# OpenAM Administration Guide
6.5. Configuring Web Policy Agents

Sidebar | Prev | Up | Next

### 6.5.2. Configuring Web Policy Agent Application Properties

This section covers application web agent properties. After creating the agent profile, you access these properties in the OpenAM console under Access Control > `Realm Name` > Agents > Web > `Agent Name` > Application.

Not Enforced URL Processing properties

Ignore Path Info for Not Enforced URLs

  When enabled, the path info and query are stripped from the request URL before being compared with the URLs of the not enforced list for those URLs containing a wildcard character. This prevents a user from accessing `http://host/index.html` by requesting `http://host/index.html/hack.gif` when the not enforced list includes `http://host/*.gif`.

  | Note
  This setting is not supported by the Varnish Cache agent.

  For a more generally applicable setting, see Ignore Path Info properties.

  Property: `com.sun.identity.agents.config.ignore.path.info.for.not.enforced.list`

Enable Regular Expressions for Not Enforced URLs (Not yet in OpenAM console)

  Enable use of Perl-compatible regular expressions in Not Enforced URL settings by using the following property under Advanced > Custom Properties in the agent profile.

      com.forgerock.agents.notenforced.url.regex.enable=true

Not Enforced URLs

  List of URLs for which no authentication is required. You can use wildcards to define a pattern for a URL.

  The `*` wildcard matches all characters except question mark (`?`), cannot be escaped, and spans multiple levels in a URL. Multiple forward slashes do not match a single forward slash, so `*` matches `mult/iple/dirs`, yet `mult/*/dirs` does not match `mult/dirs`.

  The `-*-` wildcard matches all characters except forward slash (`/`) or question mark (`?`), and cannot be escaped. As it does not match `/`, `-*-` does not span multiple levels in a URL.

  OpenAM does not let you mix `*` and `-*-` in the same URL.

  Examples include `http://www.example.com/logout.html`, `http://www.example.com/images/*`, `http://www.example.com/css/-*-`, and `http://www.example.com/*.jsp?locale=*`.

  Trailing forward slashes are not recognized as part of a resource name. Therefore `http://www.example.com/images//` and `http://www.example.com/images` are equivalent.

  Property: `com.sun.identity.agents.config.notenforced.url`

  If you enabled use of Perl-compatible regular expressions to match Not Enforced URLs, then all your settings must be done using regular expressions. (Do not mix settings; use either the mechanism described above or Perl-compatible regular expressions, but not both.)

  The following example shows settings where no authentication is required for URLs whose path ends `/publicA` or `/publicB` (with or without query string parameters), and no authentication is required to access .png, .jpg, .gif, .js, or .css files under URLs that do not contain `/protectedA/` or `/protectedB/`.

      .*/(PublicServletA|PublicServletB)(\?.*|$)
      ^(?!.*(/protectedA/|/protectedB/)).*\.(png|jpg|gif|js|css)(\?.*|$)

Invert Not Enforced URLs

  Only enforce not enforced list of URLs. In other words, enforce policy only for those URLs and patterns specified in the list.

  Property: `com.sun.identity.agents.config.notenforced.url.invert`

Fetch Attributes for Not Enforced URLs

  When enabled, the agent fetches profile, response, and session attributes that are mapped by doing policy evaluation, and forwards these attributes to not enforced URLs.

  Property: `com.sun.identity.agents.config.notenforced.url.attributes.enable`

Not Enforced IP Processing properties

Not Enforced Client IP List

  No authentication and authorization are required for the requests coming from these client IP addresses.

  Property: `com.sun.identity.agents.config.notenforced.ip`

CIDR Client IP Specification (Not yet in OpenAM console)

  As of version 3.0.4, web policy agents with this property set to `cidr` can use IPv4 netmasks and IP ranges instead of wildcards as values for Not Enforced Client IP addresses. Version 3.0.5 adds support for IPv6, including the IPv6 loopback address, `::1`.

  When the parameter is defined, wildcards are ignored in Not Enforced Client IP settings. Instead, you can use settings such as those shown in the following examples.

  Netmask Example

    To disable policy agent enforcement for addresses in 192.168.1.1 to 192.168.1.255, use the following setting.

        com.sun.identity.agents.config.notenforced.ip = 192.168.1.1/24

    The following example shows an IPv6 address with a corresponding network mask.

        com.sun.identity.agents.config.notenforced.ip = 2001:5c0:9168:0:0:0:0:2/128

    Currently the policy agent stops evaluating properties after reaching an invalid netmask in the list.

  IP Range Example

    To disable policy agent enforcement for addresses between 192.168.1.1 to 192.168.4.3 inclusive, use the following setting.

        com.sun.identity.agents.config.notenforced.ip = 192.168.1.1-192.168.4.3

    The following example shows a range of IPv6 addresses.

        com.sun.identity.agents.config.notenforced.ip = 2001:5c0:9168:0:0:0:0:1-2001:5c0:9168:0:0:0:0:2

  Property: `com.forgerock.agents.config.notenforced.ip.handler`

  Hot swap: no

Client IP Validation

  When enabled, validate that the subsequent browser requests come from the same IP address that the SSO token is initially issued against.

  Property: `com.sun.identity.agents.config.client.ip.validation.enable`

Profile Attributes Processing properties

Profile Attribute Fetch Mode

  When set to `HTTP_COOKIE` or `HTTP_HEADER`, profile attributes are introduced into the cookie or the headers, respectively.

  Property: `com.sun.identity.agents.config.profile.attribute.fetch.mode`

Profile Attribute Map

  Maps the profile attributes to HTTP headers for the currently authenticated user. Map Keys are LDAP attribute names, and Map Values are HTTP header names.

  To populate the value of profile attribute CN under `CUSTOM-Common-Name`: enter CN in the Map Key field, and enter `CUSTOM-Common-Name` in the Corresponding Map Value field. This corresponds to `com.sun.identity.agents.config.profile.attribute.mapping[cn]=CUSTOM-Common-Name`.

  In most cases, in a destination application where an HTTP header name shows up as a request header, it is prefixed by `HTTP_`, lower case letters become upper case, and hyphens (`-`) become underscores (`_`). For example, `common-name` becomes `HTTP_COMMON_NAME`.

  Property: `com.sun.identity.agents.config.profile.attribute.mapping`

Response Attributes Processing properties

Response Attribute Fetch Mode

  When set to `HTTP_COOKIE` or `HTTP_HEADER`, response attributes are introduced into the cookie or the headers, respectively.

  Property: `com.sun.identity.agents.config.response.attribute.fetch.mode`

Response Attribute Map

  Maps the policy response attributes to HTTP headers for the currently authenticated user. The response attribute is the attribute in the policy response to be fetched.

  To populate the value of response attribute `uid` under `CUSTOM-User-Name`: enter `uid` in the Map Key field, and enter `CUSTOM-User-Name` in the Corresponding Map Value field. This corresponds to `com.sun.identity.agents.config.response.attribute.mapping[uid]=Custom-User-Name`.

  In most cases, in a destination application where an HTTP header name shows up as a request header, it is prefixed by `HTTP_`, lower case letters become upper case, and hyphens (`-`) become underscores (`_`). For example, `response-attr-one` becomes `HTTP_RESPONSE_ATTR_ONE`.

  Property: `com.sun.identity.agents.config.response.attribute.mapping`

Session Attributes Processing properties

Session Attribute Fetch Mode

  When set to `HTTP_COOKIE` or `HTTP_HEADER`, session attributes are introduced into the cookie or the headers, respectively.

  Property: `com.sun.identity.agents.config.session.attribute.fetch.mode`

Session Attribute Map

  Maps session attributes to HTTP headers for the currently authenticated user. The session attribute is the attribute in the session to be fetched.

  To populate the value of session attribute `UserToken` under `CUSTOM-userid`: enter `UserToken` in the Map Key field, and enter `CUSTOM-userid` in the Corresponding Map Value field. This corresponds to `com.sun.identity.agents.config.session.attribute.mapping[UserToken] =CUSTOM-userid`.

  In most cases, in a destination application where an HTTP header name shows up as a request header, it is prefixed by `HTTP_`, lower case letters become upper case, and hyphens (`-`) become underscores (`_`). For example, `success-url` becomes `HTTP_SUCCESS_URL`.

  Property: `com.sun.identity.agents.config.session.attribute.mapping`

Common Attributes Fetching Processing properties

Attribute Multi Value Separator

  Specifies separator for multiple values. Applies to all types of attributes such as profile, session and response attributes. Default: `|`.

  Property: `com.sun.identity.agents.config.attribute.multi.value.separator`