The goal of this document is to enable the reader to be able to 
protect their Java EE application deployed on Glass Fish Enterprise
Server 2.1 Cluster using OpenSSO and Policy Agents 3.0. This document
is verified and validated with OpenSSO policy agents 3.0 and GFv2.1 EE
cluster as described in the next section. Read More on http://indirat.wordpress.com/2009/10/13/policyagentsongfcluster/

Now it is so simple to use OpenSSO as an Identity Provider to SSO
with Salesforce.com applications using the SAMLv2 protocol. Out of the
box OpenSSO supports an easy to use work flow feature that enable the
customers to integrate salesforce.com applications to their existing
authentication infrastructure. More you can read it from my new url http://indirat.wordpress.com/salesforce/

It is time for me to move to wordpress.com. I like the editor and it is so easy to upload an image/file. You can find my new posts at 

http://indirat.wordpress.com/ 

You can use ssoadm CLI to automate the OpenSSO service configuration. 
In the next few blog entries I am planning to give some examples on how
to perform certain configuration changes using the ssoadm CLI. In this
article I am going to show you how to create an Authentication Chain.
You should have configured the CLI  as a prerequisite.

How To Determine whether the given LDAP server support persistent search

• IBM(Tivoli Directory)
  


• Novell(eDirectory)
  


• Sun(DSEE)
  


• OpenDS(OpenDS Directory Server 1.0.0-build007)
  


• Fedora-Directory/1.0.4 B2006.312.1539
  

ldapsearch -p 389 -h ds_host -s base -b '' "objectclass=*" supportedControl | grep 2.16.840.1.113730.3.4.3

Active Directory

AD implements in a different form using the LDAP control 1.2.840.113556.1.4.528

ldapsearch  -h AD_HOST -p PORT  -D"CN=Administrator,CN=Users,dc=test,dc=com" -w secret12 -s base  -b '' "objectclass=*" supportedControl | grep 1.2.840.113556.1.4.528

This blog is an addendum  to my earlier entry on the password reset application.
This article specifically addresses the steps involved in configuring
the OpenDS as the user store for the OpenSSO and enabling password
reset that works  in association with OpenDS Password policy. 

It is easy to configure  an already existing  opensso system to run in 'debug' mode, but what if the system is being configured and you want to view the debug traces of opensso? There is a way to do that in OpenSSO. 

This document specifically addresses the workaround for the
opensso issue 4094, yet this document can be used to configure the
Opensso Server against an existing Sun Java System Directory Server
Enterprise Edition. (DSEE)

Out of the box Access Manager Repository Plug-in datastore plugin cannot be created in the OpenSSO server, This is not a bug rather it is intentional to configure it manually depending up on the customer requirement.   Access Manager Repository Plug-in data store may be applicable in the co-existence and/or upgrade scenarios with its predecessors like Sun Java System Access Manager.  For the fresh deployments customers should be using the Identity Repository Datastore Plugins. 

Problem:

• 
  

  
  Create cn=dsameuser entry under the configuration directory server

  
  


• 
  

  
  Update the serverconfig.xml in the configuration store

  
  

later option is recommended to the production customers

People who love programming in the interpretive languages would love the OpenSSO  REST based Identity Services, OpenSSO offers decently powerful REST interfaces to manipulate the idenity information stored in any supported OpenSSO identity store. I strongly encourage to read  Aravindan Ranganathan's  article on Identity Servic

This document is generated based on the  article

OpenSSO support most of the commercially available LDAP servers as
identity store. In this blog entry I am goign to show you how to create
these data store from famadm CLI. IT is easy and less error prone and
repeatable.

The simplest way to configure the OpenSSO system is to use the browser just to fill four test fields, it is that simple. However there are scenarios where you want to script the configuration on multiple machines or when you can not reach out to a browser, let us say all you've got is a dumb terminal access. In these scenarios what you do?