OpenAM Administration Guide---笔记(2)

本来打算明把这本书看完的，果然flag不能随便立，往url里加入userId的目标基本达成，但是出现了安全性问题，当把userid用cookie从apache传给后台后，在apache往浏览器返回时，居然也在cookie中加入了userid，于是当浏览器再次访问时，浏览器本身带的cookie中的userid竟然没有删除，于是在java后台中发现cookie中有两个userid，造成了后台的安全隐患。
解决办法也有，因为java后台的过滤器中，第一次获取时，userid是从apache传过来的，所以只有一个userid参数，之后，把userid设置到session中，当后台session没超时，那么后台不必取cookies中的userid，所以无效考虑此情况。当后台的session超时之后，但是openAM还没超时，此时，apapche传来的cookie中，userid有两个，所以，在后台中，如果发现多个userid，那么验证每一个userid的值，如果相同，那么合法，如果不相同，那么直接跳回错误页面。当openAM超时后，浏览器中的tokenid已失效，此情况无需考虑。
解决方法二，因为apache每次访问后台时，都是把userId插入到最前端（一般情况是这样，有待验证），那么只要取第一个userid就好，
当然，这种方法太low，为了高大上的解决这个问题，我得往后跳章节查阅了。
Chapter 5 Configuring Policy Agent Profiles
简介：你可能会安装多个代理，这章描述了如何用openAM配置各个代理的配置文件。
You install policy agents in web servers and web application containers to
enforce access policies OpenAM applies to protected web sites and web
applications. Policy agents depend on OpenAM for all authentication and
authorization decisions. Their primary responsibility consists of enforcing what
OpenAM decides in a way that is unobtrusive to the user. In organizations with
many servers, you might well install many policy agents.
Policy agents can have local configurations where they are installed. Typically,
you store all policy agent configuration information in the OpenAM configuration
store, defining policy agent profiles for each, and then you let the policy agents
access their profiles through OpenAM. In this way, you manage all agent
configuration changes centrally. This chapter describes how to set up policy
agent profiles in OpenAM for centralized configuration.

5.5 Configuring Web Policy Agent Properties
When you create a web policy agent profile and install the agent, you can choose
to store the agent configuration centrally and configure the agent through
OpenAM console. Alternatively, you can choose to store the agent configuration
locally and configure the agent by changing values in the properties file. For
information on the properties used in a centralized configuration, and the
corresponding properties for use in a local configuration file where applicable,
*see Configuring Web Policy Agent Properties in the OpenAM Web Policy Agent
User’s Guide.*
啥也不说了，让我跳到OpenAM Web Policy Agent User’s Guide这本书。