Skip to Content
Sun and Oracle
Channel Sun
How to Buy
Log In
Español
Página de inicio de docs.sun.com
>
Sun Java System Access Manager 7 2005Q4
> Deployment Example 2: Federation Using SAML v2
Deployment Example 2: Federation Using SAML v2
Buscar sólo este libro
Buscar Ayuda
Contained Within
Sun Java System Access Manager 7 2005Q4
Java Enterprise System 2005Q4 Deployment Examples and Technical Notes Collection
Find More Documentation
Examinar títulos de documentación
Examinar documentación de productos
Featured Support Resources
Cursos de formación de Sun
Portal de administración de sistemas BigAdmin
Centro de asistencia técnica de Sun
Sun Solve
Descargar este libro en PDF (1745 KB)
Deployment Example 2: Federation Using SAML v2
Book Information
About This Deployment Example
1. Key Features, System Architecture, and Process Flow
1.1 Key Features
1.2 System Architecture
1.3 Illustrated Protocol Flows
1.4 Firewall Rules
2. Before You Begin
2.1 Using This Manual
2.2 Downloading and Mounting the Java Enterprise System 2005Q4 Installer
To Download and Mount the Java Enterprise System 2005Q4 Installer
2.3 Obtaining the Federation Manager Program
2.4 Obtaining the SAMLv2 Plug-In
2.5 Obtaining the SAMLv2 Patch 2
2.6 Obtaining the Application Server Enterprise Ed 8.1 2005Q1 Patch
2.7 Obtaining Policy Agents Software
2.8 Resolving Host Names
2.9 Setting Up Load Balancer Hardware and Software
2.10 Obtaining Certificates for SSL and for XML Signing and Encryption
2.11 Obtaining and Using the Certificate Database Tool
2.12 Obtaining Instructions for Deploying the Identity Provider Site
2.13 Finding Help for SAMLv2 CLI Commands
Setting Up the Service Provider Site
3. Installing and Deploying the Federation Manager Servers
3.1 Installing and Configuring Federation Manager 1
To Install the Web Server for Federation Manager 1
To Install Federation Manager Server 1
To Deploy the Federation Manager 1 WAR File
To Install the SAMLv2 Plug-In on Federation Manager 1
To Install SAMLv2 Patch 2 on Federation Manager 1
3.2 Installing and Configuring Federation Manager 2
To Install the Web Server for Federation Manager 2
To Install Federation Manager Server 2
To Deploy the Federation Manager 2 WAR File
To Install the SAMLv2 Plug-In on Federation Manager 2
To Install the SAMLv2 Patch 2 on Federation Manager 2
3.3 Configuring the Federation Manager Load Balancer
To Configure Load Balancer 9 for the Federation Manager Servers
To Configure Federation Manager 1 to Work with the Federation Manager Load Balancer
To Configure Federation Manager 2 to Work with the Federation Manager Load Balancer
To Verify that the Federation Manager Load Balancers are Working Properly
3.4 Configuring SSL Termination at the Federation Manager Load Balancer
To Request an SSL Certificate
To Install the SSL Certificate
To Configure the Web Server 1 for SSL Termination
To Configure the Web Server 2 for SSL Termination
To Verify that SSL on the Federation Manager Load Balancer is Working Properly
4. Installing and Configuring the Directory Servers
4.1 Installing Two Directory Servers
To Install Directory Server 3SP
To Install Directory Server 4SP
4.2 Creating New Directory Server Instances
To Create a New Configuration Instance in Directory Server 3SP
To Create a New User Data Instance in Directory Server 3SP
To Create a New Configuration Instance in Directory Server 4SP
To Create a New User Data Instance in Directory Server 4SP
4.3 Enabling Multi-Master Replication of the Configuration Instances
To Enable Multi-Master Replication of the Configuration Instance on Directory Server 3SP
To Enable Multi-Master Replication of the Configuration Instance on Directory Server 4SP
To Create a Replication Agreement for the Configuration Instance on Directory Server 3SP
To Create a Replication Agreement for the Configuration Instance on Directory Server 4SP
To Initialize the Configuration Instance Master Replica
4.4 Enabling Multi-Master Replication of the User Data Instances
To Enable Multi-Master Replication for the User Data Instance on Directory Server 3SP
To Enable Multi-Master Replication for the User Data Instance on Directory Server 4SP
To Create a Replication Agreement for the User Data Instance on Directory Server 3SP
To Create a Replication Agreement for the User Data Instance on Directory Server 4SP
To Initialize the User Data Instance Master Replica
4.5 Configuring the Directory Server Load Balancers
4.5.1 Simple Persistence
To Configure Load Balancer 7 for the Directory Server Configuration Instances
To Configure Load Balancer 8 for the Directory Server User Data Instances
5. Configuring Federation Manager Servers to Work with Directory Servers
5.1 Migrating Federation Manager 1 Configuration from Flat Files to Directory Servers
To Migrate Federation Manager 1 Services Schema into the Directory Servers
To Update the Federation Manager 1 serverconfig.xml File
To Update the Federation Manager 1 AMConfig.properties File
To Regenerate and Redeploy the Federation Manager 1 WAR File
To Update the Platform Server List
5.2 Migrating Federation Manager 1 User Data from Flat Files to Directory Servers
To Load SAMLv2 Users Schema into the Directory Servers
To Update the Federation Manager 1 AMConfig.properties File
To Update the Federation Manager 1 serverconfig.xml File
5.3 Migrating Federation Manager 2 Configuration from Flat Files to Directory Servers
To Update the Federation Manager 2 serverconfig.xml File
To Update the Federation Manager 2 AMConfig.properties File
To Regenerate and Redeploy the Federation Manager 2 WAR File
5.4 Migrating Federation Manager 2 User Data from Flat Files to Directory Servers
To Update the Federation Manager 2 AMConfig.properties File
To Update the Federation Manager 2 serverconfig.xml File
5.5 Configuring the Federation Manager Authentication Service to Work with the Directory Servers
To Migrate the Federation Manager User Data to the Directory Server User Data Store
To Verify that LDAP Authentication Works Properly
6. Setting Up the Service Provider Keystores
6.1 Configuring the Keystore for Federation Manager 1
To Obtain an XML Signing Certificate from a Trusted Certificate Authority
To Obtain an Encryption Certificate from a Trusted Certificate Authority
6.2 Configuring Federation Manager 1 to Recognize the New Keystores and Key Files
To Create the Federation Manager 1 Keystore Passwords
To Modify the AMConfig.properties File
6.3 Configuring the Keystore for Federation Manager 2
To Install the Federation Manager 1 XML Signing Certificate on Federation Manager 2
6.4 Configuring Federation Manager 2 to Recognize the New Keystores and Key Files
To Create the Federation Manager 2 Keystore Passwords
To Modify the AMConfig.properties File
6.5 Loading the Access Manager Root CA Certificates into the Federation Manager Servers
To Load the Root CA Certificate into the Federation Manager 1 Web Container
To Load the Root CA Certificate into the Federation Manager 2 Web Container
7. Configuring SAMLv2 Metadata for the Federation Manager Servers
7.1 Creating a Circle of Trust
To Create a Circle of Trust
7.2 Configuring the SAMLv2 Service Provider Metadata
To Generate and Customize the Service Provider Template Files
7.2.1 Sample Metadata Template Files
7.3 Loading the Service Provider SAMLv2 Metadata
Setting Up the Identity Provider Site
8. Installing the SAMLv2 Plug-in on Access Manager Servers
8.1 Installing the SAMLv2 Plug-In on the Access Manager Servers
To Install the SAMLv2 Plug-In and the SAMLv2 Patch on Access Manager 1
To Install the SAMLv2 Plug-In and the SAMLv2 Patch on Access Manager 2
8.2 Configuring the Access Manager Load Balancer for the SAMLv2 Protocols
8.3 Configuring the Access Manager Servers to Use SAMLv2 User Schema
To Reconfigure the LDAPv3 Plug-In on the Access Manager User Instances
9. Setting Up the Identity Provider Keystores
9.1 Configuring the Keystore for Access Manager 1
To Obtain an XML Signing Certificate from a Trusted Certificate Authority
To Obtain an Encryption Certificate from a Trusted Certificate Authority
9.2 Configuring Access Manager 1 to Recognize the New Keystores and Key Files
To Create the Access Manager 1 Keystore Passwords
To Modify the AMConfig.properties File
To Modify the amsaml.properties File
9.3 Configuring the Keystore for Access Manager 2
To Install the Access Manager 1 XML Signing Certificate on Access Manager 2
9.4 Configuring Access Manager 2 to Recognize the New Keystores and Key Files
To Create the Access Manager 2 Keystore Passwords
To Modify the AMConfig.properties File
Modify the amSAML.properties File
9.5 Loading the Federation Manager Root CA Certificates into the Access Manager Servers
To Load the Root CA Certificate into the Access Manager 1 Web Container
To Load the Root CA Certificate into the Access Manager 2 Web Container
10. Configuring SAMLv2 Metadata for the Access Manager Servers
10.1 Creating a Circle of Trust
To Create a Circle of Trust
10.2 Configuring the SAMLv2 Identity Provider Metadata
To Generate and Customize the Identity Provider Template Files
10.3 Loading the SAMLv2 Metadata
To Load Customized Identity Provider Configuration Files
10.4 Sample Identity Provider Metadata Template Files
Exchanging Metadata Between Identity Provider and Service Provider
11. Loading Identity Provider and Service Provider Metadata
11.1 Loading Service Provider Metadata into the Access Manager Servers
To Load the Service Provider Metadata into the Identity Provider Servers
To Load the Identity Provider Metadata into the Service Provider Servers
12. Verifying that SAMLv2 Protocols are Working Properly
12.1 Creating Test Users
To Create a Test Identity Provider User
To Create a Test Service Provider User
12.2 Testing Basic SAMLv2 Protocols
To Verify that Basic Login and Logout Work Properly
To Verify that Single Sign-On Works Properly on Initial Login
To Verify that Single Logout Works Properly
To Verify that Single Sign-On Works Properly on Subsequent Login
Setting Up Policy Agents in the Service Provider Site
13. Installing and Configuring J2EE Policy Agents
13.1 Creating J2EE Policy Agent Profiles on the Federation Manager Servers
To Create a J2EE Policy Agent Profile on Protected Resource 3
To Create an J2EE Policy Agent Profile on Protected Resource 4
13.2 Installing Application Server 3 and J2EE Policy Agent 3
To Install Application Server 3 on Protected Resource 3
To Run the J2EE Policy Agent Installer on Application Server 3
13.3 Completing the J2EE Policy Agent 3 Installation
To Deploy the J2EE Policy Agent Housekeeping Application
To Enable the J2EE Policy Agent 3 to Run in SSO-Only Mode
To Initialize the Application Server 3 Certificate Database
To Deploy the Sample Agent Application on Application Server 3
To Verify the Use of the Sample Agent Application on Application Server 3
13.4 Installing Application Server 4 and J2EE Policy Agent 4
To Install Application Server 4 on Protected Resource 4
To Run the J2EE Policy Agent Installer on Application Server 4
13.5 Completing the J2EE Policy Agent 4 Installation
To Deploy the J2EE Policy Agent Housekeeping Application
To Enable the J2EE Policy Agent 4 to Run in SSO-Only Mode
To Initialize the Application Server 4 Certificate Database
To Deploy the Sample Agent Application on Application Server 4
To Verify the Use of the Sample Agent Application on Application Server 4
13.6 Configuring the J2EE Policy Agents Load Balancer
To Configure the J2EE Policy Agents Load Balancer
To Terminate SSL at the J2EE Policy Agents Load Balancer
13.7 Configuring the Application Servers for SSL Termination
To Configure Application Server 3 for SSL Termination
To Configure Application Server 4 for SSL Termination
13.8 Configuring the J2EE Policy Agents to Work with the J2EE Policy Agents Load Balancer
To Configure J2EE Policy Agent 3 to Work with the J2EE Policy Agents Load Balancer
To Configure J2EE Policy Agent 4 to Work with the J2EE Policy Agents Load Balancer
To Verify that the J2EE Policy Agents Load Balancer Works Properly
13.9 Configuring the J2EE Policy Agents Load Balancer to Participate in SAMLv2 Protocols
To Configure the J2EE Policy Agents Load Balancer to Participate in SAMLv2 Protocols
To Verify that the J2EE Policy Agents Load Balancer Uses SAMLv2 Protocols
14. Installing and Configuring Web Policy Agents
14.1 Creating Web Agent Profiles on the Federation Manager Servers
To Create the UrlAccessAgent.properties File on Federation Manager 1
To Create the UrlAccessAgent.properties File on Federation Manager 2
14.2 Installing Web Server 3 and Web Policy Agent 3
To Install Web Server 3 on Protected Resource 3
To Install Web Policy Agent 3
14.3 Completing the Web Policy Agent 3 Installation
To Edit the AMAgent.Properties File
To Verify that Web Policy Agent 3 is Working Properly
To Import the Root CA Certificate into the Web Server 3 Key Store
To Verify that Web Policy Agent 3 Can Access the Federation Manager Load Balancer
14.4 Installing Web Server 4 and Web Policy Agent 4
To Install Web Server 4 on Protected Resource 4
To Install Web Policy Agent 4
14.5 Completing the Web Policy Agent 4 Installation
To Edit the AMAgent.Properties File
To Verify that Web Policy Agent 4 is Working Properly
To Import the Root CA Certificate into the Web Server 4 Key Store
To Verify that Web Policy Agent 4 Can Access the Federation Manager Load Balancer
14.6 Configuring the Web Policy Agents Load Balancer
To Configure the Web Policy Agents Load Balancer
To Configure the Web Policy Agents to Work with the Web Policy Agents Load Balancer
To Verify that the Web Policy Agents Load Balancer is Working Properly
14.7 Configuring the Web Policy Agents Load Balancer to Participate in SAMLv2 Protocols
To Enable the Web Policy Agents Load Balancer to Use SAMLv2 Protocols
To Verify that the Web Policy Agents Load Balancer Uses SAMLv2 Protocols
Configuring Special Use Cases
15. Use Case 1: Testing Basic SAMLv2 Protocols
15.1 Before You Begin
To Create an index.jsp File
To Create a Test User in the Identity Provider Site
15.2 Testing Requests Initiated by the Service Provider Using SOAP
To Test Persistent Federation Using Browser Artifact
15.2.1 To Test Logout Using SOAP
To Test Single Sign-On Using Browser Artifact
To Test Federation Termination Using SOAP
15.3 Testing Requests Initiated by the Service Provider Using HTTP Redirect
To Test Persistent Federation Using Browser POST
To Test Logout Using HTTP
To Test Single Sign-On Using Browser POST
To Test Federation Termination Using HTTP
15.4 Testing Requests Initiated by the Identity Provider Using SOAP
To Test Persistent Federation Using Browser Artifact
To Test Logout Using SOAP
To Test Single Sign-On Using Browser Artifact
To Test Federation Termination Using SOAP
15.5 Testing Requests Initiated by the Identity Provider Using HTTP Redirect
To Test Persistent Federation Using Browser POST
To Test Logout Using HTTP
To Test Single Sign-On Using Browser POST
To Test Federation Termination Using HTTP
15.6 The Sample jsp.index File
16. Use Case 2: User Attribute Mapping
16.1 Mapping User Attributes from the Identity Provider to a Single User on the Service Provider
To Modify the usersLDAP User Attributes
To Create a New User
To Edit the New User's Contact Information
To Modify the Identity Provider Metadata
To Modify the Service Provider Metadata
To Modify the Agents Properties
To Verify that Attribute Mapping is Working Properly
Reference: Summaries of Server and Component Configurations
A. Directory Servers
B. Federation Manager Servers
C. Sun Java System Application Servers and J2EE Policy Agents
D. Sun Java System Web Servers and Web Policy Agents
E. Load Balancers
F. Keystores and SSL Certificate Chains
News Center
About Sun
Contact Sun
Terms of Use
Privacy
Copyright
1994-2009
Sun Microsystems, Inc.
Descargar este libro en PDF (1745 KB)