Configuring the agent file

The agent file (.agent) contains the details of the IdP (SAE) and non-SAML/OIDC web applications. Configuring the agent file requires:

1. Obtaining values for the agent file
2. Updating the agent file

Obtaining values for the agent file

Before configuring the agent file, you must obtain certain values. Perform the following steps:

1. Go to the administrator console of your SAE instance.

2. In the left pane, under Configure, click Realm settings, and then in the right pane, on the General tab, perform the following steps:

   1. Copy the Realm ID field's value and paste it in a text editor.

   2. In the Endpoints field, click OpenID Endpoint Configuration. A new window opens. Copy the Issuer URL and save it in a text editor for future use.

   

   Figure: SAE Realm settings — click OpenID Endpoint Configuration to retrieve the Issuer URL.

   For example:

   "IssuerUrl":"https://your-sae-url/realms/your-realm-name"

3. In the left pane, click Clients, and copy the Client ID (for example, PCE_WLA) of the client that you have created earlier. Paste the value in the text editor.

   

   Figure: SAE Clients list — copy the Client ID of the previously created client.

Updating the agent file

Perform the following steps to update the sample .agent file, Passwordless_UCA_FIDO.agent, available in the downloaded Windows Logon package:

1. Open the Passwordless_UCA_FIDO.agent file in any text editor such as Notepad++.

2. In FriendlyName, enter a friendly name (for example, Windows Logon SASPCE_PWD).

3. In TenantCode, enter your organization's SAS PCE virtual server name.

   "TenantCode":"SASPCETenantCode"

   For example, in the below sample, DIS-Auth is the name of the virtual server.

4. In IssuerUrl, paste the Issuer URL as obtained in Step 2 (b) of the Obtaining values for the agent file section.

   "IssuerUrl":"https://your-sae-url/realms/your-realm-name"

5. In ClientId, paste the Client ID as obtained in Step 3 of the Obtaining values for the agent file section.

   "ClientId":"PCE_WLA"

6. Replace the value of PrivateKey with the key you retrieved in Step 3 of Generating a private key and selecting the credentials type for the client.

   For Passwordless configuration only (steps 7–10):

7. Replace the value of RedirectUrl with http://localhost/, which is used for accessing Windows Logon.

   "RedirectUrl":"http://localhost/"

8. In ScepRequestUri, specify the URL where the SCEP service is installed, for example, https://<FQDN>/certsrv/mscep/mscep.dll

9. In EnrollmentWindow, ensure that the value is set to 10, which specifies the number of days in which the user can enroll for the logon certificate.

   "EnrollmentWindow":"10"

10. In RenewalWindow, ensure that the value is set to 21, which specifies the number of days in which the user can re-enroll for the logon certificate.

    "RenewalWindow":"21"

    For UCA and FIDO configuration only (step 11):

11. In AuthenticatorsUrl, specify the URL of the deployed Authentication Service.

12. Save the Passwordless_UCA_FIDO.agent file.

Now, the updated .agent file will look like: