# OpenAM Administration Guide
6.5. Configuring Web Policy Agents

Sidebar | Prev | Up | Next

### 6.5.5. Configuring Web Policy Agent Miscellaneous Properties

This section covers miscellaneous web agent properties. After creating the agent profile, you access these properties in the OpenAM console under Access Control > `Realm Name` > Agents > Web > `Agent Name` > Miscellaneous.

Advice Handling properties

Composite Advice Handling (Not yet in OpenAM console)

  As of version 3.0.4, when set to `true`, the agent sends composite advice in the query (GET request) instead of sending it through a POST request.

  Property: `com.sun.am.use_redirect_for_advice`

Locale properties

Agent Locale

  The default locale for the agent.

  Property: `com.sun.identity.agents.config.locale`

  Hot swap: no

Anonymous user properties

Anonymous User

  Enable or disable REMOTE_USER processing for anonymous users.

  Property: `com.sun.identity.agents.config.anonymous.user.enable`

Cookie Processing properties

Encode special chars in Cookies

  When enabled, encode special chars in cookie by URL encoding. This is useful when profile, session, and response attributes contain special characters, and the attributes fetch mode is set to `HTTP_COOKIE`.

  Property: `com.sun.identity.agents.config.encode.cookie.special.chars.enable`

Profile Attributes Cookie Prefix

  Sets cookie prefix in the attributes headers. Default: `HTTP_`.

  Property: `com.sun.identity.agents.config.profile.attribute.cookie.prefix`

Profile Attributes Cookie Maxage

  Maximum age in seconds of custom cookie headers. Default: 300.

  Property: `com.sun.identity.agents.config.profile.attribute.cookie.maxage`

URL Handling properties

URL Comparison Case Sensitivity Check

  When enabled, enforces case insensitivity in both policy and not enforced URL evaluation.

  Property: `com.sun.identity.agents.config.url.comparison.case.ignore`

Encode URL's Special Characters

  When enabled, encodes the URL which has special characters before doing policy evaluation.

  Property: `com.sun.identity.agents.config.encode.url.special.chars.enable`

Ignore Naming URL properties

Ignore Preferred Naming URL in Naming Request

  When enabled, do not send a preferred naming URL in the naming request.

  Property: `com.sun.identity.agents.config.ignore.preferred.naming.url`

Invalid URL properties (Not yet in OpenAM console)

Invalid URL Regular Expression

  Use a Perl-compatible regular expression to filter out invalid request URLs. The policy agent reject requests to invalid URLs with HTTP 403 Forbidden status without further processing. Use Advanced > Custom Properties to set this in the agent profile.

  For example, to filter out URLs containing the symbols in the list ./, /., /, ., ,\, %00-%1f, %7f-%ff, %25, %2B, %2C, %7E, .info, use the following setting.

      com.forgerock.agents.agent.invalid.url.regex= \
       ^((?!(|/\.|\./||*|\.info|%25|%2B|%2C|%[0-1][0-9a-fA-F]|%[7-9a-fA-F][0-9a-fA-F])).)$

Ignore Server Check properties

Ignore Server Check

  When enabled, do not check whether OpenAM is up before doing a 302 redirect.

  Property: `com.sun.identity.agents.config.ignore.server.check`

Ignore Path Info properties

Ignore Path Info in Request URL

  When enabled, strip path info from the request URL while doing the Not Enforced List check, and URL policy evaluation. This is designed to prevent a user from accessing a URI by appending the matching pattern in the policy or not enforced list.

  | Note
  This setting is not supported by the Varnish Cache agent.

  For example, if the not enforced list includes `http://host/*.gif`, then stripping path info from the request URI prevents access to `http://host/index.html` by using `http://host/index.html?hack.gif`.

  However, when a web server is configured as a reverse proxy for a J2EE application server, the path info is interpreted to map a resource on the proxy server rather than the application server. This prevents the not enforced list or the policy from being applied to the part of the URI below the application server path if a wildcard character is used.

  For example, if the not enforced list includes `http://host/webapp/servcontext/*` and the request URL is `http://host/webapp/servcontext/example.jsp`, the path info is `/servcontext/example.jsp` and the resulting request URL with path info stripped is `http://host/webapp/`, which does not match the not enforced list. Thus when this property is enabled, path info is not stripped from teh request URL even if there is a wildcard in the not enforced list or policy.

  Make sure therefore when this property is enabled that there is nothing following the wildcard in the not enforced list or policy.

  Property: `com.sun.identity.agents.config.ignore.path.info`

Multi-byte Enable properties

Native Encoding of Profile Attributes

  When enabled, the agent encodes the LDAP header values in the default encoding of operating system locale. When disabled, the agent uses UTF-8.

  Property: `com.sun.identity.agents.config.convert.mbyte.enable`

Goto Parameter Name properties

Goto Parameter Name

  Property used only when CDSSO is enabled. Only change the default value, `goto` when the login URL has a landing page specified such as, `com.sun.identity.agents.config.cdsso.cdcservlet.url = http://openam.example.com:8080/openam/cdcservlet?goto= http://www.example.com/landing.jsp`. The agent uses this parameter to append the original request URL to this cdcservlet URL. The landing page consumes this parameter to redirect to the original URL.

  As an example, if you set this value to `goto2`, then the complete URL sent for authentication is `http://openam.example.com:8080/openam/cdcservlet?goto= http://www.example.com/landing.jsp?goto2=http://www.example.com/original.jsp`.

  Property: `com.sun.identity.agents.config.redirect.param`

Deprecated Agent properties

Anonymous User Default Value

  User ID of unauthenticated users. Default: `anonymous`.

  Property: `com.sun.identity.agents.config.anonymous.user.id`