3.4. Managing Policies Outside the Console

When you first create policies, the OpenAM console helps you to get started quickly. Yet, when you have many policies to manage you might find it easier to script operations, starting from policies originally created in the console, then exported to XML.

Procedure 3.3. To Export Policies From the Console

You can export policies created in the console to an XML Policies document.

  • Use the ssoadm list-policies command. 

    $ ssoadm
 list-policies
 --realm "/"
 --adminid amadmin
 --password-file /tmp/pwd.txt 

Policy definitions were returned under realm, /.
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE Policies 
PUBLIC "-//OpenSSO Policy Administration DTD//EN"
"jar://com/sun/identity/policy/policyAdmin.dtd">

<!-- extracted from realm, / -->
<Policies>
<Policy name="URL Policy" createdby="id=amadmin,ou=user,o=openam"
 lastmodifiedby="id=amadmin,ou=user,o=openam" creationdate="1312553988059"
 lastmodifieddate="1315403023466" referralPolicy="false" active="true" >
<Rule name="Allow GET with parameters">
<ServiceName name="iPlanetAMWebAgentService" />
<ResourceName name="http://www.example.com/ching/*?*" />
<AttributeValuePair>
<Attribute name="GET" />
<Value>allow</Value>
</AttributeValuePair>
</Rule>
<Rule name="Allow GET and POST">
<ServiceName name="iPlanetAMWebAgentService" />
<ResourceName name="http://www.example.com/ching/*" />
<AttributeValuePair>
<Attribute name="POST" />
<Value>allow</Value>
</AttributeValuePair>
<AttributeValuePair>
<Attribute name="GET" />
<Value>allow</Value>
</AttributeValuePair>
</Rule>
<Subjects name="Subjects:1312553593870WmIuFvI=" description="">
<Subject name="All Authenticated Users" type="AuthenticatedUsers"
 includeType="inclusive">
</Subject>
</Subjects>
</Policy>
</Policies>

Procedure 3.4. To Import Policies Using the Command Line

In a production environment where you manage operations using scripts rather than the console, use exported, file-based policies edited for your needs, and then import the policies using ssoadm.

  1. Create your XML policy file.

    $ cat policy.xml
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE Policies 
PUBLIC "-//OpenSSO Policy Administration DTD//EN"
"jar://com/sun/identity/policy/policyAdmin.dtd">
<!-- New policy, same as the old policy -->
<Policies>
<Policy name="New Policy" referralPolicy="false" active="true" >
<Rule name="Allow GET with parameters">
<ServiceName name="iPlanetAMWebAgentService" />
<ResourceName name="http://www.example.com/ching/*?*" />
<AttributeValuePair>
<Attribute name="GET" />
<Value>allow</Value>
</AttributeValuePair>
</Rule>
<Rule name="Allow GET and POST">
<ServiceName name="iPlanetAMWebAgentService" />
<ResourceName name="http://www.example.com/ching/*" />
<AttributeValuePair>
<Attribute name="POST" />
<Value>allow</Value>
</AttributeValuePair>
<AttributeValuePair>
<Attribute name="GET" />
<Value>allow</Value>
</AttributeValuePair>
</Rule>
<Subjects name="Subjects" description="Everybody authenticated">
<Subject name="All Authenticated Users" type="AuthenticatedUsers"
 includeType="inclusive">
</Subject>
</Subjects>
</Policy>
</Policies>

  2. Use the ssoadm create-policies command. 

    $ ssoadm
 create-policies
 --realm "/"
 --adminid amadmin
 --password-file /tmp/pwd.txt
 --xmlfile policy.xml

Policies were created under realm, /.