OpenAM J2EE 代理安装导致 Tomcat 宕机

Question

OpenAM 版本 -12 ，代理版本 3.5 和 3.3 ，tomcat 版本 7

我尝试点击链接https://forums.alfresco.com/forum/installation-upgrades-configuration-integration/authentication-ldap-sso/sso-openam-06052012 来设置我的J2EE 代理。让我在问完问题后粘贴步骤（见最后）

但我收到了如下所示的错误

Not able to configure J2ee agent on adding my customized data store for users

我曾多次尝试使用3.5版本安装和卸载，并尝试了以前的版本。

http://database.developer-works.com/article/16009911/%22Cannot+obtain+Application+SSO+token%22+error 对此话题进行了很好的讨论 但对我帮助不大。

我正在使用 LDAP，所以我使用了 LDAP 领域并且主题显示正常。我还观察到策略选项卡与博客中的描述发生了很大变化。

现在有了路障，我不确定如何继续，因为错误没有给我任何线索。我什至在类路径中添加了名为 AMConfig.properties 的文件，其中包含代理的用户名和密码，并按照上述讨论中的建议尝试了 OpenAM 管理员的用户名和密码。但这也无济于事。

问题是 Tomcat 现在没有启动并给出需要 AMConfig.properties 属性的错误

我知道 OpenAM 领域设置很好，因为我能够通过该领域登录到另一个应用程序 (Liferay)，我只需提供使用 OpenAM 集成的 URL。但是在卸载代理后，tomcat 启动时没有任何错误，我可以登录到应用程序

-------------------Step copied from 1st link(modified)--------------------------

1. Configure your OpenAM agent (tried both 3.5 and 3.3 version on tomcat 7)
a. Log into OpenAM as the admin user and navigate to "Access Control -> (Your Realm) - where in my case LDAP Realm (other application using it without issue)
b. Select Policies -> New Policy
c. Enter Share as the policy name and then create 2 new URL Policy agent rules
d. 1st Resource Name = http://:/share/*
e. 2nd Resource Name = http://alfresco.domain.com:8080/share/*?*
f. Add a subjects - already part of LDAP Realm 
g. Now select Agents -> J2EE - > (your J2EE agent)
h. Select the Application tab
i. Login Processing -> Login Form URI - add /share/page/dologin
j. Logout Processing -> Application Logout URL - add Map Key = share - Corresponding Map Value = /share/page/dologout
k. Not Enforced URI Processing - Add 2 entries - /share and /share/
l. Profile Attributes Processing - Select HTTP_HEADER and add Map Key = uid - Corresponding Map Value = SsoUserHeader (This is what I called my header in the alfresco-global.properties file - see below)

  Auth chain
authentication.chain=external1:external,alfrescoNtlm1:alfrescoNtlm 
alfresco.authentication.allowGuestLogin=true

  SSO settings
external.authentication.enabled=true
external.authentication.defaultAdministratorUserNames=admin
external.authentication.proxyUserName=
external.authentication.proxyHeader=SsoUserHeader

NOTE- It does not seem possible to configure SSO where the Guest login has been disabled. There are webscripts used on the Alfresco repository that need guest login.

That concludes the setup for Alfresco and OpenAM

For Share you need to have the following section uncommented in your share-config-custom.xml


alfresco/web-extension/alfresco-system.p12
pkcs12
alfresco-system



alfrescoCookie
Alfresco Connector
Connects to an Alfresco instance using cookie-based authentication
org.alfresco.web.site.servlet.SlingshotAlfrescoConnector



alfrescoHeader
Alfresco Connector
Connects to an Alfresco instance using header and cookie-based authentication
org.alfresco.web.site.servlet.SlingshotAlfrescoConnector
SsoUserHeader

alfresco
Alfresco - user access
Access to Alfresco Repository WebScripts that require user authentication
alfrescoHeader
http://alfreso.domain.com:8080/alfresco/wcs
user
true


Notice I am not using the SSL cert and in my alfrescoHeader connector I have used SsoUserHeader (as setup in OpenAM) and the endpoint uses the alfrescoHeader connector

Now you need to add the OpenAM filter to the Share web.xml file

Add the following filter just before the Share SSO authentication support filter


Agent
com.sun.identity.agents.filter.AmAgentFilter
Add the following filter mapping to the filter-mapping section


Agent

REQUEST
INCLUDE
FORWARD
ERROR
----- End ----------

Answer 1

错误信息有点misleading：无法获取应用程序 SSO 令牌一般意味着代理无法对自己进行身份验证。当您安装代理时，代理会询问配置文件名称和密码文件，这些值需要与 OpenAM 中配置的代理配置文件相对应。 要测试您是否可以作为用户进行身份验证，您可以简单地通过发出以下请求来尝试以代理身份进行身份验证：

curl -d "username=profilename&password=password&uri=realm=/%26module=Application" http://aldaris.sch.bme.hu:8080/openam/identity/authenticate

在上述命令中，领域值需要与 OpenSSOAgentBootstrap.properties 中定义的“com.sun.identity.agents.config.organization.name”属性的值相同（在代理的安装目录下）。

但用户名/密码组合错误只是此异常的可能根本原因之一。也有可能在启动期间代理无法连接到 OpenAM 以验证自己。在这些情况下，问题可能是：

• 网络错误、防火墙问题阻止代理联系 OpenAM
• SSL 信任问题：代理的 JVM 不信任 OpenAM 容器的证书（仅当您通过提供 OpenAM 的 HTTPS URL 安装代理并且证书是自签名的或只是不被 JVM 信任时才会出现问题）李>