# OpenAM Administration Guide
6.5. Configuring Web Policy Agents

Sidebar | Prev | Up | Next

### 6.5.4. Configuring Web Policy Agent OpenAM Services Properties

This section covers OpenAM services web agent properties. After creating the agent profile, you access these properties in the OpenAM console under Access Control > `Realm Name` > Agents > Web > `Agent Name` > OpenAM Services.

Login URL properties

OpenAM Login URL

  OpenAM login page URL, such as `http://openam.example.com:8080/openam/UI/Login`, to which the agent redirects incoming users without sufficient credentials so then can authenticate.

  Property: `com.sun.identity.agents.config.login.url`

OpenAM Conditional Login URL (Not yet in OpenAM console)

  To conditionally redirect users based on the incoming request URL, set this property.

  This takes the incoming request domain to match, a vertical bar ( `|` ), and then a comma-separated list of URLs to which to redirect incoming users.

  If the domain before the vertical bar matches an incoming request URL, then the policy agent uses the list of URLs to determine how to redirect the user-agent. If the global property FQDN Check (`com.sun.identity.agents.config.fqdn.check.enable`) is enabled for the policy agent, then the policy agent iterates through the list until it finds an appropriate redirect URL that matches the FQDN check. Otherwise, the policy agent redirects the user-agent to the first URL in the list.

  Property: `com.forgerock.agents.conditional.login.url`

  Examples: `com.forgerock.agents.conditional.login.url[0]= login.example.com|http://openam1.example.com/openam/UI/Login, http://openam2.example.com/openam/UI/Login`, `com.forgerock.agents.conditional.login.url[1]= signin.example.com|http://openam3.example.com/openam/UI/Login, http://openam4.example.com/openam/UI/Login`

  If CDSSO is enabled for the policy agent, then this property takes CDSSO Servlet URLs for its values (`com.sun.identity.agents.config.cdsso.cdcservlet.url`), rather than OpenAM login URLs.

  CDSSO examples: `com.forgerock.agents.conditional.login.url[0]= login.example.com|http://openam1.example.com/openam/cdcservlet, http://openam2.example.com/openam/cdcservlet`, `com.forgerock.agents.conditional.login.url[1]= signin.example.com|http://openam3.example.com/openam/cdcservlet, http://openam4.example.com/openam/cdcservlet`

Agent Connection Timeout

  Timeout period in seconds for an agent connection with OpenAM auth server.

  Property: `com.sun.identity.agents.config.auth.connection.timeout`

  Default: 2

Polling Period for Primary Server

  Interval in minutes, agent polls to check the primary server is up and running. Default: 5.

  Property: `com.sun.identity.agents.config.poll.primary.server`

  Hot swap: no

Logout URL properties

OpenAM Logout URL

  OpenAM logout page URL, such as `http://openam.example.com:8080/openam/UI/Logout`.

  Property: `com.sun.identity.agents.config.logout.url`

Enable Logout URL Redirect (Not yet in OpenAM console)

  Logout URL redirect is enabled by default.

  When this is disabled, instead of redirecting the user-agent, the policy agent performs session logout in the background and then continues processing access to the current URL. Disable this using Advanced > Custom Properties in the agent profile.

      com.forgerock.agents.config.logout.redirect.disable=true

Agent Logout URL properties

Logout URL List

  List of application logout URLs, such as `http://www.example.com/logout.html`. The user is logged out of the OpenAM session when these URLs are accessed. When using this property, specify a value for the Logout Redirect URL property.

  Property: `com.sun.identity.agents.config.agent.logout.url`

Agent Logout URL Regular Expression (Not yet in OpenAM console)

  Perl-compatible regular expression that matches logout URLs. Set this using Advanced > Custom Properties in the agent profile.

  For example, to match URLs with `protectedA` or `protectedB` in the path and `op=logout` in the query string, use the following setting.

      com.forgerock.agents.agent.logout.url.regex= \
         .*(/protectedA\?|/protectedB\?/).*(\&op=logout\&)(.*|$)

  When you use this property, the agent ignores the settings for Logout URL List.

Logout Cookies List for Reset

  Cookies to be reset upon logout in the same format as the cookie reset list.

  Property: `com.sun.identity.agents.config.logout.cookie.reset`

Logout Redirect URL

  User gets redirected to this URL after logout. Specify this property alongside a Logout URL List.

  Property: `com.sun.identity.agents.config.logout.redirect.url`

Policy Client Service properties

Policy Cache Polling Period

  Polling interval in minutes during which an entry remains valid after being added to the agent's cache.

  Property: `com.sun.identity.agents.config.policy.cache.polling.interval`

  Hot swap: no

SSO Cache Polling Period

  Polling interval in minutes during which an SSO entry remains valid after being added to the agent's cache.

  Property: `com.sun.identity.agents.config.sso.cache.polling.interval`

  Hot swap: no

User ID Parameter

  Agent sets this value for User Id passed in the session from OpenAM to the REMOTE_USER server variable. Default: UserToken.

  Property: `com.sun.identity.agents.config.userid.param`

User ID Parameter Type

  User ID can be fetched from either SESSION and LDAP attributes. Default: `SESSION`.

  Property: `com.sun.identity.agents.config.userid.param.type`

Fetch Policies from Root Resource

  When enabled, the agent caches the policy decision of the resource and all resources from the root of the resource down. For example, if the resource is `http://host/a/b/c`, then the root of the resource is `http://host/`. This setting can be useful when a client is expect to access multiple resources on the same path. Yet, caching can be expensive if very many policies are defined for the root resource.

  Property: `com.sun.identity.agents.config.fetch.from.root.resource`

  Default: false

  Hot swap: no

Retrieve Client Hostname

  When enabled, get the client hostname through DNS reverse lookup for use in policy evaluation. This setting can impact performance.

  Property: `com.sun.identity.agents.config.get.client.host.name`

Policy Clock Skew

  Time in seconds used adjust time difference between agent system and OpenAM. Clock skew in seconds = AgentTime - OpenAMServerTime.

  Use this property to adjust for small time differences encountered despite use of a time synchronization service. When this property is not set and agent time is greater than OpenAM server time, the agent can make policy calls to the OpenAM server before the policy subject cache has expired, or you can see infinite redirection occur.

  Property: `com.sun.identity.agents.config.policy.clock.skew`

  Hot swap: no