Questions[opensso](server)

I've found a few how-tos, but they're based on old versions of both libraries (and contain references for files that seem to have been removed from OpenAM/OpenSSO) - for example:

http://blogs.oracle.com/indira/entry/using_opends_as_user_store

I've tried importing the old version of am_remote_opends_schema.ldif, but I get a fairly verbose error:

ldap_modify: Invalid syntax (21)
 additional info: An error occurred while attempting to decode the object class "( 2.16.840.1.113730.3.2.181 NAME 'iplanet-am-managed-filtered-group' DESC 'Managed Filter Group OC' SUP iplanet-am-managed-group X-ORIGIN 'OpenSSO' )":  The definition for objectclass 2.16.840.1.113730.3.2.181 is invalid because it has an objectclass type of STRUCTURAL but this is incompatible with the objectclass type AUXILIARY for the superior class iplanet-am-managed-group

Should I roll back to the versions of OpenAM and OpenDJ to the older versions of OpenSSO and OpenDS referenced in these how-tos? That seems like a not-so-pleasing approach, but if it would do the trick...

I've got OpenAM (was OpenSSO) installed successfully and running in a Glassfish container. I also have OpenLDAP installed and working minimally. Now I'm trying to import an LDIF file of records from another server (Java Access Manager and Sun Java System Directory Server), but I get a persistent error when I try to run ldapadd:

ldap_add: Invalid syntax (21)
    additional info: objectClass: value #2 invalid per syntax

I've added the schema provided at http://blogs.oracle.com/indira/entry/using_openldap_as_user_data, but it doesn't seem to affect the error message. It could be that I'm missing some simple understanding about LDAP!

Here's an example record from my LDIF file (domain and password changed):

dn: uid=amAdmin,ou=People,dc=domain,dc=org
objectClass: inetuser
objectClass: inetorgperson
objectClass: organizationalperson
objectClass: person
objectClass: top
objectClass: iplanet-am-managed-person
objectClass: iplanet-am-session-service
objectClass: iplanet-am-user-service
objectClass: iPlanetPreferences
objectClass: inetAdmin
objectClass: sunAMAuthAccountLockout
inetUserStatus: Active
cn: amAdmin
sn: amAdmin
userPassword:: ------
uid: amAdmin

I assume that the schema file provided in the link above should contain configuration for all the attributes that are used in the "objectClass" lines, but that could be one of my core misunderstandings!

Thanks for any help!

I am trying to setup an IdP Provider using OpenAM(OpenSSO) with a 3rd party SP. I currently have OpenAM behind Apache reverse proxy with OpenAM configured to use an internal DNS. When I access OpenAM through the proxy, OpenAM redirects to the internal DNS instead which cannot be resolved by the browser.

I've tried setting the com.sun.identity.server.fqdnMap[public.domain.com]=internal.domain.com property and even swapping the (in)valid values around.

What am I missing?

Question says it all. I would like to use SUN Glassfish 2.0x server as a reverse-proxy server, so that when someone hits this server, he/she is transparently redirected to an internal web site, which runs some old Apache (which we cannot upgrade).

We are using Glassfish already under SuSE Linux for multiple applications. This Glassfish would then have SUN Policy Agent (from OpenSSO) installed to control the access to the box.

(internet) ---> reverse-proxy ---> internal server

Both internal and external should be the same NIC and same IP, preferrably.

Is it possible to implement a Single-Sign-On solution using OpenSSO (express build 8) for the most recent versions of Jira (4.0.1) and Confluence (3.1) ? Is full integration of OpenSSO users and groups possible, or only integration on the level of authentication (which means that there is still a user store in both Jira and Confluence) ?

I already tried to find information about this, but this is still not clear to me. I found the Seraph provider extension for OpenSSO at

https://opensso.dev.java.net/public/extensions/index.html

This one only provides authentication and gives pure SSO for Jira and Confluence AFAICT. Then I also found an extension for Jira which gives better integration with OpenSSO at

http://confluence.atlassian.com/display/JIRAEXT/Sun+Access+Manager+%28OpenSSO%29+Integration

Does anyone have experience with those extensions and recent versions of Jira and Confluence?

I tried to install a setup with OpenSSO on a GlassFish server (with the default OpenSSO setup, since this is only a test) and Confluence on Tomcat 6.0.20. I use the Seraph provider, which can be found on the OpenSSO extensions page. I configured Confluence as described in the documentation. I use the following AMConfig.properties file:

com.iplanet.am.naming.url=http://opensso.test.local:8080/opensso/namingservice
com.iplanet.am.cookie.name=iPlanetDirectoryPro
com.sun.identity.agents.app.username=amadmin
com.iplanet.am.service.password=adminadmin
com.iplanet.am.server.protocol=http
com.iplanet.am.server.host=opensso.test.local
com.iplanet.am.server.port=8080
com.iplanet.security.encryptor=com.iplanet.services.util.JCEEncryption
com.iplanet.services.debug.level=MESSAGE
com.iplanet.am.cookie.encode=true
com.iplanet.am.serverMode=false

As you can see, the property com.iplanet.am.cookie.encode is true. This is also activated on the OpenSSO server side.

In the Confluence install, I initially created an admin user "confluenceadmin". I created a user with the same id in the OpenSSO user data store.

When I browse to the Confluence site (http://confluence.test.local:8080/), I am redirected to the OpenSSO login page (which is correct). After authentication on the OpenSSO page, however, the browser goes into a redirect loop between Confluence and OpenSSO. In the Tomcat logs, I found the following error on the Confluence side:

In SiteMonitor.isAvailable()
amNaming:01/06/2010 04:30:04:463 PM CET: Thread[http-8080-1,5,main]
SiteID http://opensso.pmtools.local:8080/opensso/sessionservice is UP.
PLLClient:01/06/2010 04:30:04:463 PM CET: Thread[http-8080-1,5,main]
sending cookies: iPlanetDirectoryPro=AQIC5wM2LY4SfczS5FTStE+TifKvZv90WatUK11Rea1JT28=@AAJTSQACMDE=#;amlbcookie=null
amSession:01/06/2010 04:30:04:467 PM CET: Thread[http-8080-1,5,main]
ERROR: XMLUtils.fatalError
org.xml.sax.SAXParseException: Content is not allowed in prolog.
 at org.apache.xerces.util.ErrorHandlerWrapper.createSAXParseException(Unknown Source)
 at org.apache.xerces.util.ErrorHandlerWrapper.fatalError(Unknown Source)
 at org.apache.xerces.impl.XMLErrorReporter.reportError(Unknown Source)
 at org.apache.xerces.impl.XMLErrorReporter.reportError(Unknown Source)
 at org.apache.xerces.impl.XMLErrorReporter.reportError(Unknown Source)
 at org.apache.xerces.impl.XMLScanner.reportFatalError(Unknown Source)
 at org.apache.xerces.impl.XMLDocumentScannerImpl$PrologDispatcher.dispatch(Unknown Source)
 at org.apache.xerces.impl.XMLDocumentFragmentScannerImpl.scanDocument(Unknown     Source)
 at org.apache.xerces.parsers.XML11Configuration.parse(Unknown Source)
 at org.apache.xerces.parsers.XML11Configuration.parse(Unknown Source)
 at org.apache.xerces.parsers.XMLParser.parse(Unknown Source)
 at org.apache.xerces.parsers.DOMParser.parse(Unknown Source)
 at org.apache.xerces.jaxp.DocumentBuilderImpl.parse(Unknown Source)
 at javax.xml.parsers.DocumentBuilder.parse(DocumentBuilder.java:124)
 at com.sun.identity.shared.xml.XMLUtils.toDOMDocument(XMLUtils.java:181)
 at com.sun.identity.shared.xml.XMLUtils.toDOMDocument(XMLUtils.java:130)
 at com.iplanet.dpro.session.share.SessionResponseParser.<init>(SessionResponseParser.java:70)
 at com.iplanet.dpro.session.share.SessionResponse.parseXML(SessionResponse.java:152)
 at com.iplanet.dpro.session.Session.sendPLLRequest(Session.java:1122)
 at com.iplanet.dpro.session.Session.getSessionResponseWithoutRetry(Session.java:1538)
 at com.iplanet.dpro.session.Session.getSessionResponse(Session.java:1646)
 at com.iplanet.dpro.session.Session.doRefresh(Session.java:1413)
 at com.iplanet.dpro.session.Session.access$300(Session.java:108)
 at com.iplanet.dpro.session.Session$3.run(Session.java:1385)
 ....

Any hints on how to proceed?

BTW, I know Atlassian provides Crowd for central user management and Single-Sign-On. However, we'd like to standardize on OpenSSO.