Question on running multiple WebAgents on one Apache server

Products

• CA Single Sign On Secure Proxy Server (SiteMinder)
• CA Single Sign On SOA Security Manager (SiteMinder)
• CA Single Sign-On

Issue/Introduction

We are looking to configure the following:
Apache web server with two virtual hosts setup,  both pointing to their on web agent ACO, with their own agent and Policies as well.

NOTE: We need separate ACO and not just AgentName within 1 ACO. We have 2 separate entry channels (domain1.com and Domain2.com) and they need to have different ACO settings. 

Environment

Environment::Policy Server: 12.51; Update: 00.05; Build: 1232; CR: 05 Policy Server OS: Windows Server 2008 r2 SiteMinder APACHE 2.2 WebAgent, Version 12.5, Update HF-01, Label 813. Agent OS: RHEL6

Resolution

It is dependent on how the WebServer is configured, if it is a single WebServer instance e.g. IIS or single Apache Instance (single httpd.conf) - then you could only have one ACO.

IIS is an exception in that there could be only one ACO, since only one WebAgent could be configured with IIS.

_{*As of R12.52. SP02 multiple WebAgent could be configured with IIS.} 

 

Apache, we can create multiple instances of Apache using a single install of Apache. Thus, there is an httpd.conf per instance of Apache. We could now map a unique WebAgent.conf (with a unique ACO in each) to each httpd.conf. Each httpd.conf could be an independent WebSite (e.g. abc.com or xyz.com).

ServerPath must be set for each Apache or iPlanet Web Server, so if you have four web servers, the need four separate httpd.conf or obj.conf files, each loading an Agent, then you need four separate ServerPath parameters. These ServerPath parameters are set in the WebAgent.conf file for R12.52 agents. The value of the ServerPath parameter should be set to a unique file path for each Apache or iPlanet instance. Generally, setting the value to the directory that contains the httpd.conf or obj.conf file is a valid configuration.

In the above scenario, webagents can still use the same SmHost.conf file, only the webagent.conf needs to be different.