AM Fun

remote-auth.dtd specifies the authentication
protcols between client and server

(1) Should customized app SSOTokenListener
do the AuthContext clean up for AM in case of
SSO timeout and destroy events or AM instance
does the work

(2) if we communicate with /amserver/authservice
and follow the remote-auth.dtd, how to deal with
encided ir encrypted data such as if we
succeeded for the authentication. I mean without
SDK

(3) AM group only for policy now. Does not with services

(4) readm service schema change, for instance load
customized login module, sample does not work

This impacts the loginModule and post authentication registration
to realm, policy etc.

Extended Accounting and DTrace

The current challenge is how to provide the billing
strategy. Each customer will be operating in it's own Solaris
Container, but there is no obvious way to measure the utilisation by
container.

DTRACE is the obvious choice to enable the customer
to create such a billing infrastructure. Simple calculation of the number of CPU-Seconds and read/write IO's by container over a period of time is the desired result.

The uts core exacct usage and recording routines(exacct) and associated
D fbt probes (fbt:genunix::entry) requires getacct(2), putacct(2), and
wracct(2) system calls which is on top of exacctsys to trap into kernel
instead of call back.

Specifically, the fbt provider will do the work
to probe the uts structure such as proc_usage_t,task_usage_t
and flow_usage_t.

programmtically login

(1) From AuthContext

new AuthContext("orgname").login("authtype.indextype","auth name");


(2) token vaildation for login request


(3) From service point of view without API

http://:/authservice

But it requires remote-auth.dtd

programmtically logout

AM Authentication service and session mgt does provide
the logout

(1) From SSO session management API


SSOTokenManager.destroy(token)


(2) From Authentication Context State Mgt API

To clean up all authentication state management infor
AuthContext(token).logout()

(3) Service point of view

http://:/amserver/Logout

Post Authentication and AM previliged query user ? amadmin or proxy account

Writing a Post Authentication class for a customer with AM 7.0
I need to obtain an admin-level connection to AMStore to
manipulate AMUser object instances. To reuse existing AM SDK
configuration files to get the amadmin dn and password,
instead of providing my own config file.

How to programmatically get the amadmin DN and password ?
DN is easy to retrieve in AMConfig.properties. But what
about password ? Is there a public or private API for doing this ?

Although you can get the user name and password and generate the admin SSOToken,
the recommended way to get the admin SSOToken is as follows:

SSOToken token = (SSOToken) AccessController.doPrivileged(
com.sun.identity.security.AdminTokenAction.getInstance());


However why not to have API for proxy authentication and authorization instead of
querying amadmin identity for identity management ?

Need Answer

Writing a Post Authentication class for a customer with AM 7.0
I need to obtain an admin-level connection to AMStore to
manipulate AMUser object instances. To reuse existing AM SDK
configuration files to get the amadmin dn and password,
instead of providing my own config file.

How to programmatically get the amadmin DN and password ?
DN is easy to retrieve in AMConfig.properties. But what
about password ? Is there a public or private API for doing this ?

Although you can get the user name and password and generate the admin SSOToken,
the recommended way to get the admin SSOToken is as follows:

SSOToken token = (SSOToken) AccessController.doPrivileged(
com.sun.identity.security.AdminTokenAction.getInstance());


However why not to have API for proxy authentication and authorization instead of
querying amadmin identity for identity management ?

Need Answer

ndd(1M) and uts network driver link speed

ndd(1M) does support uts implementation for

hme(7D), bge(7D), dmfg(7D), eri(7D), rge

Besides functions defined to support ndd(1M),
there are variables are defined to use for
configuring link-operation for all the above
interfaces in the system. These parameters
may be changed per interface using ndd (1M)

However, only rge and bge does create kstats(1M)
corresponding functions and structures to
NDD parameters.

Evenmore, all these parameters may also be specified
as properties using the .conf file mechanism f
or each interface.

Therefore, for e1000g(7D) interface


/kernel/drv/e1000g.conf

32–bit driver configuration file.
/kernel/drv/sparcv9/e1000g

SPARC e1000g driver binary.
/kernel/drv/amd64/e1000g

64-bit x86 e1000g driver binary.
/kernel/drv/e1000g

32-bit x86 e1000g driver binary.


For e1000g(7D)

kernel/drv/e1000g.conf

32–bit driver configuration file.
/kernel/drv/sparcv9/e1000g

SPARC e1000g driver binary.
/kernel/drv/amd64/e1000g

64-bit x86 e1000g driver binary.
/kernel/drv/e1000g

32-bit x86 e1000g driver binary.

Grid Resource Discovery

Query the distributed state of the Grid and identify the resource characteristics and state matching the selection

Determine the distribute resource state

Seperate the resource discovery and resource allocation

Grid Resource Management

Resource Mgt is mutual agreement between a resource provider and a resource consumer
by provider agrees to supply caps for a specific task on half of consumer

What, How , When,

via a specialized QoS interface

(1) Task Submission: What task to do

Commit to to perform but
not Commit when, how and what other works

(2) Workload Mgt: How task to be done

Commit to a agreement of QoS by Provisioning
(3) On Demand Accessing: Advanced Reservation

(4) Coscheduling: make resource available by co-ordinatingm on-demand requirement


(5) Resource Brokering:

AM7 role management

(1) Static Role Creation






PUBLIC "-//iPlanet//Sun Java System Access Manager 2005Q4 Admin CLI DTD//EN"
"jar://com/iplanet/am/admin/cli/amAdmin.dtd"
>










(2) create filtered role







PUBLIC "-//iPlanet//Sun Java System Access Manager 2005Q4 Admin CLI DTD//EN"
"jar://com/iplanet/am/admin/cli/amAdmin.dtd"
>








(|(objectclass=inetOrgPerson)(uid=*))





(2) Realm Role Service Registration







PUBLIC "-//iPlanet//Sun Java System Access Manager 2005Q4 Admin CLI
DTD//EN"
"jar://com/iplanet/am/admin/cli/amAdmin.dtd"
>





iceName="iPlanetAMSessionService" >


125



35




3



5






(3) add user to role






PUBLIC "-//iPlanet//Sun Java System Access Manager 2005Q4 Admin CLI DTD//EN"
"jar://com/iplanet/am/admin/cli/amAdmin.dtd"
>







uid=ituser1,ou=people,dc=jesswitch,dc=com





(1) user service registration to role






PUBLIC "-//iPlanet//Sun Java System Access Manager 2005Q4 Admin CLI DTD//EN"
"jar://com/iplanet/am/admin/cli/amAdmin.dtd"
>









en_US



PST




en



Active







(2) admin service to realm role







PUBLIC "-//iPlanet//Sun Java System Access Manager 2005Q4 Admin CLI DTD//EN"
"jar://com/iplanet/am/admin/cli/amAdmin.dtd"
>









false



5




100



25






(2) assign auth config service to realm






PUBLIC "-//iPlanet//Sun Java System Access Manager 2005Q4 Admin CLI DTD//EN"
"jar://com/iplanet/am/admin/cli/amAdmin.dtd"
>





"iPlanetAMAuthConfiguration" >



ldapService






(3) assign disco service to realm role






PUBLIC "-//iPlanet//Sun Java System Access Manager 2005Q4 Admin CLI DTD//EN"
"jar://com/iplanet/am/admin/cli/amAdmin.dtd"
>





"sunIdentityServerDiscoveryService" >






(8) service registration, there will no diff from
static role and filtered role.







PUBLIC "-//iPlanet//Sun Java System Access Manager 2005Q4 Admin CLI DTD//EN"
"jar://com/iplanet/am/admin/cli/amAdmin.dtd"
>








125



35




3



5

amadmin realm role service registration

(1) Case Sensitiveness may need to be enforced
by underline IdRepo instead of AM layer

Not iplanetAMSessionService but iPlanetAMSessionService

(2) There may be one bug in the code for sub realm role service
registration. If the service is not registered under
the sub-realm, the service registration to the role
under the sub realm will show no error from amadmin
console and amadmin.error log.
(3) There may be another bug is that the amadmin writes
to the IdRepo and creates the role based CoS template
for the service registration.


But the corrected thing is that the service should be
registered under realm before the service is registered
under the role. The good thing is that both amadmin.error
and amadmin console output can be used to troubleshooting




>



>>
>>
>>
>>
>>
>>
>> >> PUBLIC "-//iPlanet//Sun Java System Access Manager 2005Q4 Admin CLI
>> DTD//EN"
>> "jar://com/iplanet/am/admin/cli/amAdmin.dtd"
>> >
>>
>>
>>
>>
>>
>> >> iceName="iPlanetAMSessionService" >
>>
>>
>> 125
>>
>>
>>
>> 35
>>
>>
>>
>>
>> 3
>>
>>
>>
>> 5
>>
>>
>>
>>
>>
>> (2) amadmin error output
>> # /opt/SUNWam/bin/amadmin --runasdn amadmin --verbose --password ll51>
>> Info 107: Calling XML PARSER
>> Info 108: XML file to parse:jesswitchAssignSessionServiceToRealmRole.xml
>> Info 101: Processing jesswitchAssignSessionServiceToRealmRole.xml
>> Info 111: Requests generated by amadmin
>> Request Description: Assign Service to Identity in Realm /itrealm
>> iplanet-am-session-max-idle-time =
>> 35
>> iplanet-am-session-max-session-time =
>> 125
>> iplanet-am-session-quota-limit =
>> 5
>> iplanet-am-session-max-caching-time =
>> 3
>>
>> Identity Request:
>> Assign Service iplanetAMSessionService to itrole of IdType: role in
>> Realm /itrealm
>> iplanet-am-session-max-idle-time = [35]
>> iplanet-am-session-max-session-time = [125]
>> iplanet-am-session-quota-limit = [5]
>> iplanet-am-session-max-caching-time = [3]
>> Error 10: Cannot process requests:
>> Service iplanetAMSessionService not registered.
>>
>>
>> (3) amadmin.error log
>>
>> mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm"2006-02-09
>> 21:22:06" "IdentityRequests|Service iplanetAMSessionService not
>> registered." amAdmin.error AMADMIN-2
>> dc=jesswitch,dc=com "Not Available" INFO
>> "cn=dsameuser,ou=DSAME Users,dc=jesswitch,dc=com"
>> 10.6.137.48 "cn=dsameuser,ou=DSAME
>> Users,dc=jesswitch,dc=com" v1280-137-08 "2006-02-09
>> 21:22:06" "Error 10: Cannot process requests:
>> com.iplanet.am.admin.cli.AdminException: Service
>> iplanetAMSessionService not registered." amAdmin.error "Not
>> Available" dc=jesswitch,dc=com "Not Available" INFO
>> "cn=dsameuser,ou=DSAME Users,dc=jesswitch,dc=com"
>> 10.6.137.48 "cn=dsameuser,ou=DSAME
>> Users,dc=jesswitch,dc=com" 10.6.137.48
>>


--


Lei Liu (Larry)
Member of Technical Staff
Horizontal Technology
Software MAX
Mailstop: UNWK 12-209
Address: 7777 Gateway Boulevard, Bldg 12 Newark, CA 94560
Phone: (510) 574-7187 (x37187)
Email: lei.liu@sun.com, ttoulliu2002@gmail.com
Fax: (510) 574-6074
Blog:http://ttoulliu2002.blogspot.com
Skype: ttoulliu2002

Dennis:

Thanks for the reply. Hope you do not mind if
I have questions below for you.

(1) Case Sensitiveness may need to be enforced
by underline IdRepo instead of AM layer
(2) There may be one bug in the code for sub realm role service
registration. If the service is not registered under
the sub-realm, the service registration to the role
under the sub realm will show no error from amadmin
console and amadmin.error log.
(3) There may be another bug is that the amadmin writes
to the IdRepo and creates the role based CoS template
for the service registration.

Thanks

Lei



Dennis Seah wrote:

> in your XML, can you replace iplanetAMSessionService
> with iPlanetAMSessionService
>
> and try again?
>
> THANK YOU !
>
>
> Lei Liu wrote:
>
>> Hi:
>>
>> I have amadmin data file below for service registration.
>> I have the session service registered under sub realm.
>> But it can not be registered for the sub realm role.
>>
>>
>> (1) It does not work. amAdmin error is attached too.
>>
>>
>>
>>
>>
>>
>> >> PUBLIC "-//iPlanet//Sun Java System Access Manager 2005Q4 Admin CLI
>> DTD//EN"
>> "jar://com/iplanet/am/admin/cli/amAdmin.dtd"
>> >
>>
>>
>>
>>
>>
>> >> iceName="iplanetAMSessionService" >
>>
>>
>> 125
>>
>>
>>
>> 35
>>
>>
>>
>>
>> 3
>>
>>
>>
>> 5
>>
>>
>>
>>
>>
>> (2) amadmin error output
>> # /opt/SUNWam/bin/amadmin --runasdn amadmin --verbose --password ll51>
>> Info 107: Calling XML PARSER
>> Info 108: XML file to parse:jesswitchAssignSessionServiceToRealmRole.xml
>> Info 101: Processing jesswitchAssignSessionServiceToRealmRole.xml
>> Info 111: Requests generated by amadmin
>> Request Description: Assign Service to Identity in Realm /itrealm
>> iplanet-am-session-max-idle-time =
>> 35
>> iplanet-am-session-max-session-time =
>> 125
>> iplanet-am-session-quota-limit =
>> 5
>> iplanet-am-session-max-caching-time =
>> 3
>>
>> Identity Request:
>> Assign Service iplanetAMSessionService to itrole of IdType: role in Realm /itrealm
>> iplanet-am-session-max-idle-time = [35]
>> iplanet-am-session-max-session-time = [125]
>> iplanet-am-session-quota-limit = [5]
>> iplanet-am-session-max-caching-time = [3]
>> Error 10: Cannot process requests:
>> Service iplanetAMSessionService not registered.
>>
>>
>> (3) amadmin.error log
>>
>> mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm"2006-02-09 21:22:06" "IdentityRequests|Service iplanetAMSessionService not registered." amAdmin.error AMADMIN-2 dc=jesswitch,dc=com "Not Available" INFO "cn=dsameuser,ou=DSAME Users,dc=jesswitch,dc=com" 10.6.137.48 "cn=dsameuser,ou=DSAME Users,dc=jesswitch,dc=com" v1280-137-08 "2006-02-09 21:22:06" "Error 10: Cannot process requests: com.iplanet.am.admin.cli.AdminException: Service iplanetAMSessionService not registered." amAdmin.error "Not Available" dc=jesswitch,dc=com "Not Available" INFO "cn=dsameuser,ou=DSAME Users,dc=jesswitch,dc=com" 10.6.137.48 "cn=dsameuser,ou=DSAME Users,dc=jesswitch,dc=com" 10.6.137.48
>>

prsadm on Niagara platforms

For processor resource management, better practice would be
applying SRM model to create processor pool in order to better
control the resource. S10 kernel abstracts the platform specifics
which it should be transparent to user land and system mangement.





> > our psradm -n/-f commands are woefully inadequate ... someone needs to
> > expand them to include simple things like ranges "psradm -f 1..15",
> > "psradm -f 1..3 5..7 9..11 13..15" ... this would make up for a lot
> > of the nuisance of these tools with large numbers of virtual
> > processors
>
> psradm has ranges. Try "psradm -f 1-31" on a Niagara.

Java EE and .Net

There several important messages draw for the survey data

(1) It seems the top 2 driven factors which has dramatic impact of the success
of both Java and Enterprise Java:

Th success of the conventional RDBMS
The success of Traditional Internet Computing Model

(2) A big attention to Java EE connector and JMS which indicates
catch less than 40% usage. Event worse for WS-technology.
In addition, Java Messaging Model was not compelling againist
.Net


It indicates Enterprise Java is still considered as traditional
multi-tiered application development technology. There is still
a chance to loose the leadership from integration point of view which
could result in further slip in the multi-tiered application domain itself.
Microsoft owns large market share in integration domains. This
also count in IBM's mainframe integration strategy.


(3) How to maintain the endorsement on Java EE from RDBMS vendors ?
How to keep the hype on the Internet Computing Model and Deliver
highly performed platforms to the Internet world ?
How to get market share from WS and Integration domain ?

is where could be the turning point for Java and Enterprise Java Technology.

Autonomous Policy Neogotiations

With the autonomy of the policy negotiation, it requires one participant
to understand access control requirements restricted by counter party.
Therefore, there is an interactive process of policy disclosure underneath.
However, the mutual trust limits by the sensitive of the policy to
authorized disclosure which includes public and private ones as asset of
the parties needs to be protected as common resource. The policy expression
would require more flexibilities for the policy automation management. This
includes the authorization and obligation policies. There are also high level
abstract human readable policies and low level detailed machine readable policies.


In addition, service consumer and provider do not have existing relationship on
the policy constraints as the protected resources are initially accessed.
It means it requires a discovery scheme for policy negotiation to be
initiated.


Moreover, traditional CA signed certificate based disclosure requires third party
authorities for establish the trust. In order to eliminate the external
dependencies, the designated policy agreement is to built on a robust bilateral
negotiation protocol with finer grained control over the separated sequence
of actions to incrementally solving the coalition which results in partial
acceptance and counter offers. It should cover both explicit and constructive
negotiation use cases.


Furthermore, traditional access control does requires
user registration with predefined access control policies to local PDP
and identity is authorized by SP which may protected by different PDPs.
Therefore, traditional centralized identity management approaches give less or zero
negotiation for service consumer privacy polices. Even it address the
common needs of enterprise computing but it is less sufficient to
policy simplification and co-ordinating across multiple PDPs. More important,
for those entities without existing relationship, access control does not
applied to identity. In general, we need to define the protocol for
conjunct policy agreements not only for service providers but also consumers.


In spite of the above considerations, a wide range of mobile devices
gradually become popular consumer service accessing apparatus. However,
with the relative limited processing power and memory space on the mobile
client devices, the zero-less overheated elite policy management entities
are demanded to represent the each party for handshaking. Due to the nature
of wireless transport and readability of the data transferring, the accuracy of the
data communications is one of the concerns. Hence, the efficient, reliable
and secured protocol is demanded for the broad based mobile communication
service provider and consumer trust authorization and access control with
policy negotiation.


On the another hand, different hardware, software and device vendors provide
different hardware platform architecture, operating environments from OS kernel,
programming platforms to device drivers. This requires a cross platform policy
negotiation framework employed with industrial standards. However, it means
heavy loaded enterprise policy languages and standards should be translated
to cater to the wide range of usage.

In the large distributed computing environment, administrative policies
are created and persistented in different policy repositories.
Policy conflicts arised from the conflicted requirements or errors.
And constraint satisfaction are the normal scenoior during the real work policy
negotiation.It is up to a proper protocol of disagreement solving to refine
the agreement in order to derive the conclusion to grant or deny the requests.

Even more, with the shift of the computing paradigm from traditional
hosting computation to usage based utility computing such as grid computing,
the policy negotiation does not depends on service consumer and provider but also
the dynamic usage of the resources. In addition the content applied to policies
could be generated at run time. It requires the policy management should be
dynamic replaceable and enabled. In addition, in the open distributed systems,
there is no security domain to applied without existing relationship. This
includes the release of both known resources and dynamic generated resources.



In general, an automous policy negotiation utility in purpose of an adaptive
policy automation management framework is proposed for a serial inventions
and publications with a blueprint of specific interoperability with efficient,
portable and reliable protocol for policy discovery, policy and credential delivery,
lightweight policy presentation footprint,policy automated component and entities,
policy protection, conflict detection and resolution (both specification time
and run time),constraint meta policy,policy prioritization, policy decomposition,
failure handling, industry standard integration,dynamic policy computation,dynamic
content classification, policy mapping, policy verification and policy analyzer.

cpu time for page fault, the modified page numbers

MMU page fault exception does address major, minor and protection
faults as it requires interrupted in order for a process to
trap in kernel. DTrace built-in probe offers a high level overview
on the latency and count metrics such as maj_fault probe, as_fault probe.
If you want to aggregate the all latency caused by page in not only because of
page fault, try pagin probe.

However, if you want have grained level instrumentation, Please consider
instrument unix module function calls such as pagefault entry, as_fault_* entry,
anon_map_privatepages,anon_private etc. and also segement driver fault in case.
Dtrace fbt provider does address the need.

Performance Counter and Core

Since SPARC III, HW counter, High resoluation timer and virtual clock address the most
efficient to deliver the most accurate performance data. However, it will be a major limitation
to access performance within NG-Zone with the introduction of the S10 container technology.
Therefore, the traditional counter approach may be challenged by the latest virtualization and
partition service requirements.

However, system monitoring is driven by serveral major factors:
status check, performance tunning, debugging and troubleshooting

Majority system management is not required by debugging and tunning level performance resolutions.

In addition, all HW counter requires kernel based accessing. libcpc(3LIB) is one of the performance coutner library for uts cpu_t structure. The same issues as libkstat(3LIB), cpustat(1M) , cputrack(1M) CLI call routines and realetd user land structure associated with chip_id, cpuid, status which lacks of core support. Moreover, the same libkstat(3LIB) kstat_data_lookup for kstat_t and kstat_named_t are required to be handled.

I could not see the major gain for libcpc(3LIB) either in terms of the limitation of performance counter,core support, and dependency on libkstat(3LIB).

Just for sharing, libkstat(3LIB) requires execute Kernel
static library call routines as /on/usr/src/cmd to
open /dev/kstat and kstat_lookup to uses existing
common user land kstat_t strcutre Afterwards,
kstat_data_lookup should be invoked to downcast
to kstat_named_t in order to retrieve the exported
templated cpu_info structure for "core_id" and
KSTAT_DATA_LONE value.

It just reinvent the same call routines as any (1M) CLI at user
lande. I did not see any value of doing so. In addition, HP and
BMC will have their own user lander structure and object model
to abstract and management objects.

The major work for HP OV and BMC patrol should focus on is to
design the object class to redegin the object model for MIB II
in order to fit the architecture needs.

realm and services

AM does have CoS role based template services are global services which across
different realms such as user, session and discovery services

However, amadmin console service, policy configuration, globalization and password reset service are realm specific services

System Boot

(1) bootstrap code is stored in firmware ROM and EPROM.
(2) bootstrap runs post test and run a bit code to read
a single block at a fix location (block 0, boot sector)
from disk into memory and begin it's execute the code
from boot block.
this code is very simple only lnow the addresas on disk
and length of reminder of the bootstrap program
(4) full bootstrap, it will traverse the file system to find
the OS kernel, load it into memory and start it's execution

Virtualization

It is to mitigate workload management problems by reintroducing a single co-hesive system view onto the distributed IT infrastructure

(1) it is more than just LB
(2) Trends of applications and infrastructure
a. Serial apps: openMP, MainFrames, DAS
b. Client server: Java EE, open system, DAS
c. P2P, reliable messaging, Cluster, DAS
d. service virtualization service registration, discovery, Grid
(3) In SV, applications are encapsulated as services, distributed framwork to disseminate the work across service instances. It allows developers to assemble
building blocks from different application domains
SV decouples apps from HW
(4) In IV, is to infrastrcure to deliver JIT compute and storage capacity
automation, finer control at end-user service level-- utility

amadmin.template vs amadmin on AM7

On a fresh deployed AM instance
I could not find amadmin shell
but only found amadmin.template
What can cause the issue ? wrong
deployment ?