# OpenAM Administration Guide
6.6. Configuring J2EE Policy Agents

Sidebar | Prev | Up | Next

### 6.6.4. Configuring J2EE Policy Agent OpenAM Services Properties

This section covers OpenAM services web agent properties. After creating the agent profile, you access these properties in the OpenAM console under Access Control > `Realm Name` > Agents > J2EE > `Agent Name` > OpenAM Services.

Login URL properties

OpenAM Login URL

  OpenAM login page URL, such as `http://openam.example.com:8080/openam/UI/Login`, to which the agent redirects incoming users without sufficient credentials so then can authenticate.

  Property: `com.sun.identity.agents.config.login.url`

OpenAM Conditional Login URL (Not yet in OpenAM console)

  To conditionally redirect users based on the incoming request URL, set this property.

  This takes the incoming request domain to match, a vertical bar ( `|` ), and then a comma-separated list of URLs to which to redirect incoming users.

  If the domain before the vertical bar matches an incoming request URL, then the policy agent uses the list of URLs to determine how to redirect the user-agent. If the global property FQDN Check (`com.sun.identity.agents.config.fqdn.check.enable`) is enabled for the policy agent, then the policy agent iterates through the list until it finds an appropriate redirect URL that matches the FQDN check. Otherwise, the policy agent redirects the user-agent to the first URL in the list.

  Property: `com.sun.identity.agents.config.conditional.login.url`

  Examples: `com.sun.identity.agents.config.conditional.login.url[0]= login.example.com|http://openam1.example.com/openam/UI/Login, http://openam2.example.com/openam/UI/Login`, `com.sun.identity.agents.config.conditional.login.url[1]= signin.example.com|http://openam3.example.com/openam/UI/Login, http://openam4.example.com/openam/UI/Login`

  If CDSSO is enabled for the policy agent, then this property takes CDSSO Servlet URLs for its values (`com.sun.identity.agents.config.cdsso.cdcservlet.url`), rather than OpenAM login URLs.

  CDSSO examples: `com.sun.identity.agents.config.conditional.login.url[0]= login.example.com|http://openam1.example.com/openam/cdcservlet, http://openam2.example.com/openam/cdcservlet`, `com.sun.identity.agents.config.conditional.login.url[1]= signin.example.com|http://openam3.example.com/openam/cdcservlet, http://openam4.example.com/openam/cdcservlet`

Login URL Prioritized

  When enabled, OpenAM uses the priority defined in the OpenAM Login URL list as the priority for Login and CDSSO URLs when handling failover.

  Property: `com.sun.identity.agents.config.login.url.prioritized`

Login URL Probe

  When enabled, OpenAM checks the availability of OpenAM Login URLs before redirecting to them.

  Property: `com.sun.identity.agents.config.login.url.probe.enabled`

Login URL Probe Timeout

  Timeout period in milliseconds for OpenAM to determine whether to failover between Login URLs when Login URL Probe is enabled.

  Property: `com.sun.identity.agents.config.login.url.probe.timeout`

  Default: 2000

Logout URL properties

OpenAM Logout URL

  OpenAM logout page URLs, such as `http://openam.example.com:8080/openam/UI/Logout`. The user is logged out of the OpenAM session when accessing these URLs.

  Property: `com.sun.identity.agents.config.logout.url`

OpenAM Conditional Logout URL (Not yet in OpenAM console)

  The values take the incoming request URL to match and a comma-separated list of URLs to which to redirect users logging out.

  Property: `com.sun.identity.agents.config.conditional.logout.url`

  Example: `com.sun.identity.agents.config.conditional.logout.url[0]= logout.example.com|http://openam1.example.com/openam/UI/Logout, http://openam2.example.com/openam/UI/Logout`

Logout URL Prioritized

  When enabled, OpenAM uses the priority defined in the OpenAM Logout URL list as the priority for Logout URLs when handling failover.

  Property: `com.sun.identity.agents.config.logout.url.prioritized`

Logout URL Probe

  When enabled, OpenAM checks the availability of OpenAM Logout URLs before redirecting to them.

  Property: `com.sun.identity.agents.config.logout.url.probe.enabled`

Logout URL Probe Timeout

  Timeout period in milliseconds for OpenAM to determine whether to failover between Logout URLs when Logout URL Probe is enabled.

  Property: `com.sun.identity.agents.config.logout.url.probe.timeout`

  Default: 2000

Authentication Service properties

OpenAM Authentication Service Protocol

  Specifies the protocol used by the OpenAM authentication service.

  Property: `com.iplanet.am.server.protocol`

  Hot swap: no

OpenAM Authentication Service Host Name

  Specifies the OpenAM authentication service host name.

  Property: `com.iplanet.am.server.host`

  Hot swap: no

OpenAM Authentication Service Port

  Specifies the OpenAM authentication service port number.

  Property: `com.iplanet.am.server.port`

  Hot swap: no

Policy Client Service properties

Enable Policy Notifications

  When enabled, OpenAM sends notification about changes to policy.

  Property: `com.sun.identity.agents.notification.enabled`

  Hot swap: no

Policy Client Polling Interval

  Specifies the time in minutes after which the policy cache is refreshed.

  Property: `com.sun.identity.agents.polling.interval`

  Default: 3

  Hot swap: no

Policy Client Cache Mode

  Set to cache mode subtree when only a small number of policy rules are defined. For large numbers of policy rules, set to self.

  Property: `com.sun.identity.policy.client.cacheMode`

  Default: self

  Hot swap: no

Policy Client Boolean Action Values

  Specifies the values, such as `allow` and `deny`, that are associated with boolean policy decisions.

  Default: `iPlanetAMWebAgentService|GET|allow|deny:iPlanetAMWebAgentService|POST|allow|deny`

  Property: `com.sun.identity.policy.client.booleanActionValues`

  Hot swap: no

Policy Client Resource Comparators

  Specifies the comparators used for service names in policy.

  Default: `serviceType=iPlanetAMWebAgentService| class=com.sun.identity.policy.plugins.HttpURLResourceName|wildcard=*| delimiter=/|caseSensitive=false`

  Property: `com.sun.identity.policy.client.resourceComparators`

  Hot swap: no

Policy Client Clock Skew

  Time in seconds used adjust time difference between agent system and OpenAM. Clock skew in seconds = AgentTime - OpenAMServerTime.

  Default: 10.

  Property: `com.sun.identity.policy.client.clockSkew`

  Hot swap: no

URL Policy Env GET Parameters

  Specifies the list of HTTP GET request parameters whose names and values the agents sets in the environment map for URL policy evaluation by the OpenAM server.

  Property: `com.sun.identity.agents.config.policy.env.get.param`

URL Policy Env POST Parameters

  Specifies the list of HTTP POST request parameters whose names and values the agents sets in the environment map for URL policy evaluation by the OpenAM server.

  Property: `com.sun.identity.agents.config.policy.env.post.param`

URL Policy Env jsession Parameters

  Specifies the list of HTTP session attributes whose names and values the agents sets in the environment map for URL policy evaluation by the OpenAM server.

  Property: `com.sun.identity.agents.config.policy.env.jsession.param`

Use HTTP-Redirect for composite advice

  When enabled, the remote policy client is configured to use HTTP-Redirect instead of HTTP-POST for composite advice.

  Property: `com.sun.identity.agents.config.policy.advice.use.redirect`

User Data Cache Service properties

Enable Notification of User Data Caches

  When enabled, receive notification from OpenAM to update user management data caches.

  Property: `com.sun.identity.idm.remote.notification.enabled`

  Hot swap: no

User Data Cache Polling Time

  If notifications are not enabled and set to a value other than zero, specifies the time in minutes after which the agent polls to update cached user management data.

  Property: `com.iplanet.am.sdk.remote.pollingTime`

  Default: 1

  Hot swap: no

Enable Notification of Service Data Caches

  When enabled, receive notification from OpenAM to update service configuration data caches.

  Property: `com.sun.identity.sm.notification.enabled`

  Hot swap: no

Service Data Cache Time

  If notifications are not enabled and set to a value other than zero, specifies the time in minutes after which the agent polls to update cached service configuration data.

  Property: `com.sun.identity.sm.cacheTime`

  Default: 1

  Hot swap: no

Session Client Service properties

Enable Client Polling

  When enabled, the session client polls to update the session cache rather than relying on notifications from OpenAM.

  Property: `com.iplanet.am.session.client.polling.enable`

  Hot swap: no

Client Polling Period

  Specifies the time in seconds after which the session client requests an update from OpenAM for cached session information.

  Property: `com.iplanet.am.session.client.polling.period`

  Default: 180

  Hot swap: no