Scripted, Deterministic Deployments. Script AM deployments by using the Groovy scripting support within Amster.

See Section 3.5, "Scripting" in the User Guide.

Import and Export Configuration. Amster can export all the configuration settings related to an AM instance and import it back to the same or a different instance.

See Section 3.2, "Exporting Configuration Data" in the User Guide.

Configuration Stored in JSON. Amster exports all configuration settings as a hierarchy of JSON format text files on the local filesystem. Store these files in a version control system to manage and maintain AM configurations.

See Chapter 1, "Introducing the Amster Command-line Interface" in the User Guide.

Encryption of Sensitive Data. Amster can export encrypted password and sensitive data to the configuration files. Amster is not able to decrypt the values itself, only a correctly configured AM instance with the appropriate transport key installed is able to decrypt the values.

See Section 3.1, "Creating Transport Keys" in the User Guide.

Amster Imports and Exports Configuration From Access Management 5 or Newer

Upgrade to Access Management 5 or newer to import or export the configuration using Amster.

For more information on upgrades, see the Upgrade Guide.

Amster Installs Single-server Instances of Access Management

To create instances and add them to a multi-server site deployment, see the Install Guide.

Importing Resources Containing Slash Characters Can Fail

Some Access Management resources have names that can contain slash characters (/), for example policy names, application names, and SAML v2.0 entities. These slash characters can cause unexpected behavior and failures in Amster when importing into Access Management instances running on Apache Tomcat.

To workaround this issue, configure Apache Tomcat to allow encoded slash characters by updating the CATALINA_OPTS environment variable. For example:

On Unix/Linux systems:

$ export CATALINA_OPTS= \
  "-Dorg.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH=true"
$ startup.sh

On Windows systems:

C:\> set CATALINA_OPTS= ^
  "-Dorg.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH=true"
C:\> startup.bat

[INFO] Messages Showing On SuSE On Amster Start Up

Running Amster on SuSE may produce [INFO] messages, for example:

# ./amster
[INFO] Unable to bind key for unsupported operation: up-history
[INFO] Unable to bind key for unsupported operation: down-history
[INFO] Unable to bind key for unsupported operation: up-history
[INFO] Unable to bind key for unsupported operation: down-history
OpenAM Shell (14.0.0 build c9ca9450a9, JVM: 1.8.0_65)
Type ':help' or ':h' for help.
-----------------------------------------------------
am>

These messages are caused by the keyboard mappings configured in the /etc/inputrc file and can safely be ignored, as they do not affect functionality.

Private Key Connections to Access Management Can Fail

Installing or upgrading AM appends the contents of the /path/to/openam/amster_rsa.pub file to the /path/to/openam/authorized_keys file. The contents of the authorized_keys file resemble the following:

from="127.0.0.0/24,::1" ssh-rsa AAAAB3NzaC1y...

The from attribute restricts the communication between AM and Amster clients that communicate using the 127.0.0.0/24 network. If your AM server is not configured in the loopback interface, Amster connections may fail with an error resembling the following:

am> connect  --private-key /home/fr/openam/amster_rsa https://openam.example.com:8443/openam
Unexpected response from OpenAM
[code:401, reason:Unauthorized, message:Authentication Failed]

To work around this problem, remove or update the from attribute to suit your environment as follows: