# OpenAM Administration Guide
Chapter 4. Defining Entitlements

Sidebar | Prev | Up | Next

## 4.2. Managing Entitlements on the Command Line

To manage entitlements, you can use the ssoadm command. The ssoadm command provides several other subcommands for managing entitlements in addition to those shown here.

Procedure 4.1. To List Current Policies

- Use the ssoadm list-xacml command to list current policies, ready for export.

      $ ssoadm list-xacml --realm / --adminid amadmin --password-file /tmp/pwd.txt

      <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
      <PolicySet PolicyCombiningAlgId="urn:oasis:names:tc:xacml:3.0:
       rule-combining-algorithm:deny-overrides" Version="2011.10.07.12.22.04.705"
       PolicySetId="/:2011.10.07.12.22.04.704" xmlns="urn:oasis:names:tc:xacml:3.0:
       core:schema:cd-1">
          <Target/>
      ... other policies ...
          <Policy RuleCombiningAlgId="urn:oasis:names:tc:xacml:3.0:
       rule-combining-algorithm:deny-overrides" Version="2011.10.07.11.51.27.444"
       PolicyId="New Policy">
      ... policy content here ...
          </Policy>
      </PolicySet>

Procedure 4.2. To Import an Entitlements Policy

- Use the ssoadm create-xacml command to import a policy.

      $ ssoadm
       create-xacml
       --realm /
       --xmlfile policy.xml
       --adminid amadmin
       --password-file /tmp/pwd.txt

Procedure 4.3. To Create an Application

- Use the ssoadm create-appl command to create an application type.

      $ cat application.txt
      resources=http://myapp.example.com:80/*
      subjects=com.sun.identity.admin.model.IdRepoUserViewSubject
      subjects=com.sun.identity.admin.model.VirtualViewSubject
      subjects=com.sun.identity.admin.model.OrViewSubject
      subjects=com.sun.identity.admin.model.AndViewSubject
      conditions=com.sun.identity.admin.model.DateRangeCondition
      conditions=com.sun.identity.admin.model.DaysOfWeekCondition
      conditions=com.sun.identity.admin.model.IpRangeViewCondition
      conditions=com.sun.identity.admin.model.DnsNameViewCondition
      conditions=com.sun.identity.admin.model.TimeRangeCondition
      conditions=com.sun.identity.admin.model.TimezoneCondition
      conditions=com.sun.identity.admin.model.OrViewCondition
      conditions=com.sun.identity.admin.model.AndViewCondition
      conditions=com.sun.identity.admin.model.NotViewCondition
      entitlementCombiner=com.sun.identity.entitlement.DenyOverride
      $ ssoadm
       create-appl
       --realm /
       --applicationtype iPlanetAMWebAgentService
       --name myApp
       --adminid amadmin
       --password-file /tmp/pwd.txt
       --datafile application.txt

      myApp was created.