# OpenAM Administration Guide
6.5. Configuring Web Policy Agents

Sidebar | Prev | Up | Next

### 6.5.1. Configuring Web Policy Agent Global Properties

This section covers global web agent properties. After creating the agent profile, you access these properties in the OpenAM console under Access Control > `Realm Name` > Agents > Web > `Agent Name` > Global.

Profile properties

Group

  For assigning the agent to a previously configured web agent group in order to inherit selected properties from the group.

Password

  Agent password used when creating the password file and when installing the agent.

Status

  Status of the agent configuration.

Location of Agent Configuration Repository

  Indicates agent's configuration located either on agent's host or centrally on OpenAM server.

  If you change this to a local configuration, you can no longer manage the policy agent configuration through OpenAM console.

  Property: `com.sun.identity.agents.config.repository.location`

Agent Configuration Change Notification

  Enable agent to receive notification messages from OpenAM server for configuration changes.

  Property: `com.sun.identity.agents.config.change.notification.enable`

Enable Notifications

  If enabled, the agent receives policy updates from the OpenAM notification mechanism to maintain its internal cache. If disabled, the agent must poll OpenAM for changes.

  Property: `com.sun.identity.agents.config.notification.enable`

  Hot swap: no

Agent Notification URL

  URL used by agent to register notification listeners.

  Property: `com.sun.identity.client.notification.url`

  Hot swap: no

Agent Deployment URI Prefix

  The default value is ``agent-root-URL`/amagent`.

  Property: `com.sun.identity.agents.config.agenturi.prefix`

  Hot swap: yes

Configuration Reload Interval

  Interval in minutes to fetch agent configuration from OpenAM. Used if notifications are disabled. Default: 60.

  Property: `com.sun.identity.agents.config.polling.interval`

  Hot swap: no

Configuration Cleanup Interval

  Interval in minutes to cleanup old agent configuration entries unless they are referenced by current requests. Default: 30.

  Property: `com.sun.identity.agents.config.cleanup.interval`

  Hot swap: no

Agent Root URL for CDSSO

  The agent root URL for CDSSO. The valid value is in the format ``protocol`://`hostname`:`port`/` where `protocol` represents the protocol used, such as `http` or `https`, `hostname` represents the host name of the system where the agent resides, and `port` represents the port number on which the agent is installed. The slash following the port number is required.

  If your agent system also has virtual host names, add URLs with the virtual host names to this list as well. OpenAM checks that `goto` URLs match one of the agent root URLs for CDSSO.

General properties

SSO Only Mode

  When enabled, agent only enforces authentication (SSO), but no policies for authorization.

  Property: `com.sun.identity.agents.config.sso.only`

Resources Access Denied URL

  The URL of the customized access denied page. If no value is specified (default), then the agent returns an HTTP status of 403 (Forbidden).

  Property: `com.sun.identity.agents.config.access.denied.url`

Agent Debug Level

  Default is `Error`. Increase to `Message` or even `All` for fine-grained detail.

  Property: `com.sun.identity.agents.config.debug.level`

  You can set the level in the configuration file by module using the format ``module`[:`level`][,`module`[:`level`]]*`, where `module` is one of `AuthService`, `NamingService`, `PolicyService`, `SessionService`, `PolicyEngine`, `ServiceEngine`, `Notification`, `PolicyAgent`, `RemoteLog`, or `all`, and `level` is one of the following.

  - `0`: Disable logging from specified module

    At this level the agent nevertheless logs messages having the level value `always`.

  - `1`: Log error messages

  - `2`: Log warning and error messages

  - `3`: Log info, warning, and error messages

  - `4`: Log debug, info, warning, and error messages

  - `5`: Like level 4, but with even more debugging messages

  When you omit `level`, the agent uses the default level, which is the level associated with the `all` module.

  The following example used in the local configuration sets the log overall level to debug for all messages.

      com.sun.identity.agents.config.debug.level=all:4

Agent Debug File Rotation

  When enabled, rotate the debug file when specified file size is reached.

  Property: `com.sun.identity.agents.config.debug.file.rotate`

Agent Debug File Size

  Debug file size in bytes beyond which the log file is rotated. The minimum is 1048576 bytes (1 MB), and lower values are reset to 1 MB. OpenAM console sets a default of 10 MB.

  Property: `com.sun.identity.agents.config.debug.file.size`

Audit properties

Audit Access Types

  Types of messages to log based on user URL access attempts.

  Property: `com.sun.identity.agents.config.audit.accesstype`

  Valid values for the configuration file property include `LOG_NONE`, `LOG_ALLOW`, `LOG_DENY`, and `LOG_BOTH`.

Audit Log Location

  Specifies where audit messages are logged. By default, audit messages are logged remotely.

  Property: `com.sun.identity.agents.config.log.disposition`

  Valid values for the configuration file property include `REMOTE`, `LOCAL`, and `ALL`.

Remote Log Filename

  Name of file stored on OpenAM server that contains agent audit messages if log location is remote or all.

  Property: `com.sun.identity.agents.config.remote.logfile`

  Hot swap: no

Remote Audit Log Interval

  Periodic interval in minutes in which audit log messages are sent to the remote log file.

  Property: `com.sun.identity.agents.config.remote.log.interval`

  Default: 5

  Hot swap: no

Rotate Local Audit Log

  When enabled, audit log files are rotated when reaching the specified size.

  Property: `com.sun.identity.agents.config.local.log.rotate`

Local Audit Log Rotation Size

  Beyond this size limit in bytes the agent rotates the local audit log file if rotation is enabled.

  Property: `com.sun.identity.agents.config.local.log.size`

  Default: 50 MB

Fully Qualified Domain Name Checking properties

FQDN Check

  Enables checking of FQDN default value and FQDN map values.

  Property: `com.sun.identity.agents.config.fqdn.check.enable`

FQDN Default

  Fully qualified domain name that the users should use in order to access resources. Without this value, the web server can fail to start, thus you set the property on agent installation, and only change it when absolutely necessary.

  This property ensures that when users access protected resources on the web server without specifying the FQDN, the agent can redirect the users to URLs containing the correct FQDN.

  Property: `com.sun.identity.agents.config.fqdn.default`

FQDN Virtual Host Map

  Enables virtual hosts, partial hostname and IP address to access protected resources. Maps invalid or virtual name keys to valid FQDN values so the agent can properly redirect users and the agents receive cookies belonging to the domain.

  To map `myserver` to `myserver.mydomain.example`, enter `myserver` in the Map Key field, and enter `myserver.mydomain.example` in the Corresponding Map Value field. This corresponds to `com.sun.identity.agents.config.fqdn.mapping[myserver]= myserver.mydomain.example`.

  Invalid FQDN values can cause the web server to become unusable or render resources inaccessible.

  Property: `com.sun.identity.agents.config.fqdn.mapping`