsp</literal></term>

<listitem>

<para>Associated with an IDP acting as an attribute authority.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SAMLv2AttrQuery.jsp</literal></term>

<listitem>

<para>Supports queries and saves of SAML2 attribute metadata.</para>

<!-- based on my reading of http://docs.oracle.com/cd/E19681-01/820-3885/ghzmm/index.html -->

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SAMLv2AuthnAuthority.jsp</literal></term>

<listitem>

<para>Enables communication with an IDP acting as an authentication authority.</para>

<!-- based on my reading of the ViewBean file, which points to retrieving and saving values -->

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SAMLv2General.jsp</literal></term>

<listitem>

<para>Identifies general properties of a SAML version 2 affiliate.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SAMLv2IDPAdvanced.jsp</literal></term>

<listitem>

<para>Supports the configuration of advanced properties for a SAMLv2 IDP.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SAMLv2AssertionContent.jsp</literal></term>

<listitem>

<para>Associated with the Assertion Content tab, accessible when you select Federation &gt; Entity Providers

&gt; <replaceable>Provider Name</replaceable>.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SAMLv2AssertionProcessing.jsp</literal></term>

<listitem>

<para>Associated with the Assertion Processing tab, accessible when you select Federation &gt; Entity Providers

&gt; <replaceable>Provider Name</replaceable>.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SAMLv2IDPServices.jsp</literal></term>

<listitem>

<para>Supports the configuration of IDP service properties for a SAML2 provider.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SAMLv2PDP.jsp</literal></term>

<listitem>

<para>Enables the configuration of a SAMLv2-based Policy Decision Point (PDP).</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SAMLv2PEP.jsp</literal></term>

<listitem>

<para>Enables the configuration of a SAMLv2-based Policy Enforcement Point (PEP).</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SAMLv2SPAdvanced.jsp</literal></term>

<listitem>

<para>Supports the configuration of advanced properties for a SP. Accessible when you select Federation &gt;

Entity Providers &gt; <replaceable>Provider Name</replaceable> &gt; SP &gt; Advanced.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SAMLv2SPAssertionContent.jsp</literal></term>

<listitem>

<para>Associated with the Assertion Content tab; supports the configuration of such for SPs; It is accessible

when you select Federation &gt; Entity Providers &gt; <replaceable>Provider Name</replaceable> &gt; SP &gt;

Assertion Content.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SAMLv2SPAssertionProcessing.jsp</literal></term>

<listitem>

<para>Associated with the Assertion Content tab; supports the configuration of assertion processing-related

properties for SPs. It is accessible

when you select Federation &gt; Entity Providers &gt; <replaceable>Provider Name</replaceable> &gt; SP &gt;

Assertion Processing.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SAMLv2SPServices.jsp</literal></term>

<listitem>

<para>Supports the configuration of services-related properties for an SP. It is accessible

when you select Federation &gt; Entity Providers &gt; <replaceable>Provider Name</replaceable> &gt; SP &gt;

Services.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>WSFedGeneral.jsp</literal></term>

<listitem>

<para>Associated with the configuration of a legacy WS-Federation entity provider.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>WSFedIDP.jsp</literal></term>

<listitem>

<para>Supports the configuration of an IDP under WS-Federation.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>WSFedSP.jsp</literal></term>

<listitem>

<para>Supports the configuration of an SP under WS-Federation.</para>

</listitem>

</varlistentry>

</variablelist>

</section>

<section xml:id="console-policy-jsp-endpoints">

<title>Policy Console JSP Endpoints</title>

<indexterm>

<primary>Endpoints</primary>

<secondary>JSP</secondary>

<tertiary>Policy Console</tertiary>

</indexterm>

<para>The JSP service endpoints in the console/policy subdirectory relate to a policies under a specific realm. To v

iew the options listed in this section, start the GUI console and navigate to Access Control &gt;

<replaceable>[Name of Realm]</replaceable> &gt; Policies.</para>

<para>For more information, see the chapter on

<link xlink:href="admin-guide#chap-authz-policy" xlink:role="http://docbook.org/xlink/role/olink">

<citetitle>Defining Authorization Policies OpenAM in the Administration Guide</citetitle></link>.</para>

<variablelist>

<varlistentry>

<term><literal>AuthToRealm.jsp</literal></term>

<listitem>

<para>Supports a policy that depends on the realm where the user authenticated.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>AuthToRealmAdd.jsp</literal></term>

<listitem>

<para>Adds a policy that depends on the realm where the user authenticated.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>AuthToRealmEdit.jsp</literal></term>

<listitem>

<para>Edits an existing policy that depends on the realm where the user authenticated.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>AuthToServiceAdd.jsp</literal></term>

<listitem>

<para>Enables a policy that depends on an authentication realm for a user.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>AuthToServiceEdit.jsp</literal></term>

<listitem>

<para>Edits a policy that depends on an authentication realm for a user.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ConditionAdd.jsp</literal></term>

<listitem>

<para>Supports adding a condition to a policy realm.

Associated with the SelectConditionType.jsp file.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ConditionEdit.jsp</literal></term>

<listitem>

<para>Edits a condition that has been added to a policy realm.

Associated with the SelectConditionType.jsp file.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ConditionProxy.jsp</literal></term>

<listitem>

<para>Supports a proxy of a condition that has been added to a policy realm.

Cited only by the ConditionProxyViewBean.java file.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>IdentityMembershipConditionAdd.jsp</literal></term>

<listitem>

<para>Supports a policy that depends on a list of selected OpenAM subjects, as well as group

membership.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>IdentityMembershipConditionEdit.jsp</literal></term>

<listitem>

<para>Edits an existing policy that depends on a list of selected OpenAM subjects, as well as group

membership.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>IdentitySubject.jsp</literal></term>

<listitem>

<para>Supports the configuration of a policy based on users or groups.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>IdentitySubjectAdd.jsp</literal></term>

<listitem>

<para>Adds a policy that configures a policy based on users or groups.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>IdentitySubjectEdit.jsp</literal></term>

<listitem>

<para>Edits an existing policy based on the configuration of users or groups.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>IDRepoResponseProviderAdd.jsp</literal></term>

<listitem>

<para>Identifies a response provider that provide additional information on policy enforcement,

such as why a request was allowed or denied.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>IDRepoResponseProviderEdit.jsp</literal></term>

<listitem>

<para>Edits an ID response provider that provide additional information on policy enforcement,

such as why a request was allowed or denied.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>PMAuthenticatedUsersSubjectAdd.jsp</literal></term>

<listitem>

<para>Supports the configuration of a new policy for authenticated users.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>PMAuthenticatedUsersSubjectEdit.jsp</literal></term>

<listitem>

<para>Supports the editing of an existing policy for authenticated users.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>PMDefaultAuthLevelCondition.jsp</literal></term>

<listitem>

<para>Supports a policy that depends on the realm where the user authenticated, with a minimum or

maximum acceptable authentication level.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>PMDefaultAuthLevelConditionAdd.jsp</literal></term>

<listitem>

<para>Adds a policy that depends on the realm where the user authenticated, with a minimum or

maximum acceptable authentication level.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>PMDefaultAuthLevelConditionEdit.jsp</literal></term>

<listitem>

<para>Edits an existing policy that depends on the realm where the user authenticated, with a

minimum or maximum acceptable authentication level.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>PMDefaultAuthSchemeCondition.jsp</literal></term>

<listitem>

<para>Supports the configuration of a policy that depends on the realm where the user authenticated.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>PMDefaultAuthSchemeConditionAdd.jsp</literal></term>

<listitem>

<para>Adds a policy that depends on the realm where the user authenticated.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>PMDefaultAuthSchemeConditionEdit.jsp</literal></term>

<listitem>

<para>Edits an existing policy that depends on the realm where the user authenticated.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>PMDefaultIPCondition.jsp</literal></term>

<listitem>

<para>Supports a policy based on clients in a specific range of IP addresses or associated with

a specific DNS domain name.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>PMDefaultIPConditionAdd.jsp</literal></term>

<listitem>

<para>Adds a policy based on clients in a specific range of IP addresses or associated with

a specific DNS domain name.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>PMDefaultIPConditionEdit.jsp</literal></term>

<listitem>

<para>Edits an existing policy based on clients in a specific range of IP addresses or associated

with a specific DNS domain name.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>PMDefaultSessionCondition.jsp</literal></term>

<listitem>

<para>Supports the configuration of an Active Session policy condition.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>PMDefaultSessionConditionAdd.jsp</literal></term>

<listitem>

<para>Adds a new policy related to an Active Session policy condition.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>PMDefaultSessionConditionEdit.jsp</literal></term>

<listitem>

<para>Edits an existing policy related to an Active Session policy condition.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>PMDefaultTimeCondition.jsp</literal></term>

<listitem>

<para>Relates to a policy associated with time restrictions on a user or group.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>PMDefaultTimeConditionAdd.jsp</literal></term>

<listitem>

<para>Adds a policy for time restrictions on a user or a group.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>PMDefaultTimeConditionEdit.jsp</literal></term>

<listitem>

<para>Edits an existing policy related to time restrictions on a user or a group.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>PMDSAMERoleSubject.jsp</literal></term>

<listitem>

<para>Used for user/group roles associated with the Directory Server Access Management Edition.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>PMLDAPGroupSubject.jsp</literal></term>

<listitem>

<para>Relates to a policy dependent on group membership within the LDAP database.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>PMLDAPOrgSubject.jsp</literal></term>

<listitem>

<para>Relates to a policy dependent on organizational (OU) membership within the LDAP database.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>PMLDAPRoleSubject.jsp</literal></term>

<listitem>

<para>Relates to a policy dependent on user roles configured within the LDAP database.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>Policy.jsp</literal></term>

<listitem>

<para>Displays currently configured policies for the target realm.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>PolicyNormalAdd.jsp</literal></term>

<listitem>

<para>Shows what policy has been added from the Policies tab, after configuring a new policy with

the New Policy button.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>PolicyNormalEdit.jsp</literal></term>

<listitem>

<para>Supports the creation of a new policy rule, or the edit of an existing policy rule. To access,

click New in any policy category, or select an existing policy.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>PolicyReferralAdd.jsp</literal></term>

<listitem>

<para>Displays a newly configured referral policy.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>PolicyReferralEdit.jsp</literal></term>

<listitem>

<para>Supports editing of an existing referral policy.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>PolicySelectType.jsp</literal></term>

<listitem>

<para>Supports selection of a policy, by name, in either a "normal" or a "referral" category.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ReferralAdd.jsp</literal></term>

<listitem>

<para>Adds referrals to and from an existing policy.</para>

<!-- Based on my reading of PolicyOpViewBeanBase.java -->

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ReferralEdit.jsp</literal></term>

<listitem>

<para>Edits referrals associated with an existing policy.</para>

<!-- Based on my reading of PolicyOpViewBeanBase.java -->

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ReferralProxy.jsp</literal></term>

<listitem>

<para>Supports changes in referrals to and from an existing policy.</para>

<!-- Best guess -->

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ResponseProviderAdd.jsp</literal></term>

<listitem>

<para>Associated with IDRepoResponseProviderAdd.jsp.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ResponseProviderEdit.jsp</literal></term>

<listitem>

<para>Associated with IDRepoResponseProviderEdit.jsp.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ResponseProviderProxy.jsp</literal></term>

<listitem>

<para>Supports changes in response providers for an existing policy.</para>

<!-- Best guess -->

</listitem>

</varlistentry>

<varlistentry>

<term><literal>RuleAdd.jsp</literal></term>

<listitem>

<para>Displays a newly created policy, in the Edit Policy window.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>RuleEdit.jsp</literal></term>

<listitem>

<para>Supports edits of an existing policy.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>RuleWithPrefixAdd.jsp</literal></term>

<listitem>

<para>Associated with the SelectServiceType.jsp endpoint.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>RuleWithPrefixEdit.jsp</literal></term>

<listitem>

<para>Associated with the SelectServiceType.jsp endpoint.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>RuleNoResourceAdd.jsp</literal></term>

<listitem>

<para>Associated with the SelectServiceType.jsp endpoint.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>RuleNoResourceEdit.jsp</literal></term>

<listitem>

<para>Associated with the SelectServiceType.jsp endpoint.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SelectConditionType.jsp</literal></term>

<listitem>

<para>Enables a policy that depends on whether the information for a specific user can be found

in the identity repository LDAP database.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SelectRealm.jsp</literal></term>

<listitem>

<para>Opens a window that supports a selection from existing realms, based on available

authentication modules.</para>

<!-- While I can get to the window, my entries error out, so this may be a legacy endpoint -->

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SelectReferralType.jsp</literal></term>

<listitem>

<para>Supports the configuration of a referral type for a sub-realm.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SelectResponseProviderType.jsp</literal></term>

<listitem>

<para>Supports the configuration of a response provider type for an identity repository.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SelectServiceType.jsp</literal></term>

<listitem>

<para>Supports the configuration of a policy service type; supports the customization of a new rule

for configurable service types such as the Discovery Service.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SelectSubjectType.jsp</literal></term>

<listitem>

<para>Enables creation of a policy for web service clients, associated with federated access

management.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SessionPropertyAdd.jsp</literal></term>

<listitem>

<para>Supports a policy that depends on attributes in a user's session.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SessionPropertyConditionAdd.jsp</literal></term>

<listitem>

<para>Supports a policy that includes conditions based on attributes in a user's session.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SessionPropertyConditionEdit.jsp</literal></term>

<listitem>

<para>Edits conditions in a policy based on attributes in a user's session.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SessionPropertyEdit.jsp</literal></term>

<listitem>

<para>Edits attributes in a policy based on attributes in a user's session.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SubjectAdd.jsp</literal></term>

<listitem>

<para>Supports the configuration of a new policy for authenticated users; associated with

PMAuthenticatedUsersSubjectAdd.jsp.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SubjectEdit.jsp</literal></term>

<listitem>

<para>Edits the configuration of a policy for authenticated users; associated with

PMAuthenticatedUsersSubjectEdit.jsp.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SubjectNoneAdd.jsp</literal></term>

<listitem>

<para>Associated with a policy for web service clients; related to SelectSubjectType.jsp.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SubjectNoneEdit.jsp</literal></term>

<listitem>

<para>Supports the configuration of a new policy for authenticated users; associated with

PMAuthenticatedUsersSubjectEdit.jsp.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SubjectProxy.jsp</literal></term>

<listitem>

<para>Configures a proxy for web service client policies; associated with

SelectSubjectType.jsp.</para>

</listitem>

</varlistentry>

</variablelist>

</section>

<section xml:id="console-idm-jsp-endpoints">

<title>IDM Console JSP Endpoints</title>

<indexterm>

<primary>Endpoints</primary>

<secondary>JSP</secondary>

<tertiary>IDM Console</tertiary>

</indexterm>

<para>This group of service endpoints are associated with an identity management (IDM) interface from OpenAM.

You can find these endpoints in the console/idm subdirectory. You may not need all of the functionality

provided by the endpoints in this section.</para>

<para>Some of the endpoints in this section include references to UM*.jsp endpoints, User Console JSP Endpoints

located in the console/user subdirectory, and described later in this chapter.</para>

<variablelist>

<varlistentry>

<term><literal>EndUser.jsp</literal></term>

<listitem>

<para>Accesses the information page for the currently logged in user.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>Entities.jsp</literal></term>

<listitem>

<para>Opens the list of currently configured users, available via Access Control &gt;

<replaceable>[selected realm]</replaceable> &gt; Subjects.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>EntityAdd.jsp</literal></term>

<listitem>

<para>Used when adding a new user or group.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>EntityDiscoveryDescriptionAdd.jsp</literal></term>

<listitem>

<para>Associated with the Discovery Service. To access that service, select a non-administrative

user and select the Services tab. The EntityDiscoveryDescriptionAdd.jsp file is used when

selecting a new Security Mechanism ID

as a Service Description as a new Discovery Resource Offering.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>EntityDiscoveryDescriptionEdit.jsp</literal></term>

<listitem>

<para>Associated with an edit of an existing Security Mechanism ID.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>EntityEdit.jsp</literal></term>

<listitem>

<para>Called when saving changes to an existing user.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>EntityMembers.jsp</literal></term>

<listitem>

<para>Lists the members of a configured group.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>EntityMembersFilteredIdentity.jsp</literal></term>

<listitem>

<para>Lists the members of a configured group based on some filter.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>EntityMembership.jsp</literal></term>

<listitem>

<para>Accessed when a regular user is made a member of a previously configured group.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>EntityResourceOffering.jsp</literal></term>

<listitem>

<para>Supports custom resource offering entries for a previously configured user. Also seen when

accessing the UMUserResourceOffering.jsp file.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>EntityResourceOfferingAdd.jsp</literal></term>

<listitem>

<para>Supports entries of new resource offerings for a previously configured user. Also seen when

accessing the UMUserResourceOfferingAdd.jsp file.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>EntityResourceOfferingEdit.jsp</literal></term>

<listitem>

<para>Supports edits of existing resource offerings for a previously configured user. Also seen when

accessing the UMUserResourceOfferingEdit.jsp file.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>EntityServices.jsp</literal></term>

<listitem>

<para>Supports a new service for a specific user. As of this writing, available services are:

Dashboard, Discovery Service, Liberty Personal Profile Service, and Session.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>Home.jsp</literal></term>

<listitem>

<para>Opens a list of currently configured users.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ServicesAdd.jsp</literal></term>

<listitem>

<para>Accessible after adding a new service for a currently configured user; associated with

the EntityServices.jsp file.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ServicesEdit.jsp</literal></term>

<listitem>

<para>Accessible for editing services associated with a currently configured user.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ServicesNoAttribute.jsp</literal></term>

<listitem>

<para>Used if a configured organization has no available attributes.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ServicesSelect.jsp</literal></term>

<listitem>

<para>Opened when adding a service for a specific user.</para>

</listitem>

</varlistentry>

</variablelist>

</section>

<section xml:id="console-realm-jsp-endpoints">

<title>Console Realm JSP Endpoints</title>

<indexterm>

<primary>Endpoints</primary>

<secondary>JSP</secondary>

<tertiary>Console Realm</tertiary>

</indexterm>

<para>If you want to know how to configure services and data stores within a realm, you'll want to understand

the workings of these service endpoints. If you want to customize realms in production, you'll want to keep

these endpoints available on an OpenAM console. You can find these endpoints in the console/realm

subdirectory.</para>

<variablelist>

<varlistentry>

<term><literal>HomePage.jsp</literal></term>

<listitem>

<para>Associated with the main Access Control page in the OpenAM GUI console, which lists configured

realms. If you call realm/HomePage.jsp directly, it cites messages associated with changes for

a specific user, and functions more closely associated with JSP endpoints in the console/idm

subdirectory.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>IDRepo.jsp</literal></term>

<listitem>

<para>Enables links with directory server data stores within a realm. To access, select Access

Control &gt; <replaceable>[some realm]</replaceable> &gt; Data Stores &gt; New. You should see

a variety of supported directory server data stores, such as Active Directory, OpenDJ, and

Tivoli Directory Server.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>IDRepoAdd.jsp</literal></term>

<listitem>

<para>Appears when you add a data store; associated with the IDRepo.jsp service endpoint.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>IDRepoEdit.jsp</literal></term>

<listitem>

<para>Appears when you edit an existing data store; associated with the IDRepo.jsp service

endpoint.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>IDRepoSelectType.jsp</literal></term>

<listitem>

<para>Includes a list of supported data stores, from Active Directory to OpenDJ; associated with

the IDRepo.jsp service endpoint.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>RMRealm.jsp</literal></term>

<listitem>

<para>Supports the configuration of a new realm, or editing of an existing realm.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>RMRealmAdd.jsp</literal></term>

<listitem>

<para>Supports the addition of a new realm; associated with the RMRealm.jsp service endpoint.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>RealmDiscoveryDescriptionAdd.jsp</literal></term>

<listitem>

<para>Supports a new description for a realm; associated with the RealmResourceOffering.jsp service

endpoint. </para>

<!-- based on my reading of RealmResourceOfferingViewBeanBase.java -->

</listitem>

</varlistentry>

<varlistentry>

<term><literal>RealmDiscoveryDescriptionEdit.jsp</literal></term>

<listitem>

<para>Supports an edited description; associated with the RealmResourceOffering.jsp service endpoint.

</para>

<!-- based on my reading of RealmResourceOfferingViewBeanBase.java -->

</listitem>

</varlistentry>

<varlistentry>

<term><literal>RealmProperties.jsp</literal></term>

<listitem>

<para>Works with the pages that allow you to edit an existing realm.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>RealmResourceOffering.jsp</literal></term>

<listitem>

<para>Supports the configuration of a security mechanism to a new realm resource offering. Requires

the configuration of the discovery service, and the configuration of a directory resource

offering for the specified realm.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>RealmResourceOfferingAdd.jsp</literal></term>

<listitem>

<para>Supports the addition of a security mechanism to a new realm resource offering. Requires

the configuration of the discovery service, and the configuration of a directory resource

offering for the specified realm.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>RealmResourceOfferingEdit.jsp</literal></term>

<listitem>

<para>Supports the editing of a security mechanism for an existing realm resource offering. Requires

the configuration of the discovery service, and the configuration of a directory resource

offering for the specified realm.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>Services.jsp</literal></term>

<listitem>

<para>Supports the configuration of a service within a specified realm.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ServicesAdd.jsp</literal></term>

<listitem>

<para>Supports the addition of a service to a specified realm; available services to add include

Administration, Dashboard, Discovery, Globalization Settings, OAuth2 Provider, Password Reset,

Session, and User.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ServicesCannotAssignService.jsp</literal></term>

<listitem>

<para>If a desired service is not compatible with directory data available from an organization, it

is rejected.</para>

<!--Based on my reading of the ServicesAddViewBean.java file -->

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ServicesEdit.jsp</literal></term>

<listitem>

<para>Supports the editing of an existing service; associated with the Services.jsp endpoint.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ServicesNoAttribute.jsp</literal></term>

<listitem>

<para>Supports the editing of an existing service; called if the attribute cannot be found or

changed.</para>

<!--Based on my reading of the ServicesEditViewBean.java file -->

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ServicesSelect.jsp</literal></term>

<listitem>

<para>Implements step 1 of the addition of a new service; associated with the Services.jsp

endpoint.</para>

</listitem>

</varlistentry>

</variablelist>

</section>

<section xml:id="console-service-jsp-endpoints">

<title>Service Console JSP Endpoints</title>

<indexterm>

<primary>Endpoints</primary>

<secondary>JSP</secondary>

<tertiary>Service Console</tertiary>

</indexterm>

<para> You can find the JSP files in this category in the console/service subdirectory. Most of the endpoints

are accessible in the console, from various options associated with the Configuration menu. If you

don't use some of the functionality described such as Liberty ID-FF or SOAP binding, you may be able to

delete the associated endpoints.</para>

<variablelist>

<varlistentry>

<term><literal>G11NCharsetAliasAdd.jsp</literal></term>

<listitem>

<para>Supports the configuration of a new character set alias. Accessible from the Globalization

Settings &gt; Charset Aliases submenu.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>G11NCharsetAliasEdit.jsp</literal></term>

<listitem>

<para>Supports the editing of an existing character set alias. Accessible from the Globalization

Settings &gt; Charset Aliases submenu.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>G11NSupportedCharsetAdd.jsp</literal></term>

<listitem>

<para>Supports the configuration of a new character set supported by a locale. Accessible from the

Globalization Settings &gt; Charsets Supported by Each Locale submenu.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>G11NCharsetAliasEdit.jsp</literal></term>

<listitem>

<para>Supports the editing of an existing character set supported by a locale. Accessible from the

Globalization Settings &gt; Charsets Supported by Each Locale submenu.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>MAPClientManager.jsp</literal></term>

<listitem>

<para>Supports a list of client types. Associated with the Default Client Type option available

via Configuration &gt; System &gt; Client Detection.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>MAPCreateDevice.jsp</literal></term>

<listitem>

<para>Supports creation of client devices.</para>

<!-- Guess, based on functionality of MAPClientManager.jsp -->

</listitem>

</varlistentry>

<varlistentry>

<term><literal>MAPCreateDeviceTwo.jsp</literal></term>

<listitem>

<para>Supports creation of client devices.</para>

<!-- Guess, based on functionality of MAPClientManager.jsp -->

</listitem>

</varlistentry>

<varlistentry>

<term><literal>MAPDeviceProfile.jsp</literal></term>

<listitem>

<para>Supports step 1 of creating a new client device.</para>

<!-- Guess, based on functionality of MAPClientManager.jsp -->

</listitem>

</varlistentry>

<varlistentry>

<term><literal>MAPDuplicationDevice.jsp</literal></term>

<listitem>

<para>Used with duplicate client devices.</para>

<!-- Guess, based on functionality of MAPClientManager.jsp -->

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SCConfig.jsp</literal></term>

<listitem>

<para>Associated with basic Service Configuration data, and the other endpoints accessible from

the Configuration menu.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SCConfigAuth.jsp</literal></term>

<listitem>

<para>Supports the configuration of available authentication databases. You can get to this window

by selecting Configuration &gt; Authentication.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SCConfigConsole.jsp</literal></term>

<listitem>

<para>Supports the configuration of administrative an globalization console properties. You can get

to this window by selecting Configuration &gt; Console.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SCConfigGlobal.jsp</literal></term>

<listitem>

<para>Supports the configuration of OpenAM global properties. You can get to this window by

selecting Configuration &gt; Global.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SCConfigSystem.jsp</literal></term>

<listitem>

<para>Supports the configuration of OpenAM system properties. You can get to this window by

selecting Configuration &gt; System.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SCPlatform30.jsp</literal></term>

<listitem>

<para>Accesses current global attributes and cookie domain settings. To get to this window, select

Configuration &gt; System &gt; Platform.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SCPolicy.jsp</literal></term>

<listitem>

<para>Supports a view of the current policy configuration. To access this window, select

Configuration &gt; Global &gt; Policy Configuration.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SCPolicyResourceComparatorAdd.jsp</literal></term>

<listitem>

<para>Supports the addition of a new resource comparator to the current policy configuration.

To access the relevant window, select Configuration &gt; Global &gt; Policy Configuration.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SCPolicyResourceComparatorEdit.jsp</literal></term>

<listitem>

<para>Supports the editing of an existing resource comparator in the current policy configuration.

To access the relevant window, select Configuration &gt; Global &gt; Policy Configuration.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SCSAML2SOAPBinding.jsp</literal></term>

<listitem>

<para>Enables a review of current SAMLv2 SOAP binding request handlers. Associated with SOAP-based

communications, using SAMLv2 requests, between a client and a server.

To access the relevant screen, select Configuration &gt; Global &gt; SAMLv2 SOAP Binding.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SCSAML2SOAPBindingRequestHandlerListAdd.jsp</literal></term>

<listitem>

<para>Allows you to add a new SAMLv2 SOAP binding request handler.

To access the relevant screen, select Configuration &gt; Global &gt; SAMLv2 SOAP Binding.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SCSAML2SOAPBindingRequestHandlerListDup.jsp</literal></term>

<listitem>

<para>Allows you to duplicate an existing SAMLv2 SOAP binding request handler.

To access the relevant screen, select Configuration &gt; Global &gt; SAMLv2 SOAP Binding.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SCSAML2SOAPBindingRequestHandlerListEdit.jsp</literal></term>

<listitem>

<para>Allows you to edit an existing SAMLv2 SOAP binding request handler.

To access the relevant screen, select Configuration &gt; Global &gt; SAMLv2 SOAP Binding.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SCSOAPBinding.jsp</literal></term>

<listitem>

<para>Enables a review of current SOAP binding request handlers. Associated with the Liberty

Alliance Project Identity Federation Framework (Liberty ID-FF).</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SCSOAPBindingRequestHandlerListAdd.jsp</literal></term>

<listitem>

<para>Allows you to add a new SOAP binding request handler. Associated with the Liberty

Alliance Project Identity Federation Framework (Liberty ID-FF).</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SCSOAPBindingRequestHandlerListDup.jsp</literal></term>

<listitem>

<para>Allows you to duplicate an existing SOAP binding request handler. Associated with the Liberty

Alliance Project Identity Federation Framework (Liberty ID-FF).</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SCSOAPBindingRequestHandlerListEdit.jsp</literal></term>

<listitem>

<para>Allows you to edit an existing SOAP binding request handler. Associated with the Liberty

Alliance Project Identity Federation Framework (Liberty ID-FF).</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SecurityTokenService.jsp</literal></term>

<listitem>

<para>Supports the configuration of tokens associated with the Security Token Service (STS). To

access the associated screen, select Configuration &gt; Global &gt; Security Token Service.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ServerAdd.jsp</literal></term>

<listitem>

<para>Supports the addition of an OpenAM server to work behind a load balancer in support of

Session Failover (SFO). Available from Configuration &gt; Servers and Sites, in the Servers

subsection.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ServerClone.jsp</literal></term>

<listitem>

<para>Supports the cloning of an existing OpenAM server to work behind a load balancer in support of

Session Failover (SFO). Available from Configuration &gt; Servers and Sites, in the Servers

subsection.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ServerConfigInherit.jsp</literal></term>

<listitem>

<para>Supports the inheritance of the default configuration for servers, as it relates to SFO.</para>

<!-- Best guess -->

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ServerConfigXMLAddServer.jsp</literal></term>

<listitem>

<para>Enables the configuration fo a new server; relates to SFO.</para>

<!-- Best guess based on screen that appears -->

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ServerConfigXML.jsp</literal></term>

<listitem>

<para>Supports the review of the XML settings of an existing server, as it relates to SFO.</para>

<!-- Best guess -->

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ServerEditAdvanced.jsp</literal></term>

<listitem>

<para>Supports the editing of advanced properties for default servers, in the configuration of

servers for SFO. To access, select Configuration &gt; Severs and Sites &gt; Default Server

Settings, and click Advanced.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ServerEditGeneral.jsp</literal></term>

<listitem>

<para>Supports the editing of general properties for default servers, such as the base directory,

default locale, debug level, mail server for notifications, and more. Relates to the

configuration of servers for SFO. To access, select Configuration &gt; Severs and Sites &gt;

Default Server Settings, and click General.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ServerEditSDK.jsp</literal></term>

<listitem>

<para>Supports the editing of SDK-related properties for default servers, associated with SFO.

Supports editing of settings such as datastore notifications, event service connection retries,

LDAP connections, Time To Live (TTL) for user entries, and more. To access, select Configuration

&gt; Severs and Sites &gt; Default Server Settings, and click SDK.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ServerEditSecurity.jsp</literal></term>

<listitem>

<para>Supports the editing of security properties for default servers; associated wtih SFO.

Includes default security settings such as encryption keys, cookie encoding, key stores, and

certificate management. To access, select Configuration &gt; Severs and Sites &gt;

Default Server Settings, and click Security.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ServerEditSession.jsp</literal></term>

<listitem>

<para>Supports the editing of session properties for default servers; associated with SFO.

Note the Session Limit default specifies a maximum of 5000, well short of the 100,000 sessions

that can be handled by a standard 3GB dual-core production system. To access, select

Configuration &gt; Severs and Sites &gt; Default Server Settings, and click Session.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ServerSite.jsp</literal></term>

<listitem>

<para>Associated with the addition or editing of a load balancer that distributes requests to other

OpenAM servers. Available from the Configuration &gt; Servers and Sites, in the Servers

subsection.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SiteAdd.jsp</literal></term>

<listitem>

<para>Enables the configuration of a load balancer to distribute requests to other existing OpenAM

servers. Available from the Configuration &gt; Servers and Sites, in the Sites subsection.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SiteEdit.jsp</literal></term>

<listitem>

<para>Enables changes to a configured load balancer in how it distributes requests to other existing

OpenAM servers. Available from the Configuration &gt; Servers and Sites, in the Sites

subsection.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SMDiscoveryBootstrapRefOffAdd.jsp</literal></term>

<listitem>

<para>Includes new resource offerings for the discovery service, bootstrapped using a standard such

as SAML2.</para>

<!-- Best guess, based on info from the OpenSSO Enterprise 8.0 Administration Guide -->

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SMDiscoveryBootstrapRefOffEdit.jsp</literal></term>

<listitem>

<para>Supports the editing of existing resource offerings for the discovery service, bootstrapped

with a standard such as SAML2.</para>

<!-- Best guess, based on info from the OpenSSO Enterprise 8.0 Administration Guide -->

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SMDiscoveryDescriptionAdd.jsp</literal></term>

<listitem>

<para>Includes the addition of of new options for the discovery service.</para>

<!-- Best guess, based on info from the OpenSSO Enterprise 8.0 Administration Guide -->

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SMDiscoveryDescriptionEdit.jsp</literal></term>

<listitem>

<para>Supports the editing of existing options for the discovery service.</para>

<!-- Best guess, based on info from the OpenSSO Enterprise 8.0 Administration Guide -->

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SMDiscoveryProviderResourceIdMapperAdd.jsp</literal></term>

<listitem>

<para>Supports the mapping of a new resource ID for the discovery service.</para>

<!-- Best guess, based on info from the OpenSSO Enterprise 8.0 Administration Guide -->

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SMDiscoveryProviderResourceIdMapperEdit.jsp</literal></term>

<listitem>

<para>Supports the editing of an existing resource ID for the discovery service.</para>

<!-- Best guess, based on info from the OpenSSO Enterprise 8.0 Administration Guide -->

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SMDiscoveryService.jsp</literal></term>

<listitem>

<para>Supports a review and configuration of the Discovery Server, for global attributes, the

ResourceID Mapper plug-in, and bootstrapping.</para>

<!-- Best guess, based on info from the screen that appears -->

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SMG11N.jsp</literal></term>

<listitem>

<para>Allows you to configure globalization settings for OpenAM; accessible via Configuration &gt;

Console &gt; Globalization Settings.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SMG11N.jsp</literal></term>

<listitem>

<para>Allows you to configure globalization settings for OpenAM; accessible via Configuration &gt;

Console &gt; Globalization Settings.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>STSExportPolicy.jsp</literal></term>

<listitem>

<para>Allows you to review and copy STS policies for export, input, and output. You can review this

via Configuration &gt; Global &gt; Security Token Service &gt; Export Policy.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SubConfigAdd.jsp</literal></term>

<listitem>

<para>Allows you to configure a secondary configuration instance; accessible via Configuration &gt;

Global &gt; Session.</para>

<!-- Best guess, based on info from the screen that appears -->

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SubConfigEdit.jsp</literal></term>

<listitem>

<para>Allows you to edit an existing secondary configuration instance; accessible via

Configuration &gt; Global &gt; Session.</para>

<!-- Best guess, based on info from the screen that appears -->

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SubSchemaTypeSelect.jsp</literal></term>

<listitem>

<para>Allows you to configure a schema assocaited with breadcrumbs.</para>

<!-- Best guess -->

</listitem>

</varlistentry>

</variablelist>

</section>

<section xml:id="console-session-jsp-endpoints">

<title>Session Console JSP Endpoints</title>

<indexterm>

<primary>Endpoints</primary>

<secondary>JSP</secondary>

<tertiary>Session Console</tertiary>

</indexterm>

<para>There are currently two service endpoints configured in the console/session subdirectory, related to

login sessions.</para>

<variablelist>

<varlistentry>

<term><literal>SMProfile.jsp</literal></term>

<listitem>

<para>Provides information on current login session statistics. Available from the Sessions tab from

the main console.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>SessionHAStatistics.jsp</literal></term>

<listitem>

<para>Supports session high availability statistics collection.</para>

</listitem>

</varlistentry>

</variablelist>

</section>

<section xml:id="console-task-jsp-endpoints">

<title>Task Console JSP Endpoints</title>

<indexterm>

<primary>Endpoints</primary>

<secondary>JSP</secondary>

<tertiary>Task Console</tertiary>

</indexterm>

<para>The service endpoints in the console/task subdirectory relate to the options available from the default

start page when an administrator logs into the OpenAM console. If you don't use Google Apps or Salesforce,

you may not need some of the functionality in the associated endpoints.</para>

<variablelist>

<varlistentry>

<term><literal>CompleteCreateHostedIDP.jsp</literal></term>

<listitem>

<para>Provides information on what the administrator can do after configuring an Identity Provider

(IDP). Options listed include registering a remote Service Provider (SP), creating a fedlet,

configuring Google Apps, and configuring Salesforce CRM. Includes links to such functionality,

which depend on the configuration of a Circle of Trust (CoT).</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ConfigureGoogleApps.jsp</literal></term>

<listitem>

<para>Supports the configuration of Google Apps for Single-sign on (SSO). Requires a CoT

configured with an IDP.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ConfigureGoogleAppsComplete.jsp</literal></term>

<listitem>

<para>Enables entries to configure the SP. Includes steps "To Enable Access to the Google Apps

API."</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ConfigureGoogleAppsWarning.jsp</literal></term>

<listitem>

<para>Includes a default warning message related to the ConfigureGoogleApps.jsp endpoint. The

message is self-explanatory, though grammatically questionable: "Unable to configure because there

are no circle of trust with Identity Provider."</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ConfigureOAuth2.jsp</literal></term>

<listitem>

<para>Supports the configuration of OAuth2 Authorization. For more information, see the

the chapter on <link xlink:href="admin-guide#chap-oauth2"

xlink:role="http://docbook.org/xlink/role/olink">

<citetitle>Managing OAuth2 Authorization in the Administration Guide</citetitle></link>.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ConfigureSalesForceApps.jsp</literal></term>

<listitem>

<para>Accessible when you select the Configure Salesforce CRM link shown in the main GUI console.

Requires IDP and SP information for an appropriate CoT, where OpenAM is the IDP and Salesforce

is configured as the SP.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ConfigureSalesForceAppsComplete.jsp</literal></term>

<listitem>

<para>Supports the configuration of SSO with a Salesforce CRM account. Includes instructions on

the settings to add to an applicable Salesforce account.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ConfigureSalesForceAppsFinishWarning.jsp</literal></term>

<listitem>

<para>Sets up a warning message related to a need for a Salesforce Login URL for the configuration.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>CreateFedlet.jsp</literal></term>

<listitem>

<para>A fedlet supports federation for a SP that does not already have its own federation solution.

For more information, see the

the chapter on <link xlink:href="dev-guide#chap-fedlet-java"

xlink:role="http://docbook.org/xlink/role/olink">

<citetitle>Using Fedlets in Java Web Applications in the Development Guide

</citetitle></link>.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>CreateFedletWarning.jsp</literal></term>

<listitem>

<para>Sets up a warning message related to the prerequisite for a CoT with the IDP.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>CreateHostedIDP.jsp</literal></term>

<listitem>

<para>Supports the configuration of a SAMLv2 IDP on the local instance of OpenAM.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>CreateHostedSP.jsp</literal></term>

<listitem>

<para>Supports the configuration of a SAMLv2 SP on the local instance of OpenAM.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>CreateRemoteIDP.jsp</literal></term>

<listitem>

<para>Supports the configuration of a SAMLv2 IDP on a remote system, within a configured CoT.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>CreateRemoteSP.jsp</literal></term>

<listitem>

<para>Supports the configuration of a SAMLv2 SP on a remote system, within a configured CoT.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>Home.jsp</literal></term>

<listitem>

<para>Endpoint that redirects the client to the startup page for OpenAM.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>ValidateSAML2Setup.jsp</literal></term>

<listitem>

<para>Supports the test of a federation connection between an IDP and SP in a CoT.</para>

</listitem>

</varlistentry>

</variablelist>

</section>

<section xml:id="console-user-jsp-endpoints">

<title>User Console JSP Endpoints</title>

<indexterm>

<primary>Endpoints</primary>

<secondary>JSP</secondary>

<tertiary>User Console</tertiary>

</indexterm>

<para>Endpoints in the console/user subdirectory support account configuration tasks. Many of these

endpoints are accessible by realm. From the home page screen, select Access Control &gt;

<replaceable>[realm]</replaceable> &gt; Subjects &gt; <replaceable>[name of user]</replaceable>. This

should open up an Edit User screen</para>

<variablelist>

<varlistentry>

<term><literal>UMChangeUserPassword.jsp</literal></term>

<listitem>

<para>This service endpoint is normally opened in a separate window to enable a user (or

administrator) to change their login password. Accessible from the Edit User screen. All

you need to do from the screen is click Edit next to the Password entry.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>UMUserDiscoveryDescriptionAdd.jsp</literal></term>

<listitem>

<para>Relates to the security mechanism identifier associated wih a user. To access from the screen

for an individual user, select Services &gt; Discovery Service &gt; Add &gt; scroll down to the

Service Description box &gt; New Description &gt; select and Add a Security Mechanism ID.

Example IDs include urn:liberty:security:2003-08:ClientTLS:SAML, which relates to the former

Liberty Alliance project, using Transaction Layer Security (TLS) on the client, with SAML

assertions.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>UMUserDiscoveryDescriptionEdit.jsp</literal></term>

<listitem>

<para>Supports editing of the security mechanism identifier associated with a user. Closely related

to the UMUserDiscoveryDescriptionAdd.jsp endpoint.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>UMUserPasswordResetOptions.jsp</literal></term>

<listitem>

<para>Allows you to "Force Change Password on Next Login". Accessible from the Edit User screen for

a specific user, via the "Password Reset Options" entry near the bottom of the window.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>UMUserResourceOffering.jsp</literal></term>

<listitem>

<para>Accessible as an option to the Discovery Service for a specific user. To access from the Edit

User screen for a specific user, select Services &gt; Discovery Service &gt; Add.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>UMUserResourceOfferingAdd.jsp</literal></term>

<listitem>

<para>Accessible as an option to the Discovery Service for a specific user. To access from the Edit

User screen for a specific user, select Services &gt; Discovery Service &gt; Add.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>UMUserResourceOfferingEdit.jsp</literal></term>

<listitem>

<para>Accessible as an option to the Discovery Service for a specific user. To edit an existing

resource offering, navigate to the Edit User screen for a specific user, select Services &gt;

Discovery Service &gt; <replaceable>[some previously configured service]</replaceable>.</para>

</listitem>

</varlistentry>

</variablelist>

</section>

<section xml:id="console-web-services-jsp-endpoints">

<title>Web Services Console JSP Endpoints</title>

<indexterm>

<primary>Endpoints</primary>

<secondary>JSP</secondary>

<tertiary>Web Services Console</tertiary>

</indexterm>

<para>Web services include endpoints in the console/webservices subdirectory. You can use them to define legacy

options for services such as the Liberty Identity Federation Framework (ID-FF). As such, these endpoints

may be less essential to your implementation of OpenAM.

For more information, see the

<link xlink:show="new"

xlink:href="http://www.forgerock.org/security_advisory2.html"><citetitle>OpenAM Wiki on Web Services

</citetitle></link>.</para>

<variablelist>

<varlistentry>

<term><literal>WSAuthNServices.jsp</literal></term>

<listitem>

<para>Supports the configuration of various mechanism handlers for authentication, including

CRAM-MD5, PLAIN, and SSOToken.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>WSAuthNServicesHandlersAdd.jsp</literal></term>

<listitem>

<para>Supports the addition of a new mechanism handler for authentication.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>WSAuthNServicesHandlersEdit.jsp</literal></term>

<listitem>

<para>Supports changes to an existing mechanism handler for authentication.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>WSPPServiceDSAttributeMapListAdd.jsp</literal></term>

<listitem>

<para>Enables the addition of a new LDAP attribute, with a name prefix.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>WSPPServiceDSAttributeMapListEdit.jsp</literal></term>

<listitem>

<para>Enables the editing of an existing LDAP attribute, with a name prefix.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>WSPPServiceSupportedContainerAdd.jsp</literal></term>

<listitem>

<para>Enables the creation of a new supported container for ID-FF.</para>

</listitem>

</varlistentry>

<varlistentry>

<term><literal>WSPPServiceSupportedContainerEdit.jsp</literal></term>

<listitem>

<para>Enables the editing of an existing container.</para>

</listitem>

</varlistentry>