# OpenAM Administration Guide
6.6. Configuring J2EE Policy Agents

Sidebar | Prev | Up | Next

### 6.6.2. Configuring J2EE Policy Agent Application Properties

This section covers application web agent properties. After creating the agent profile, you access these properties in the OpenAM console under Access Control > `Realm Name` > Agents > J2EE > `Agent Name` > Application.

Login Processing properties

Login Form URI

  Specifies the list of absolute URIs corresponding to a protected application's `web.xml` `form-login-page` element, such as `/myApp/jsp/login.jsp`.

  Property: `com.sun.identity.agents.config.login.form`

Login Error URI

  Specifies the list of absolute URIs corresponding to a protected application's `web.xml` `form-error-page` element, such as `/myApp/jsp/error.jsp`.

  Property: `com.sun.identity.agents.config.login.error.uri`

Use Internal Login

  When enabled, the agent uses the internal default content file for the login.

  Property: `com.sun.identity.agents.config.login.use.internal`

Login Content File Name

  Full path name to the file containing custom login content when Use Internal Login is enabled.

  Property: `com.sun.identity.agents.config.login.content.file`

Logout Processing properties

Application Logout Handler

  Specifies how logout handlers map to specific applications. The key is the web application name. The value is the logout handler class.

  To set a global logout handler for applications without other logout handlers defined, leave the key empty and set the value to the global logout handler class name, `GlobalApplicationLogoutHandler`.

  To set a logout handler for a specific application, set the key to the name of the application, and the value to the logout handler class name.

  Property: `com.sun.identity.agents.config.logout.application.handler`

Application Logout URI

  Specifies request URIs that indicate logout events. The key is the web application name. The value is the application logout URI.

  To set a global logout URI for applications without other logout URIs defined, leave the key empty and set the value to the global logout URI, `/logout.jsp`.

  To set a logout URI for a specific application, set the key to the name of the application, and the value to the application logout page.

  Property: `com.sun.identity.agents.config.logout.uri`

Logout Request Parameter

  Specifies parameters in the HTTP request that indicate logout events. The key is the web application name. The value is the logout request parameter.

  To set a global logout request parameter for applications without other logout request parameters defined, leave the key empty and set the value to the global logout request parameter, `logoutparam`.

  To set a logout request parameter for a specific application, set the key to the name of the application, and the value to the application logout request parameter, such as `logoutparam`.

  Property: `com.sun.identity.agents.config.logout.request.param`

Logout Introspect Enabled

  When enabled, the agent checks the HTTP request body to locate the Logout Request Parameter you set.

  Property: `com.sun.identity.agents.config.logout.introspect.enabled`

Logout Entry URI

  Specifies the URIs to return after successful logout and subsequent authentication. The key is the web application name. The value is the URI to return.

  To set a global logout entry URI for applications without other logout entry URIs defined, leave the key empty and set the value to the global logout entry URI, `/welcome.html`.

  To set a logout entry URI for a specific application, set the key to the name of the application, and the value to the application logout entry URI, such as `/myApp/welcome.html`.

  Property: `com.sun.identity.agents.config.logout.entry.uri`

Access Denied URI Processing properties

Resource Access Denied URI

  Specifies the URIs of custom pages to return when access is denied. The key is the web application name. The value is the custom URI.

  To set a global custom access denied URI for applications without other custom access denied URIs defined, leave the key empty and set the value to the global custom access denied URI, `/sample/accessdenied.html`.

  To set a custom access denied URI for a specific application, set the key to the name of the application, and the value to the application access denied URI, such as `/myApp/accessdenied.html`.

  Property: `com.sun.identity.agents.config.access.denied.uri`

Not Enforced URI Processing properties

Not Enforced URIs

  List of URIs for which no authentication is required, and the agent does not protect access. You can use wildcards to define a pattern for a URI.

  The `*` wildcard matches all characters except question mark (`?`), cannot be escaped, and spans multiple levels in a URI. Multiple forward slashes do not match a single forward slash, so `*` matches `mult/iple/dirs`, yet `mult/*/dirs` does not match `mult/dirs`.

  The `-*-` wildcard matches all characters except forward slash (`/`) or question mark (`?`), and cannot be escaped. As it does not match `/`, `-*-` does not span multiple levels in a URI.

  OpenAM does not let you mix `*` and `-*-` in the same URI.

  Examples include `/logout.html`, `/images/*`, `/css/-*-`, and `/*.jsp?locale=*`.

  Trailing forward slashes are not recognized as part of a resource name. Therefore `/images//` and `/images` are equivalent.

  Property: `com.sun.identity.agents.config.notenforced.uri`

Invert Not Enforced URIs

  Only enforce not enforced list of URIs. In other words, enforce policy only for those URIs and patterns specified in the list.

  Property: `com.sun.identity.agents.config.notenforced.uri.invert`

Not Enforced URIs Cache Enabled

  When enabled, the agent caches evaluation of the not enforced URI list.

  Property: `com.sun.identity.agents.config.notenforced.uri.cache.enable`

Not Enforced URIs Cache Size

  When caching is enabled, this limits the number of not enforced URIs cached.

  Property: `com.sun.identity.agents.config.notenforced.uri.cache.size`

  Default: 1000

Refresh Session Idle Time

  When enabled, the agent reset the session idle time when granting access to a not enforced URI, prolonging the time before the user must authenticate again.

  Property: `com.sun.identity.agents.config.notenforced.refresh.session.idletime`

Not Enforced IP Processing properties

Not Enforced Client IP List

  No authentication and authorization are required for the requests coming from these client IP addresses.

  Property: `com.sun.identity.agents.config.notenforced.ip`

Not Enforced IP Invert List

  Only enforce the not enforced list of IP addresses. In other words, enforce policy only for those client addresses and patterns specified in the list.

  Property: `com.sun.identity.agents.config.notenforced.ip.invert`

Not Enforced IP Cache Flag

  When enabled, the agent caches evaluation of the not enforced IP list.

  Property: `com.sun.identity.agents.config.notenforced.ip.cache.enable`

Not Enforced IP Cache Size

  When caching is enabled, this limits the number of not enforced addresses cached.

  Property: `com.sun.identity.agents.config.notenforced.ip.cache.size`

  Default: 1000

Profile Attributes Processing properties

Profile Attribute Fetch Mode

  When set to `HTTP_COOKIE` or `HTTP_HEADER`, profile attributes are introduced into the cookie or the headers, respectively. When set to `REQUEST_ATTRIBUTE`, profile attributes are part of the HTTP request.

  Property: `com.sun.identity.agents.config.profile.attribute.fetch.mode`

Profile Attribute Map

  Maps the profile attributes to HTTP headers for the currently authenticated user. Map Keys are LDAP attribute names, and Map Values are HTTP header names.

  To populate the value of profile attribute CN under `CUSTOM-Common-Name`: enter CN in the Map Key field, and enter `CUSTOM-Common-Name` in the Corresponding Map Value field. This corresponds to `com.sun.identity.agents.config.profile.attribute.mapping[cn]=CUSTOM-Common-Name`.

  In most cases, in a destination application where an HTTP header name shows up as a request header, it is prefixed by `HTTP_`, lower case letters become upper case, and hyphens (`-`) become underscores (`_`). For example, `common-name` becomes `HTTP_COMMON_NAME`.

  Property: `com.sun.identity.agents.config.profile.attribute.mapping`

Response Attributes Processing properties

Response Attribute Fetch Mode

  When set to `HTTP_COOKIE` or `HTTP_HEADER`, response attributes are introduced into the cookie or the headers, respectively. When set to `REQUEST_ATTRIBUTE`, response attributes are part of the HTTP response.

  Property: `com.sun.identity.agents.config.response.attribute.fetch.mode`

Response Attribute Map

  Maps the policy response attributes to HTTP headers for the currently authenticated user. The response attribute is the attribute in the policy response to be fetched.

  To populate the value of response attribute `uid` under `CUSTOM-User-Name`: enter `uid` in the Map Key field, and enter `CUSTOM-User-Name` in the Corresponding Map Value field. This corresponds to `com.sun.identity.agents.config.response.attribute.mapping[uid]=Custom-User-Name`.

  In most cases, in a destination application where an HTTP header name shows up as a request header, it is prefixed by `HTTP_`, lower case letters become upper case, and hyphens (`-`) become underscores (`_`). For example, `response-attr-one` becomes `HTTP_RESPONSE_ATTR_ONE`.

  Property: `com.sun.identity.agents.config.response.attribute.mapping`

Common Attributes Fetching Processing properties

Cookie Separator Character

  Specifies the separator for multiple values of the same attribute when it is set as a cookie. Default: `|` (also known as the vertical bar character).

  Property: `com.sun.identity.agents.config.attribute.cookie.separator`

Fetch Attribute Date Format

  Specifies the `java.text.SimpleDateFormat` of date attribute values used when an attribute is set in an HTTP header. Default: `EEE, d MMM yyyy hh:mm:ss z`.

  Property: `com.sun.identity.agents.config.attribute.date.format`

Attribute Cookie Encode

  When enabled, attribute values are URL encoded before being set as a cookie.

  Property: `com.sun.identity.agents.config.attribute.cookie.encode`

Session Attributes Processing properties

Session Attribute Fetch Mode

  When set to `HTTP_COOKIE` or `HTTP_HEADER`, session attributes are introduced into the cookie or the headers, respectively. When set to `REQUEST_ATTRIBUTE`, session attributes are part of the HTTP response.

  Property: `com.sun.identity.agents.config.session.attribute.fetch.mode`

Session Attribute Map

  Maps session attributes to HTTP headers for the currently authenticated user. The session attribute is the attribute in the session to be fetched.

  To populate the value of session attribute `UserToken` under `CUSTOM-userid`: enter `UserToken` in the Map Key field, and enter `CUSTOM-userid` in the Corresponding Map Value field. This corresponds to `com.sun.identity.agents.config.session.attribute.mapping[UserToken]=CUSTOM-userid`.

  In most cases, in a destination application where an HTTP header name shows up as a request header, it is prefixed by `HTTP_`, lower case letters become upper case, and hyphens (`-`) become underscores (`_`). For example, `success-url` becomes `HTTP_SUCCESS_URL`.

  Property: `com.sun.identity.agents.config.session.attribute.mapping`

Privilege Attributes Processing properties

Default Privileged Attribute

  Specifies the list of privileged attributes granted to all users with a valid OpenAM session, such as `AUTHENTICATED_USERS`.

  Property: `com.sun.identity.agents.config.default.privileged.attribute`

Privileged Attribute Type

  Specifies the list of privileged attribute types fetched for each user.

  Property: `com.sun.identity.agents.config.privileged.attribute.type`

Privileged Attributes To Lower Case

  Specifies how privileged attribute types should be converted to lower case.

  Property: `com.sun.identity.agents.config.privileged.attribute.tolowercase`

Privileged Session Attribute

  Specifies the list of session property names, such as `UserToken` which hold privileged attributes for authenticated users.

  Property: `com.sun.identity.agents.config.privileged.session.attribute`

Enable Privileged Attribute Mapping

  When enabled, lets you use Privileged Attribute Mapping.

  Property: `com.sun.identity.agents.config.privileged.attribute.mapping.enable`

Privileged Attribute Mapping

  OpenAM allows original attribute values to be mapped to other values. For example, you can map UUIDs to principal names in roles specified in a web application's deployment descriptor. For example, to map the UUID `id=employee,ou=group,o=openam` to the principal name `am_employee_role` in the deployment descriptor, set the key to `id=employee,ou=group,o=openam`, and the value to `am_employee_role`.

  Property: `com.sun.identity.agents.config.privileged.attribute.mapping`

Custom Authentication Processing properties

Custom Authentication Handler

  Specifies custom authentication handler classes for users authenticated with the application server. The key is the web application name and the value is the authentication handler class name.

  Property: `com.sun.identity.agents.config.auth.handler`

Custom Logout Handler

  Specifies custom logout handler classes to log users out of the application server. The key is the web application name and the value is the logout handler class name.

  Property: `com.sun.identity.agents.config.logout.handler`

Custom Verification Handler

  Specifies custom verification classes to validate user credentials with the local user repository. The key is the web application name and the value is the validation handler class name.

  Property: `com.sun.identity.agents.config.verification.handler`