Novell Doc: Novell Access Manager 3.0 SP4 Agent Guide - Using the J2EE Server to Enforce Authorization

6.1 Using the J2EE Server to Enforce Authorization

The following sections explain how to configure Access Manager to use the authorization policies of the J2EE server.

Deploy the sample payroll application on your J2EE server.

The location of the sample application is platform-specific:
- On a Linux J2EE server, the application is copied to the /opt/novell/nids_agents/example directory.
- On a Windows J2EE server, the application is copied to the <Install_Directory>\sampleapp directory.
On your J2EE server, prepare the application to use the agent for login and logout. (See Section 3.1, Preparing the Application for the Agent).

These steps have already been performed for the sample application. See the web.xml file in the application’s WEB-INF directory.
Complete any platform-specific configuration:
- JBoss: These tasks have already been performed for JBoss. To understand what was modified, see Section 3.2, Configuring Applications on the JBoss Server.
- WebSphere: You need to configure the RunAs Roles feature. See Section 3.3.2, Configuring for RunAs Roles.
- WebLogic: You need to configure the RunAs Roles feature. See Section 3.4, Configuring Applications on the WebLogic Server.
In Access Manager, create two Role policies: an Employee role and a Manager role. See Section 6.2.1, Creating an Employee Role and a Manager Role for one way to create these roles, and see Employee Role and Manager Role in the Novell Access Manager 3.0 SP4 Administration Guide for another way.
Configure the agent for authentication, if you haven’t done so already. See Section 2.0, Configuring the Agent for Authentication.
Make sure that the Enforce application server policy option is selected. In the Administration Console, click Access Manager > J2EE Agents > Edit.
To test this configuration, send the following request from a browser:
```
http://<Application_Server_DNS_Name>:<port>/payroll 
```
Replace <Application_Server_DNS_Name> with the DNS name or the IP address of your application server. Replace <port> with the port number you have configured the J2EE Agent to use.
Log in as a user who matches the condition to receive the Employee role and access the My Page and the Manager Page.
Log out and log in as a user who matches the condition to receive the Manager role. Access the My Page and the Manager Page.

As a manager you can add Employee Records. Then when employees log in, their records are displayed on My Page.