# OpenAM Administration Guide
6.6. Configuring J2EE Policy Agents

Sidebar | Prev | Up | Next

### 6.6.1. Configuring J2EE Policy Agent Global Properties

This section covers global web agent properties. After creating the agent profile, you access these properties in the OpenAM console under Access Control > `Realm Name` > Agents > J2EE > `Agent Name` > Global.

Profile properties

Group

  For assigning the agent to a previously configured web agent group in order to inherit selected properties from the group.

Password

  Agent password used when creating the password file and when installing the agent.

Status

  Status of the agent configuration.

Agent Notification URL

  URL used by agent to register notification listeners.

  Property: `com.sun.identity.client.notification.url`

  Hot swap: no

Location of Agent Configuration Repository

  Indicates agent's configuration located either on agent's host or centrally on OpenAM server.

  If you change this to a local configuration, you can no longer manage the policy agent configuration through OpenAM console.

  Property: `com.sun.identity.agents.config.repository.location`

Configuration Reload Interval

  Interval in seconds to fetch agent configuration from OpenAM. Used if notifications are disabled. Default: 0

  Property: `com.sun.identity.agents.config.load.interval`

Agent Configuration Change Notification

  Enable agent to receive notification messages from OpenAM server for configuration changes.

  Property: `com.sun.identity.agents.config.change.notification.enable`

Agent Root URL for CDSSO

  The agent root URL for CDSSO. The valid value is in the format ``protocol`://`hostname`:`port`/` where `protocol` represents the protocol used, such as `http` or `https`, `hostname` represents the host name of the system where the agent resides, and `port` represents the port number on which the agent is installed. The slash following the port number is required.

  If your agent system also has virtual host names, add URLs with the virtual host names to this list as well. OpenAM checks that `goto` URLs match one of the agent root URLs for CDSSO.

General properties

Agent Filter Mode

  Specifies how the agent filters requests to protected web applications. The global value functions as a default, and applies for protected applications that do not have their own filter settings. Valid settings include the following.

  `ALL`

    Enforce both the J2EE policy defined for the web container where the protected application runs, and also OpenAM policies.

    When setting the filter mode to `ALL`, set the Map Key, but do not set any Corresponding Map Value.

  `J2EE_POLICY`

    Enforce only the J2EE policy defined for the web container where the protected application runs.

  `NONE`

    Do not enforce policies to protect resources. In other words, turn off access management. Not for use in production.

  `SSO_ONLY`

    Enforce only authentication, not policies.

  `URL_POLICY`

    Enforce only OpenAM, URL resource based policies.

    When setting the filter mode to `URL_POLICY`, set the Map Key to the application name and the Corresponding Map Value to `URL_POLICY`.

  Property: `com.sun.identity.agents.config.filter.mode`

  Hot swap: no

HTTP Session Binding

  When enabled the agent invalidates the HTTP session upon login failure, when the user has no SSO session, or when the principal user name does not match the SSO user name.

  Property: `com.sun.identity.agents.config.httpsession.binding`

Login Attempt Limit

  When set to a value other than zero, this defines the maximum number of failed login attempts allowed during a single browser session, after which the agent blocks requests from the user.

  Property: `com.sun.identity.agents.config.login.attempt.limit`

Custom Response Header

  Specifies the custom headers the agent sets for the client. The key is the header name. The value is the header value.

  Property: `com.sun.identity.agents.config.response.header`

  For example, `com.sun.identity.agents.config.response.header[Cache-Control]=no-cache`.

Redirect Attempt Limit

  When set to a value other than zero, this defines the maximum number of redirects allowed for a single browser session, after which the agent blocks the request.

  Property: `com.sun.identity.agents.config.redirect.attempt.limit`

Agent Debug Level

  Default is `Error`. Increase to `Message` for fine-grained detail.

  Property: `com.iplanet.services.debug.level`

User Mapping properties

User Mapping Mode

  Specifies the mechanism used to determine the user ID.

  Property: `com.sun.identity.agents.config.user.mapping.mode`

User Attribute Name

  Specifies the data store attribute that contains the user ID.

  Property: `com.sun.identity.agents.config.user.attribute.name`

User Principal Flag

  When enabled, OpenAM uses both the principal user name and also the user ID for authentication.

  Property: `com.sun.identity.agents.config.user.principal`

User Token Name

  Specifies the session property name for the authenticated user's ID. Default: `UserToken`.

  Property: `com.sun.identity.agents.config.user.token`

Audit properties

Audit Access Types

  Types of messages to log based on user URL access attempts.

  Property: `com.sun.identity.agents.config.audit.accesstype`

  Valid values for the configuration file property include `LOG_NONE`, `LOG_ALLOW`, `LOG_DENY`, and `LOG_BOTH`.

Audit Log Location

  Specifies where audit messages are logged. By default, audit messages are logged remotely.

  Property: `com.sun.identity.agents.config.log.disposition`

  Valid values for the configuration file property include `REMOTE`, `LOCAL`, and `ALL`.

Remote Log Filename

  Name of file stored on OpenAM server that contains agent audit messages if log location is remote or all.

  Property: `com.sun.identity.agents.config.remote.logfile`

  Hot swap: no

Rotate Local Audit Log

  When enabled, audit log files are rotated when reaching the specified size.

  Property: `com.sun.identity.agents.config.local.log.rotate`

Local Audit Log Rotation Size

  Beyond this size limit in bytes the agent rotates the local audit log file if rotation is enabled.

  Property: `com.sun.identity.agents.config.local.log.size`

  Default: 50 MB

Fully Qualified Domain Name Checking properties

FQDN Check

  Enables checking of FQDN default value and FQDN map values.

  Property: `com.sun.identity.agents.config.fqdn.check.enable`

FQDN Default

  Fully qualified domain name that the users should use in order to access resources.

  This property ensures that when users access protected resources on the web server without specifying the FQDN, the agent can redirect the users to URLs containing the correct FQDN.

  Property: `com.sun.identity.agents.config.fqdn.default`

FQDN Virtual Host Map

  Enables virtual hosts, partial hostname and IP address to access protected resources. Maps invalid or virtual name keys to valid FQDN values so the agent can properly redirect users and the agents receive cookies belonging to the domain.

  To map `myserver` to `myserver.mydomain.example`, enter `myserver` in the Map Key field, and enter `myserver.mydomain.example` in the Corresponding Map Value field. This corresponds to `com.sun.identity.agents.config.fqdn.mapping[myserver]= myserver.mydomain.example`.

  Property: `com.sun.identity.agents.config.fqdn.mapping`