OpenAM J2EE 代理安装关闭 tomcat
OpenAM J2EE agent installation bringing down tomcat
OpenAM 版本 -12，代理版本 3.5 和 3.3，tomcat 版本 7
我已经尝试按照 link https://forums.alfresco.com/forum/installation-upgrades-configuration-integration/authentication-ldap-sso/sso-openam-06052012 设置我的 J2EE 代理。问完问题我贴一下步骤（见文末）
但我收到如下所述的错误
Not able to configure J2ee agent on adding my customized data store for users
我试过多次安装和卸载3.5版本，也试过以前的版本。
在 http://database.developer-works.com/article/16009911/%22Cannot+obtain+Application+SSO+token%22+error 上对此主题进行了很好的讨论
但对我帮助不大。
我正在使用 LDAP，所以我使用了 LDAP 领域并且主题显示正常。我还观察到政策选项卡与博客中的描述相比发生了很大变化。
现在有了障碍，我不确定如何继续，因为错误没有给我任何线索。我什至在类路径中添加了名为 AMConfig.properties 的文件，其中包含代理的用户名和密码，并按照所提到的讨论中的建议尝试了 OpenAM 管理员的用户名和密码。但这也无济于事。
问题是 Tomcat 现在没有启动并给出需要 AMConfig.properties 属性的错误
我知道 OpenAM Realm 设置很好，因为我可以通过这个领域登录到另一个应用程序 (Liferay)，我只需要提供 URL 即可使用 OpenAM 集成。但是卸载代理后 tomcat 启动时没有任何错误，我能够登录到应用程序
-------------------Step copied from 1st link(modified)--------------------------
1. Configure your OpenAM agent (tried both 3.5 and 3.3 version on tomcat 7)
a. Log into OpenAM as the admin user and navigate to "Access Control -> (Your Realm) - where in my case LDAP Realm (other application using it without issue)
b. Select Policies -> New Policy
c. Enter Share as the policy name and then create 2 new URL Policy agent rules
d. 1st Resource Name = http://:/share/*
e. 2nd Resource Name = http://alfresco.domain.com:8080/share/*?*
f. Add a subjects - already part of LDAP Realm
g. Now select Agents -> J2EE - > (your J2EE agent)
h. Select the Application tab
i. Login Processing -> Login Form URI - add /share/page/dologin
j. Logout Processing -> Application Logout URL - add Map Key = share - Corresponding Map Value = /share/page/dologout
k. Not Enforced URI Processing - Add 2 entries - /share and /share/
l. Profile Attributes Processing - Select HTTP_HEADER and add Map Key = uid - Corresponding Map Value = SsoUserHeader (This is what I called my header in the alfresco-global.properties file - see below)
Auth chain
authentication.chain=external1:external,alfrescoNtlm1:alfrescoNtlm
alfresco.authentication.allowGuestLogin=true
SSO settings
external.authentication.enabled=true
external.authentication.defaultAdministratorUserNames=admin
external.authentication.proxyUserName=
external.authentication.proxyHeader=SsoUserHeader
NOTE- It does not seem possible to configure SSO where the Guest login has been disabled. There are webscripts used on the Alfresco repository that need guest login.
That concludes the setup for Alfresco and OpenAM
For Share you need to have the following section uncommented in your share-config-custom.xml
alfresco/web-extension/alfresco-system.p12
pkcs12
alfresco-system
alfrescoCookie
Alfresco Connector
Connects to an Alfresco instance using cookie-based authentication
org.alfresco.web.site.servlet.SlingshotAlfrescoConnector
alfrescoHeader
Alfresco Connector
Connects to an Alfresco instance using header and cookie-based authentication
org.alfresco.web.site.servlet.SlingshotAlfrescoConnector
SsoUserHeader
alfresco
Alfresco - user access
Access to Alfresco Repository WebScripts that require user authentication
alfrescoHeader
http://alfreso.domain.com:8080/alfresco/wcs
user
true
Notice I am not using the SSL cert and in my alfrescoHeader connector I have used SsoUserHeader (as setup in OpenAM) and the endpoint uses the alfrescoHeader connector
Now you need to add the OpenAM filter to the Share web.xml file
Add the following filter just before the Share SSO authentication support filter
Agent
com.sun.identity.agents.filter.AmAgentFilter
Add the following filter mapping to the filter-mapping section
Agent
REQUEST
INCLUDE
FORWARD
ERROR
----- End ----------
错误信息有点misleading: Cannot obtain application SSO token 通常意味着代理无法验证自己。安装代理时，代理会要求提供配置文件名称和密码文件，这些值需要与在 OpenAM 中配置的代理配置文件相对应。
要测试您是否可以作为用户进行身份验证，您可以通过发出以下请求来尝试以代理身份进行身份验证：
curl -d "username=profilename&password=password&uri=realm=/%26module=Application" http://aldaris.sch.bme.hu:8080/openam/identity/authenticate
在上面的命令中，领域值需要与 OpenSSOAgentBootstrap.properties 中定义的 "com.sun.identity.agents.config.organization.name" 属性 的值相同（在代理的安装目录下）。
错误的 username/password 组合只是导致此异常的可能根本原因之一。也有可能是在启动期间，代理无法连接到 OpenAM 以对自身进行身份验证。在这些情况下，问题可能是：
- 网络错误，防火墙问题阻止代理联系 OpenAM
- SSL 信任问题：代理的 JVM 不信任 OpenAM 容器的证书（仅当您通过提供 OpenAM 的 HTTPS URL 安装代理并且证书是自签名的或根本不受信任时才会出现问题由 JVM）
OpenAM 版本 -12，代理版本 3.5 和 3.3，tomcat 版本 7
我已经尝试按照 link https://forums.alfresco.com/forum/installation-upgrades-configuration-integration/authentication-ldap-sso/sso-openam-06052012 设置我的 J2EE 代理。问完问题我贴一下步骤（见文末）
但我收到如下所述的错误
Not able to configure J2ee agent on adding my customized data store for users
我试过多次安装和卸载3.5版本，也试过以前的版本。
在 http://database.developer-works.com/article/16009911/%22Cannot+obtain+Application+SSO+token%22+error 上对此主题进行了很好的讨论 但对我帮助不大。
我正在使用 LDAP，所以我使用了 LDAP 领域并且主题显示正常。我还观察到政策选项卡与博客中的描述相比发生了很大变化。
现在有了障碍，我不确定如何继续，因为错误没有给我任何线索。我什至在类路径中添加了名为 AMConfig.properties 的文件，其中包含代理的用户名和密码，并按照所提到的讨论中的建议尝试了 OpenAM 管理员的用户名和密码。但这也无济于事。
问题是 Tomcat 现在没有启动并给出需要 AMConfig.properties 属性的错误
我知道 OpenAM Realm 设置很好，因为我可以通过这个领域登录到另一个应用程序 (Liferay)，我只需要提供 URL 即可使用 OpenAM 集成。但是卸载代理后 tomcat 启动时没有任何错误，我能够登录到应用程序
-------------------Step copied from 1st link(modified)--------------------------
1. Configure your OpenAM agent (tried both 3.5 and 3.3 version on tomcat 7)
a. Log into OpenAM as the admin user and navigate to "Access Control -> (Your Realm) - where in my case LDAP Realm (other application using it without issue)
b. Select Policies -> New Policy
c. Enter Share as the policy name and then create 2 new URL Policy agent rules
d. 1st Resource Name = http://:/share/*
e. 2nd Resource Name = http://alfresco.domain.com:8080/share/*?*
f. Add a subjects - already part of LDAP Realm
g. Now select Agents -> J2EE - > (your J2EE agent)
h. Select the Application tab
i. Login Processing -> Login Form URI - add /share/page/dologin
j. Logout Processing -> Application Logout URL - add Map Key = share - Corresponding Map Value = /share/page/dologout
k. Not Enforced URI Processing - Add 2 entries - /share and /share/
l. Profile Attributes Processing - Select HTTP_HEADER and add Map Key = uid - Corresponding Map Value = SsoUserHeader (This is what I called my header in the alfresco-global.properties file - see below)
Auth chain
authentication.chain=external1:external,alfrescoNtlm1:alfrescoNtlm
alfresco.authentication.allowGuestLogin=true
SSO settings
external.authentication.enabled=true
external.authentication.defaultAdministratorUserNames=admin
external.authentication.proxyUserName=
external.authentication.proxyHeader=SsoUserHeader
NOTE- It does not seem possible to configure SSO where the Guest login has been disabled. There are webscripts used on the Alfresco repository that need guest login.
That concludes the setup for Alfresco and OpenAM
For Share you need to have the following section uncommented in your share-config-custom.xml
alfresco/web-extension/alfresco-system.p12
pkcs12
alfresco-system
alfrescoCookie
Alfresco Connector
Connects to an Alfresco instance using cookie-based authentication
org.alfresco.web.site.servlet.SlingshotAlfrescoConnector
alfrescoHeader
Alfresco Connector
Connects to an Alfresco instance using header and cookie-based authentication
org.alfresco.web.site.servlet.SlingshotAlfrescoConnector
SsoUserHeader
alfresco
Alfresco - user access
Access to Alfresco Repository WebScripts that require user authentication
alfrescoHeader
http://alfreso.domain.com:8080/alfresco/wcs
user
true
Notice I am not using the SSL cert and in my alfrescoHeader connector I have used SsoUserHeader (as setup in OpenAM) and the endpoint uses the alfrescoHeader connector
Now you need to add the OpenAM filter to the Share web.xml file
Add the following filter just before the Share SSO authentication support filter
Agent
com.sun.identity.agents.filter.AmAgentFilter
Add the following filter mapping to the filter-mapping section
Agent
REQUEST
INCLUDE
FORWARD
ERROR
----- End ----------
错误信息有点misleading: Cannot obtain application SSO token 通常意味着代理无法验证自己。安装代理时，代理会要求提供配置文件名称和密码文件，这些值需要与在 OpenAM 中配置的代理配置文件相对应。 要测试您是否可以作为用户进行身份验证，您可以通过发出以下请求来尝试以代理身份进行身份验证：
curl -d "username=profilename&password=password&uri=realm=/%26module=Application" http://aldaris.sch.bme.hu:8080/openam/identity/authenticate
在上面的命令中，领域值需要与 OpenSSOAgentBootstrap.properties 中定义的 "com.sun.identity.agents.config.organization.name" 属性 的值相同（在代理的安装目录下）。
错误的 username/password 组合只是导致此异常的可能根本原因之一。也有可能是在启动期间，代理无法连接到 OpenAM 以对自身进行身份验证。在这些情况下，问题可能是：
- 网络错误，防火墙问题阻止代理联系 OpenAM
- SSL 信任问题：代理的 JVM 不信任 OpenAM 容器的证书（仅当您通过提供 OpenAM 的 HTTPS URL 安装代理并且证书是自签名的或根本不受信任时才会出现问题由 JVM）