Novell ACCESS MANAGER 3.1 SP1 - AGENT GUIDE Bedienungsanleitung

Novell®

www.novell.com

novdocx (en) 13 May 2009

AUTHORIZED DOCUMENTATION

Novell Access Manager 3.1 SP1 Agent Guide

Access Manager

3.1 SP 1

July 15, 2009

J2EE* Agent Guide

novdocx (en) 13 May 2009

Legal Notices

Novell, Inc., makes no representations or warranties with respect to the contents or use of this documentation, and

specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose.

Further, Novell, Inc., reserves the right to revise this publication and to make changes to its content, at any time,

without obligation to notify any person or entity of such revisions or changes.

Further, Novell, Inc., makes no representations or warranties with respect to any software, and specifically disclaims

any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc.,

reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to

notify any person or entity of such changes.

Any products or technical information provided under this Agreement may be subject to U.S. export controls and the

trade laws of other countries. You agree to comply with all export control regulations and to obtain any required

licenses or classification to export, re-export or import deliverables. You agree not to export or re-export to entities on

the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in the U.S. export laws.

You agree to not use deliverables for prohibited nuclear, missile, or chemical biological weaponry end uses. See the

Novell International Trade Services Web page (http://www.novell.com/info/exports/) for more information on

exporting Novell software. Novell assumes no responsibility for your failure to obtain any necessary export

approvals.

stored on a retrieval system, or transmitted without the express written consent of the publisher.

Novell, Inc., has intellectual property rights relating to technology embodied in the product that is described in this

document. In particular, and without limitation, these intellectual property rights may include one or more of the U.S.

patents listed on the Novell Legal Patents Web page (http://www.novell.com/company/legal/patents/) and one or

more additional patents or pending patent applications in the U.S. and in other countries.

Novell, Inc.

404 Wyman Street, Suite 500

Waltham, MA 02451

U.S.A.

www.novell.com

Online Documentation: To access the latest online documentation for this and other Novell products, see

the Novell Documentation Web page (http://www.novell.com/documentation).

novdocx (en) 13 May 2009

Novell Trademarks

For Novell trademarks, see the Novell Trademark and Service Mark list (http://www.novell.com/company/legal/

trademarks/tmlist.html).

Third-Party Materials

All third-party trademarks are the property of their respective owners.

4Novell Access Manager 3.1 SP1 Agent Guide

novdocx (en) 13 May 2009

Contents 5

Contents

novdocx (en) 13 May 2009

About This Guide 9

1 Installing the J2EE Agents 11

1.1 Overview of J2EE Agents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

1.2 Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

1.3 Installing the J2EE Agent on JBoss . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

1.3.1 Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

1.3.2 Installing and Configuring the JBoss Web Deployer Service. . . . . . . . . . . . . . . . . . . 13

1.3.3 Installing JBoss By Using the Installer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

1.3.4 Installing the JBoss Agent Through the Console. . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

1.4 Installing the J2EE Agent on WebSphere . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

1.4.1 Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

1.4.2 Installing on WebSphere By Using the Installer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

1.4.3 Installing the WebSphere Agent Through the Console . . . . . . . . . . . . . . . . . . . . . . . 27

1.4.4 Configuring WebSphere for J2EE Agents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

1.5 Installing the J2EE Agent on WebLogic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

1.5.1 Installing WebLogic Agent by Using the Installer. . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

1.5.2 Installing a J2EE Agent by Using the Console . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

1.5.3 Configuring WebLogic for J2EE Agents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

1.5.4 Deploying the Example Payroll Application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

1.6 Verifying If a J2EE Agent Is Installed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

1.7 Uninstalling a J2EE Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

2 Configuring the Agent for Authentication 45

2.1 Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45

2.2 Possible Configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46

2.2.1 Allowing Direct Access to the J2EE Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46

2.2.2 Protecting the Application Server with the Access Gateway . . . . . . . . . . . . . . . . . . . 47

2.3 Configuring the Agent for Direct Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

2.4 Configuring Authentication Contract . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

2.4.1 Protecting Different Applications By Using Different Authentication Contracts . . . . . 49

2.4.2 Configuring Additional Authentication for Applications . . . . . . . . . . . . . . . . . . . . . . . 52

2.5 Protecting the Application Server with the Access Gateway . . . . . . . . . . . . . . . . . . . . . . . . . . 53

2.5.1 Setting Up a Path-Based Proxy Service for an Application Server . . . . . . . . . . . . . . 53

2.5.2 Setting Up a Domain-Based Proxy Service for an Application Server. . . . . . . . . . . . 57

2.5.3 Configuring a Protected Agent for Access. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61

3 Clustering J2EE Agents 63

3.1 Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63

3.2 Creating a Cluster Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63

3.3 Assigning a J2EE Agent to a Cluster . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64

3.4 Modifying Cluster Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

3.5 Removing a J2EE Agent from a Cluster . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

4 Preparing the Applications and the J2EE Servers 67

4.1 Preparing the Application for the Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67

6Novell Access Manager 3.1 SP1 Agent Guide

novdocx (en) 13 May 2009

4.1.1 Configuring for Login . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67

4.1.2 Configuring for Logout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68

4.2 Configuring Applications on the JBoss Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69

4.2.1 Configuring a Security Domain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69

4.2.2 Configuring Security Constraints . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70

4.2.3 Configuring for Roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70

4.3 Configuring Applications on the WebSphere Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71

4.3.1 Configuring for Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71

4.3.2 Configuring for RunAs Roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71

4.4 Configuring Applications on the WebLogic Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73

5 Configuring the Basic Features of a J2EE Agent 75

5.1 Enabling Tracing and Auditing of Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75

5.1.1 Tracing Events to Log Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75

5.1.2 Enabling the Auditing of Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76

5.2 Managing Embedded Service Provider Certificates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77

5.3 Configuring SSL Certificate Trust. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77

5.4 Modifying the Display Name and Other Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78

5.5 Changing the IP Address of a J2EE Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78

6 Protecting Web and Enterprise JavaBeans Modules 79

6.1 Configuring Access Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79

6.2 Protecting Web Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80

6.2.1 Creating a Protected Resource for a Web Application . . . . . . . . . . . . . . . . . . . . . . . 80

6.2.2 Assigning a Web Authorization Policy to the Resource . . . . . . . . . . . . . . . . . . . . . . . 82

6.3 Protecting Enterprise JavaBeans Resources. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82

6.3.1 Creating a Protected Enterprise JavaBean Resource . . . . . . . . . . . . . . . . . . . . . . . . 82

6.3.2 Assigning an Enterprise JavaBeans Authorization Policy to a Resource . . . . . . . . . 84

7 Deploying the Sample Payroll Application 85

7.1 Using the J2EE Server to Enforce Authorization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85

7.2 Using Access Manager Policies to Enforce Authorization . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86

7.2.1 Creating an Employee Role and a Manager Role . . . . . . . . . . . . . . . . . . . . . . . . . . . 86

7.2.2 Creating Authorization Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88

7.2.3 Assigning Policies to Protected Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93

7.2.4 Testing the Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94

8 Managing a J2EE Agent 97

8.1 Viewing General Status Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97

8.2 Stopping and Starting the Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98

8.3 Stopping and Starting the Embedded Service Provider . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98

8.4 Deleting an Agent from the Administration Console . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99

8.5 Viewing Platform Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99

8.6 Managing the Health of an Agent. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100

8.7 Managing Alerts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101

8.8 Viewing the Status of Recent Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103

8.9 Viewing Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103

Contents 7

novdocx (en) 13 May 2009

9 Troubleshooting the J2EE Agent 105

9.1 Troubleshooting the J2EE Agent Import . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105

9.2 Authorization Policies Fail for Some Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105

9.3 Health Status Displays as Server Is Not Reporting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106

9.4 Error: Invalid Administration Server IP Address. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106

9.4.1 JRE Version is Wrong . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106

9.4.2 Issues With the Administration Console . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106

9.5 Installer Stops Responding While Installing on WebSphere . . . . . . . . . . . . . . . . . . . . . . . . . 107

9.6 Unable to Federate WebSphere Custom Profile If Agent is Already Installed . . . . . . . . . . . . 107

9.7 Authorization Fails in the WebSphere Application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108

9.8 Audit Log Event Problems on 64-Bit Platforms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108

9.8.1 JBoss Agent. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108

9.8.2 WebLogic Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109

9.9 JBoss and SSL. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109

9.10 Viewing Log Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109

9.11 Troubleshooting Access Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109

8Novell Access Manager 3.1 SP1 Agent Guide

novdocx (en) 13 May 2009

About This Guide 9

novdocx (en) 13 May 2009

About This Guide

This guide describes the J2EE Agents and explains how to install, configure, and manage them:

Chapter 1, “Installing the J2EE Agents,” on page 11

Chapter 2, “Configuring the Agent for Authentication,” on page 45

Chapter 3, “Clustering J2EE Agents,” on page 63

Chapter 4, “Preparing the Applications and the J2EE Servers,” on page 67

Chapter 5, “Configuring the Basic Features of a J2EE Agent,” on page 75

Chapter 6, “Protecting Web and Enterprise JavaBeans Modules,” on page 79

Chapter 7, “Deploying the Sample Payroll Application,” on page 85

Chapter 8, “Managing a J2EE Agent,” on page 97

Chapter 9, “Troubleshooting the J2EE Agent,” on page 105

Audience

This guide is intended for Access Manager administrators. It is assumed that you have knowledge of

evolving Internet protocols, such as:

Extensible Markup Language (XML)

Simple Object Access Protocol (SOAP)

Security Assertion Markup Language (SAML)

Public Key Infrastructure (PKI) digital signature concepts and Internet security

Secure Socket Layer/Transport Layer Security (SSL/TSL)

Hypertext Transfer Protocol (HTTP and HTTPS)

Uniform Resource Identifiers (URIs)

Domain Name System (DNS)

Web Services Description Language (WSDL)

Feedback

We want to hear your comments and suggestions about this guide and the other documentation

included with this product. Please use the User Comments feature at the bottom of each page of the

online documentation, or go to Documentation Feedback (http://www.novell.com/documentation/

feedback.html) at www.novell.com/documentation/feedback.html and enter your comments there.

Documentation Updates

For the most recent version of the Access Manager J2EE Agent Guide, visit the Novell Access

Manager Documentation Web site (http://www.novell.com/documentation/novellaccessmanager31).

10 Novell Access Manager 3.1 SP1 Agent Guide

novdocx (en) 13 May 2009

Additional Documentation

Before proceeding, you should be familiar with the Novell Access Manager 3.1 SP1 Installation

Guide and the Novell Access Manager 3.1 SP1 Setup Guide, which provide information about

setting up the Access Manager system.

Documentation Conventions

In Novell®documentation, a greater-than symbol (>) is used to separate actions within a step and

items in a cross-reference path.

A trademark symbol (®, TM, etc.) denotes a Novell trademark. An asterisk (*) denotes a third-party

trademark.

When a single pathname can be written with a backslash for some platforms or a forward slash for

other platforms, the pathname is presented with a backslash. Users of platforms that require a

forward slash, such as Linux* or UNIX*, should use forward slashes as required by your software.

Dieses Handbuch passt für folgende Modelle

Inhaltsverzeichnis

Andere Novell Software Handbücher

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - COMMAND LINE UTILITIES REFERENCE 10.3... Installations- und Betriebshandbuch

Novell

Novell GROUPWISE 8 - POST OFFICES Bedienungsanleitung

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - NETWORK DISCOVERY DATABASE... Kurzanleitung

Novell

Novell OPEN ENTERPRISE SERVER 2.0 SP2 - DOMAIN SERVICE FOR... Bedienungsanleitung

Novell

Novell SENTINEL LOG MANAGER 1.0.0.5 - S Bedienungsanleitung

Novell

Novell GROUPWISE 8 - DISTRIBUTION LISTS Bedienungsanleitung

Novell

Novell GROUPWISE 7 - WEB ACCESS Bedienungsanleitung

Novell

Novell LINUX ENTERPRISE 11 SP1 - LINUX AUDIT Bedienungsanleitung

Novell

Novell ACCESS MANAGER 3.1 SP2 - README 2010 Bedienungsanleitung

Novell

Novell GROUPWISE 7 - SECURITY POLICIES Bedienungsanleitung

Novell

Novell ACCESS MANAGER 3.1 SP2 - SSL VPN USER GUIDE... Bedienungsanleitung

Novell

Novell OPEN ENTERPRISE SERVER - CONVERSION GUIDE... Bedienungsanleitung

Novell

Novell LINUX ENTERPRISE DESKTOP 11 - ADMINISTRATION GUIDE... Benutzerhandbuch

Novell

Novell BUSINESS CONTINUITY CLUSTERING 1.2 -... Bedienungsanleitung

Novell

Novell PLATESPIN ORCHESTRATE 2.0.2 - DEVELOPMENT CLIENT REFERENCE... Service-Handbuch

Novell

Novell LINUX ENTERPRISE 10 SP1 - LINUX AUDIT Bedienungsanleitung

Novell

Novell SENTINEL RAPID DEPLOYMENT 6.1 - INSTALLATION GUIDE... Bedienungsanleitung

Novell

Novell DATA SYNCHRONIZER - 07-2010 Bedienungsanleitung

Novell

Novell GROUPWISE 8 - WEBACCESS Bedienungsanleitung

Novell

Novell GROUPWISE 8 - MONITOR Bedienungsanleitung

Novell

Novell ZENWORKS HANDELD MANAGEMENT 7 SP1 IR4 Bedienungsanleitung

Novell

Novell GROUPWISE 7 - DOMAINS Bedienungsanleitung

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - COMMAND LINE UTILITIES REFERENCE 10.3... Bedienungsanleitung

Novell

Novell SENTINEL LOG MANAGER 1.0.0.4 - S Bedienungsanleitung

Beliebte Software Handbücher anderer Marken

COMPRO

COMPRO COMPROFM Bedienungsanleitung

Muratec

Muratec OFFICEBRIDGE ONLINE Bedienungsanleitung

Oracle

Oracle Contact Center Anywhere 8.1 Bedienungsanleitung

Adobe

Adobe 65007312 - Photoshop Lightroom Handbuch

Avaya

Avaya NULL One-X for RIM Blackberry Bedienungsanleitung

HP ProLiant BL420c Bedienungsanleitung

PS Audio

PS Audio PowerPlay Betriebsanleitung

Brady

Brady LOCKOUT PRO 3.0 Service-Handbuch

Avaya

Avaya Interaction Center Bedienungsanleitung

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Handbuch

Oracle

Oracle Application 9i Bedienungsanleitung

Acer

Acer RDM Bedienungsanleitung

Canon

Canon Vixia HF21 Bedienungsanleitung

Canon

Canon ZR950 Bedienungsanleitung

Samsung

Samsung Auto Backup Bedienungsanleitung

Polycom

Polycom Vortex EF2201 Montage- und Bedienungsanleitung

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Bedienungsanleitung

Lexmark

Lexmark Apps Service-Handbuch