Notes covering prerequisites, fixes, known issues for ForgeRock® Access Management web agents. ForgeRock Access Management provides authentication, authorization, entitlement, and federation software.

Added Support for SameSite Configuration

Web Agents 5.7 add the SameSite Cookie Attribute property (com.forgerock.agents.cdsso.cookie.samesite) to set the SameSite attribute on all cookies the agent creates.

For more information, see SameSite Cookie Attribute in the User Guide.

Policy Cache Feature Now Supported

Web Agents 5.7 introduced a technical preview of the policy cache feature. The feature is fully supported in this release.

For more information, see "Caching Capabilities" in the User Guide.

Accept Secure Cookies From AM Over HTTP

A new bootstrap property allows the agent to accept secure cookies from AM over HTTP. For more information, see Accept Secure Cookies From AM Over HTTP in the User Guide.

OpenAM

AM versions earlier than 5.5.

AMAGENTS-2893: Race condition in agent-authn-tx cookie causes lost state identifier's.

AMAGENTS-3051: Agent is enforcing case sensitivity for agent_realm parameter in the jwt id_token received from AM

AMAGENTS-3181: Blocking READ causes too much buffering on Input FIlter on slow uploading clients.

AMAGENTS-3232: WebAgent override Request URL does not takes X-Forwarded-Host may have port.

AMAGENTS-3530: naming.url is case sensitive

AMAGENTS-3533: Webagent for Varnish returns 500 error on empty PDP request

AMAGENTS-3577: AM Console, WPA Profile (i)Pop-Up for log file Size (2 settings) are bootstrap props; NOT Hot-Swappable

AMAGENTS-3627: Problem handling notifications after agent token expires

AMAGENTS-3652: Infinite loop in am_sdk_handle_subscription when there is an error in net_read_ssl

AMAGENTS-3667: When upgrading to agent 5.7.0, certain properties which were set before will no longer have intended effect.

The Custom Login Redirection Mode Requires AM 6 or Later

Ignore Path Info Properties Is not Supported for NGINX Plus Agent

The NGINX Plus web agent does not support the following ignore path info properties:

IIS Web Agents May Fail to Install When IIS Configuration Is Locked

Installing web agents in IIS may fail with an error similar to the following:

Creating configuration...
    Error: failed to create module entry for MACHINE/WEBROOT/APPHOST/AgentSite/ (error 0x80070021, line: 1823).
    The process cannot access the file because another process has locked a portion of the file. (error: 0x21).
    Installation failed.

This error message means the agentadmin.exe command cannot access some IIS configuration files because they are locked.

To work around this issue, perform the following steps:

Apache HTTP Server Authentication Functionality Not Supported

The web agent replaces authentication functionality provided by Apache, for example, the mod_auth_* modules. Integration with built-in Apache httpd authentication directives, such as AuthName, FilesMatch, and Require is not supported.

IIS Web Agent With Client-Based Sessions Returning HTTP 403 Errors When Accessing Protected Resources

IIS web agents configured for client-based sessions will return HTTP 403 errors when trying to access a protected resource if the com.sun.identity.client.notification.url property is configured.

The com.sun.identity.client.notification.url property, used by earlier versions of the web agents to specify the notification listener for the agent, is not used or required anymore. However, to provide backwards-compatibility with earlier versions of the agents, AM populates this property when creating the agent profile.

The value of this property should removed for all web agents installations, and must be removed for IIS web agents configured for client-based sessions.

Default Welcome Page Showing After Upgrade Instead of Custom Error Pages

After upgrading, you may see the default Apache welcome pages instead of custom error pages defined by the Apache ErrorDocument directive.

If you encounter this issue, check your Apache ErrorDocument configuration. If the custom error pages are not in the document root of the Apache server, you should enclose the ErrorDocument directives in Directory elements. For example:

<Directory "/web/docs">
   ErrorDocument 403 myCustom403Error.html
</Directory>

Refer to the Apache documentation for more details on the ErrorDocument directive.

CA Certificate File Name Property not Honored when Client Authentication is not Required in Secure Channel Environments

If you are using the Windows built-in Secure Channel API but your environment does not require client authentication, instead of setting the CA certificate friendly name in the CA Certificate File Name Property, set it in the Public Client Certificate File Name property. For example:

com.forgerock.agents.config.cert.ca.file =
com.forgerock.agents.config.cert.file = CA-cert-friendly-name
com.sun.identity.agents.config.trust.server.certs = false

Install IIS Web Agents on Child Applications Before Installing in Parent Application

In an IIS environment where you need to protect a parent application and a child application with different web agent configurations, you must install the web agent on the child application before installing the web agent in the parent. Trying to install a web agent on a child that is already protected will result in error.

AMAGENTS-2732: com.sun.identity.agents.config.login.url property is no longer ignored

AMAGENTS-2813: Agents Logout perform logout multiple times

AMAGENTS-3493: Custom login redirection add original_request_url parameter which is not used

AMAGENTS-3506: If there are permissions issues with password file with installation on IIS then the log messages are not helpful

AMAGENTS-3510: system_0.log logging loop process_dead(): unable to verify liveness of rw lock process n (error 1)

AMAGENTS-3567: With the Policy Cache Mode for the Web Agents there is a plugin which if used could mean that policy cache does not work

AMAGENTS-3629: Rename references from OpenAM to AM

AMAGENTS-3663: Nginx Agent print absolute build path into debug logs