Web Agent configuration reference

This page lists the directives of the SSOGEN Web Agent (the Apache module mod_ssogen), grouped by what you want to achieve. Use it when you need to change something the generated configuration does not set. For the installation itself, the agent key and the first sign-in, follow Protect an on-premise app with the Web Agent.

The examples use the fictional company Acme Corp, with SSOGEN at https://sso.acme.example and an application at https://ebs.acme.example.

Start from the generated configuration

The Admin Console writes the configuration block for each application on its Integration page. Paste that block first. Add a directive from this page only when you need the behavior it describes.

1. Rules that apply to every directive

Rule	What it means for you
Where a directive may stand	SSOGENProtection may stand at server level, in a <VirtualHost>, in <Directory> and in <Location>. Every other directive stands at server level or in a <VirtualHost> only, and is rejected inside <Location>, <Directory> and .htaccess.
No inheritance	A <VirtualHost> that has any SSOGEN directive of its own takes nothing from the main server. Write every directive inside each virtual host that uses it. The one exception is SSOGENLicenseKey: a virtual host without its own key uses the main server’s.
A virtual host with no SSOGEN directive	It shares the main server’s settings, all of them, as the same application. Each start says so in the error log for every such virtual host.
One application per virtual host	A virtual host is one application.
Repeating a directive	The last one wins. Only SSOGENLogoutEndpoint, SSOGENAttributeMap and SSOGENPublicKey add up when repeated.
Names	Directive names are not case-sensitive.
Files	A file a directive names is read when Apache starts. A relative path is relative to ServerRoot. A missing or empty file, or one larger than 64 KiB, fails apachectl configtest. After you change such a file, restart gracefully.
When a value is checked	Most addresses and paths are stored as written and checked at the first sign-in: a wrong value shows as HTTP 503 then, not as a configtest error.

After every change, test and restart gracefully:

apachectl configtest
apachectl graceful

On Oracle HTTP Server use the commands of your release, as shown in Protect an on-premise app with the Web Agent.

2. Connect the site to SSOGEN

Directive	Values	Default	What it does
SSOGENMode	ssogen, saml or oidc	ssogen	How the site signs people in. ssogen: through your SSOGEN. saml and oidc: directly against an identity provider (sections 10 to 12). It must be written out whenever the virtual host holds a directive whose name contains Saml or Oidc.
SSOGENServerURL	https://host[:port]	none	SSOGEN’s address. Required. Write it exactly as SSOGEN names itself: upper and lower case and the port count; a trailing slash is ignored.
SSOGENClientURL	https://host[:port]	none	The address browsers use for this site: scheme, host and port, no path. Set it explicitly; behind a load balancer ServerName is often not what browsers use.
SSOGENClientId	text	none	The client ID SSOGEN registered for this application. Required.
SSOGENAgentKey	ssogen_ak_ followed by 43 characters	none	The application’s agent key, from Generate agent key on the Integration page. It is shown once. One key per application, the same on every web server of that application.
SSOGENAgentKeyFile	file	none	The agent key read from a file instead. The file holds the key on one line and must be readable by its owner only (chmod 0600). Use one of SSOGENAgentKey and SSOGENAgentKeyFile, not both.
SSOGENRedirectURI	https://…	SSOGENClientURL + SSOGENCallbackPath	The redirect address registered in SSOGEN, normally https://<site>/ssogen/callback. Set it only if the registered address differs from the default.
SSOGENCallbackPath	path	/ssogen/callback	The path part of the redirect address. The agent answers only on /ssogen/callback: leave it unchanged.

<VirtualHost *:443>
    ServerName ebs.acme.example
    SSOGENServerURL https://sso.acme.example
    SSOGENClientURL https://ebs.acme.example
    SSOGENClientId  <client id from the Integration page>
    SSOGENAgentKeyFile /etc/httpd/ssogen/agent.key
</VirtualHost>

apachectl configtest refuses the placeholder <agent-key>, a value that does not have the shape of an agent key, a key file other users can read, and a second key directive. It never prints the key.

3. Choose what is protected

Directive	Values	Default	What it does
SSOGENProtection	on, optional or off	off	on: sign-in is required. optional: the signed-in person is passed to the application when there is a valid session, and the page is served either way. off: no sign-in. The most specific setting wins, so off inside an on area lets that path out.
SSOGENLoginRedirect	On or Off	not set	What happens to a request that needs sign-in. On: the browser is sent to sign in. Off: the request is answered 401, which suits paths that programs call. Not set: paths under SSOGENProtection on sign in.
SSOGENRequireGrant	On or Off	Off	The older, whole-site form of SSOGENProtection on: every path of the site without its own SSOGENProtection needs sign-in. A site that uses only this form answers 401 unless SSOGENLoginRedirect On is set. Use SSOGENProtection in new configurations.

<Location />
    SSOGENProtection on
</Location>
<Location /health>
    SSOGENProtection off
</Location>

Apache’s own AuthType SSOGEN with Require valid-user is accepted as another way to write on:

<Location /reports>
    AuthType SSOGEN
    Require valid-user
</Location>

Two things follow from protection:

• On an on or optional path the agent adds Cache-Control: private and Vary: Cookie to the response and tells Apache’s cache not to store it, so one person’s page is never served to another from a cache.
• Loading the module protects nothing. A path is protected only where a setting says so.

4. Sessions

Directive	Values	Default	What it does
SSOGENSessionSecret	text of at least 32 bytes	generated at start	The key that signs the agent’s session cookie. Not set: a random key is created at start; it survives a graceful restart, and a full restart signs everyone out. Set it, with the same value on every server, when several web servers behind a load balancer serve the site without session stickiness, and when the site must be able to start while SSOGEN is unreachable (section 8).
SSOGENSessionMaxDuration	45s, 30m, 12h, 1d, or a number of seconds	12h	How long a session lasts from sign-in. Then the browser signs in again, without a prompt while the person’s SSOGEN session lasts. At most 30 days.
SSOGENSessionIdleTimeout	a duration as above, or off	30m	A session ends after this long without a request. Exact to within a minute. off disables it.
SSOGENSessionCookie	cookie name	__Host-SSOGEN-APP	The name of the session cookie. The cookie is Secure, HttpOnly and SameSite=Lax and has no Domain. Keep the __Host- prefix on an HTTPS site.

Create a session secret with:

openssl rand -base64 32

SSOGENSessionSecret <the 44 characters the command printed>
SSOGENSessionMaxDuration 8h
SSOGENSessionIdleTimeout 20m

The secret must have at least 32 bytes and at least 8 different characters, and must not be a shorter part repeated. A weaker value stops configtest and the start, with a message that names the directive and the rule, never the value. Keep the secret out of version control.

5. Sign-out

Directive	Values	Default	What it does
SSOGENLogoutScope	local or sso	local	What /ssogen/logout ends. local: this application’s session only. sso: also the session the person signed in with (SSOGEN’s, or in the standalone modes the identity provider’s). On shared computers set sso.
SSOGENLogoutRedirectURL	a path, or an https:// address	/ssogen/loggedout	Where /ssogen/logout lands. With sso, the address must be registered where the sign-out goes (SSOGEN or the provider).
SSOGENLogoutEndpoint	an exact path	/accessgate/ssologout.do with SSOGENAppType Oracle; none with generic	The application’s own logout address. When a request arrives there, the agent clears its session and lets the request through to the application: no redirect, and the SSOGEN session is not ended. Repeatable.

SSOGENLogoutScope sso
SSOGENLogoutEndpoint /app/logout.do

SSOGENLogoutEndpoint takes an absolute path with no query and no fragment. The match is exact, ignoring the query string, a ;parameter on a path segment and one trailing /:

Request path	With SSOGENLogoutEndpoint /app/logout.do
/app/logout.do	Matches
/app/logout.do/	Matches
/app/logout.do;jsessionid=...	Matches
/app/logout.dox	Does not match
/app/logout.do/more	Does not match

The effect of each scope, and the caution about a landing page of your own with sso, are in the “Signing out” section of Protect an on-premise app with the Web Agent.

6. The user name and attributes

Directive	Values	Default	What it does
SSOGENAppType	Oracle or generic	Oracle	The kind of application behind the web server: Oracle for Oracle web tiers, generic for any other application. The generated configuration sets it for you.
SSOGENUserNameCase	upper, lower or none	not set	The case of the letters of the user name the application receives. none passes the name exactly as held. Not set: upper case with Oracle, unchanged with generic. Only the letters A to Z change.
SSOGENAttributeMap	source target [First|Join]	none	Standalone modes only (saml, oidc), where the application receives the identity provider’s attributes under their own names: delivers one attribute under the name you choose instead. First (the default) takes the first value, Join joins all values. Repeatable. In ssogen mode it is ignored with a warning: there you choose what the application receives in the Admin Console, under Identity sent to app.
SSOGENAttributeJoinDelimiter	text	;	The separator between the values of an attribute that has several.

SSOGENAppType generic
SSOGENUserNameCase lower
SSOGENAttributeMap department X-Department First
SSOGENAttributeMap groups X-Groups Join
SSOGENAttributeJoinDelimiter ,

Points to know:

• SSOGENUserNameCase is applied on every request, so a change reaches people who are already signed in. Apache’s Require user lines and group files compare the name exactly: write them in the same case.
• SSOGENAttributeMap is rejected when the target is a name the application type already sets, a reserved name, a name that programs read from their environment (such as PATH), or a target used twice.

7. Outbound proxy and certificate trust

The agent calls SSOGEN (and, in the standalone modes, the identity provider) from the web server. These four directives say how.

Directive	Values	Default	What it does
SSOGENHttpProxyURL	http://host:port or https://…	none (direct)	A proxy for all of the agent’s outbound calls. Without it the calls go direct; proxy environment variables are ignored.
SSOGENHttpProxyCredentialsFile	file	none	A file that holds user:password for a proxy that asks for sign-in. The credentials are never logged.
SSOGENHttpNoProxy	hosts, separated by commas	none	Hosts the agent reaches directly, not through the proxy.
SSOGENCACertificateFile	PEM file	the system’s certificate store only	Certificate authorities trusted for the agent’s outbound HTTPS calls in addition to the system store. Use it when SSOGEN’s certificate was issued by your own authority. One or more PEM certificates.

SSOGENHttpProxyURL http://proxy.acme.example:3128
SSOGENHttpProxyCredentialsFile /etc/httpd/ssogen/proxy.cred
SSOGENHttpNoProxy sso.acme.example,localhost
SSOGENCACertificateFile /etc/httpd/ssogen/acme-ca.pem

These settings apply to the whole Apache, not to one virtual host. Set them once at server level, or with identical values in every virtual host that sets them: different values in different virtual hosts are refused at start. The error log confirms what is in use:

ssogen: outbound calls use proxy <url>
ssogen: outbound HTTPS trusts the system CAs and <n> from <file>

A SSOGENCACertificateFile that is missing or holds no certificate fails apachectl configtest.

8. Start while SSOGEN is unreachable

At every start and graceful restart the agent fetches SSOGEN’s signing keys. Without them it cannot check a sign-in.

Situation	What the agent does
A graceful restart cannot reach SSOGEN	It keeps the keys it holds.
A full start cannot reach SSOGEN and saved keys exist	It starts with the saved keys and logs a warning that names the file and its date. Saved keys are accepted for 7 days after they were saved.
A full start cannot reach SSOGEN and there are no usable saved keys	Apache does not start (every virtual host), with a message that begins cannot start: no signing keys from.

The agent saves the keys only when SSOGENSessionSecret is set. A saved copy holds public keys only.

Directive	Values	Default	What it does
SSOGENStateDir	directory	/var/lib/httpd/ssogen when /var/lib/httpd exists; otherwise /var/lib/apache2/ssogen when /var/lib/apache2 exists; otherwise ssogen-state under ServerRoot	Where the saved keys are kept. Server level only: inside a <VirtualHost> it fails configtest. The agent creates the last part of the path itself, with mode 0700, as the user Apache starts as; the directory above it must exist. A directory that is a symbolic link, belongs to another user, or is writable by group or others is not used.
SSOGENPublicKey	<key id> <base64>	none	Advanced. One of SSOGEN’s signing keys written into the configuration, for a site where a full start must succeed while SSOGEN is unreachable and no saved keys exist. Repeatable, one line per key ID. It stops being useful when SSOGEN changes its signing keys.
SSOGENPublicKeyFile	PEM file	none	Advanced. A signing key of SSOGEN as a PEM file.

# Server level, outside every <VirtualHost>
SSOGENStateDir /var/lib/httpd/ssogen

Most sites need none of the three: set SSOGENSessionSecret, start Apache once while SSOGEN is reachable, and the saved keys cover a later outage.

9. Directives you normally leave alone

Directive	Values	Default	What it does
SSOGENExpectedAudience	text	the value of SSOGENClientId	An override. A sign-in is accepted only when SSOGEN issued it for this audience. It is always checked.
SSOGENExpectedAgentId	text	none	When set, a sign-in is accepted only when SSOGEN issued it for this agent ID. Not set: the agent ID is not checked.
SSOGENAgentGroupId	text	none	The agent group SSOGEN registered for this site. With SSOGENServerURL it makes the agent fetch a signed configuration from SSOGEN at each start and graceful restart. Set it only where an SSOGEN guide for a feature tells you to. A site that sets it cannot do a full start while SSOGEN is unreachable.
SSOGENTxnDir, SSOGENConfigStoreDir	directory		No longer used. Both are accepted, with a warning, so that older files load. Nothing is written to the directory.

SSOGENExpectedAudience <audience>

The agent also allows for a clock difference of 120 seconds between the web server and SSOGEN. Keep the web server’s clock synchronized.

10. Standalone modes: the license key

In saml and oidc mode the web server signs people in directly against an identity provider, without SSOGEN in between. Both modes need a standalone license key.

Directive	Values	Default	What it does
SSOGENLicenseKey	your standalone license key	none	Required in saml and oidc mode; the same key serves both. In ssogen mode it is not needed and not checked.

SSOGENLicenseKey <key>

• The key is checked at apachectl configtest, at start and at graceful restart. A running server does not check it again until the next restart.
• Without a key, or with an invalid or expired one, the configuration does not load. The message carries the code SSO-WAG-LIC-001.
• The start-up summary in the error log shows each site’s license as license valid until YYYY-MM-DD (N days), as a warning when fewer than 30 days remain. Renew before that date.
• The key is never written to a log.

11. SAML mode

SSOGENMode saml works with any SAML 2.0 identity provider. The agent sends its request by HTTP-Redirect and receives the response by HTTP-POST at /ssogen/acs. The response or the assertion must be signed; the assertion may be encrypted.

The usual configuration uses two metadata files:

<VirtualHost *:443>
    ServerName app.example.com

    SSOGENMode saml
    SSOGENLicenseKey <key>
    SSOGENSamlIdpMetadataFile  /etc/httpd/ssogen/acme-idp.xml
    SSOGENSamlSpMetadataFile   /etc/httpd/ssogen/acme-sp.xml
    SSOGENSamlSpPrivateKeyFile /etc/httpd/ssogen/acme-sp.key

    <Location />
        SSOGENProtection on
    </Location>
</VirtualHost>

The configuration written by the SSOGEN integration packages for Oracle products carries the two identity-provider lines commented out until you have the provider’s metadata: #SSOGENSamlIdpMetadataFile with the path where the comment above it tells you to save the file, and #SSOGENSamlIdpMetadataURL with an example of a Microsoft Entra ID federation metadata address. Remove the # from one of them, never both. Until one is active, Apache starts and the protected paths answer 503; a line that names a file which does not exist stops Apache from starting.

Write these directives at server level or in the <VirtualHost>. (SSOGENSamlIdpMetadataFile, SSOGENSamlSpMetadataFile and SSOGENSamlSpPrivateKeyFile are also accepted inside a <Location>, so that older configurations load; they apply to the whole site there too.)

The agent must know five things, from the metadata or from the single directives: the provider’s entity ID, its sign-on address and its signing certificate, and this site’s entity ID and ACS address. If one is missing, sign-in answers 503. A single directive always wins over the metadata.

Directive	Values	What it does
SSOGENSamlIdpMetadataFile	file	The identity provider’s metadata. It supplies the entity ID, the sign-on address and every signing certificate; a response signed with any of them is accepted. Read at start and at each graceful restart.
SSOGENSamlIdpMetadataURL	https://…	The same metadata, fetched from the provider. Not together with SSOGENSamlIdpMetadataFile. It is fetched at start through the proxy and certificate settings of section 7. Apache starts even when the address is unreachable: sign-ins answer 503 and the agent retries every 30 seconds. The metadata is fetched again daily, and at once when the provider signs with a certificate the agent does not know.
SSOGENSamlSpMetadataFile	file	This site’s metadata: its entity ID and its ACS address, which must be https://<site>/ssogen/acs. Another path fails configtest.
SSOGENSamlSpPrivateKeyFile	file	This site’s RSA private key (PEM, not encrypted). With it the agent signs its sign-in requests (RSA-SHA256) and decrypts encrypted assertions. Without it, requests are not signed and an encrypted assertion is refused.
SSOGENSamlUserAttribute	attribute name	The attribute of the assertion that names the application user. Default: the NameID. Use it when the provider’s NameID is an internal ID. The attribute must have exactly one value; an assertion without it is refused with 403, and the log lists the attribute names the assertion carried.
SSOGENSamlRequireGcm	On or Off	On: an encrypted assertion must use AES-GCM; AES-CBC is refused with 403. Default Off: AES-CBC is accepted as well. Set On when your provider encrypts with AES-GCM.
SSOGENSamlIdpSloUrl	https://…	The provider’s single logout address (HTTP-Redirect), used with SSOGENLogoutScope sso. Taken from the metadata when not set. Without one, sign-out ends this application’s session only.
SSOGENSamlIdpEntityId	text	The provider’s entity ID. Assertions must be issued by it.
SSOGENSamlIdpSsoUrl	https://…	The provider’s sign-on address.
SSOGENSamlIdpCertFile	PEM file	The provider’s signing certificate.
SSOGENSamlSpEntityId	text	This site’s entity ID. It is also the audience the assertion must name.
SSOGENSamlAcsUrl	https://…	This site’s ACS address, normally https://<site>/ssogen/acs.

The same site without metadata files:

SSOGENMode saml
SSOGENLicenseKey <key>
SSOGENSamlIdpEntityId https://idp.acme.example/saml
SSOGENSamlIdpSsoUrl   https://idp.acme.example/saml/sso
SSOGENSamlIdpSloUrl   https://idp.acme.example/saml/slo
SSOGENSamlIdpCertFile /etc/httpd/ssogen/acme-idp.pem
SSOGENSamlSpEntityId  https://app.example.com
SSOGENSamlAcsUrl      https://app.example.com/ssogen/acs
SSOGENSamlUserAttribute uid
SSOGENSamlRequireGcm  On

What to register at the identity provider:

At the provider	Value
Reply (ACS) address	https://<site>/ssogen/acs
Logout address	https://<site>/ssogen/saml/slo. The provider must sign the logout requests it sends there; an unsigned one is refused.
Relay state, when people start the application from the provider’s portal	A path on the site, such as /app/home. Without it the person lands on /.

Starting the application from the provider’s portal works: the agent starts a sign-in of its own, which the provider completes without a prompt. The agent publishes no SAML metadata of its own.

12. OpenID Connect mode

SSOGENMode oidc works with any standard OpenID provider. The agent uses the authorization code flow with PKCE. The ID token must be signed with RS256, RS384, RS512, PS256, PS384 or PS512.

The usual configuration names the provider’s discovery document:

SSOGENMode oidc
SSOGENLicenseKey <key>
SSOGENOidcProviderMetadataURL https://login.microsoftonline.com/<tenant>/v2.0/.well-known/openid-configuration
SSOGENOidcClientId <application (client) id>
SSOGENOidcClientSecretFile /etc/httpd/ssogen/oidc.secret
SSOGENOidcRedirectUri https://app.example.com/ssogen/oidc/callback
<Location />
    SSOGENProtection on
</Location>

Required: SSOGENOidcClientId, SSOGENOidcRedirectUri, the license key, and either SSOGENOidcProviderMetadataURL or the set SSOGENOidcIssuer, SSOGENOidcAuthorizationEndpoint, SSOGENOidcTokenEndpoint and one of SSOGENOidcJwksUri and SSOGENOidcIdTokenKeyFile. If a piece is missing, sign-in answers 503.

Directive	Values	What it does
SSOGENOidcProviderMetadataURL	https://…/.well-known/openid-configuration	The provider’s discovery document. It supplies the issuer and the provider’s addresses.
SSOGENOidcClientId	text	The client ID registered at the provider.
SSOGENOidcClientSecret	text	The client secret, written in the configuration.
SSOGENOidcClientSecretFile	file	The client secret read from a file at start. Prefer this form. If both are given, the one that comes last is used.
SSOGENOidcRedirectUri	https://…	The redirect address registered at the provider. Its path is always /ssogen/oidc/callback.
SSOGENOidcScope	scopes separated by spaces	What the agent asks the provider for. Default openid profile email. It must contain openid. A narrower scope can remove the claim that SSOGENOidcUserClaim needs.
SSOGENOidcUserClaim	claim name	The claim of the ID token that names the application user. Default preferred_username. Set sub or email for a provider that sends no preferred_username. The claim must be one text value; a token without it is refused with 403, and the log lists the claim names the token carried.
SSOGENOidcIssuer	https://…	The issuer the ID token must name. Optional with a discovery document; then the document’s issuer must equal it.
SSOGENOidcAuthorizationEndpoint	https://…	The provider’s authorization address. Same host as the issuer.
SSOGENOidcTokenEndpoint	https://…	The provider’s token address. Same host as the issuer.
SSOGENOidcJwksUri	https://…	The address of the provider’s signing keys. Same host as the issuer.
SSOGENOidcIdTokenKeyFile	PEM file	One RSA public key for ID tokens, used in place of SSOGENOidcJwksUri.
SSOGENOidcEndSessionEndpoint	https://…	The provider’s logout address, when the discovery document names none. With SSOGENLogoutScope sso, /ssogen/logout goes there after it has ended the application’s session. Same host as the issuer.
SSOGENOidcPostLogoutRedirectUri	https://…	The registered address the provider returns to after logout.

The same site without a discovery document:

SSOGENMode oidc
SSOGENLicenseKey <key>
SSOGENOidcIssuer                https://login.acme.example/realms/acme
SSOGENOidcAuthorizationEndpoint https://login.acme.example/realms/acme/authorize
SSOGENOidcTokenEndpoint         https://login.acme.example/realms/acme/token
SSOGENOidcJwksUri               https://login.acme.example/realms/acme/keys
SSOGENOidcEndSessionEndpoint    https://login.acme.example/realms/acme/logout
SSOGENOidcPostLogoutRedirectUri https://app.example.com/ssogen/loggedout
SSOGENOidcClientId     acme-app
SSOGENOidcClientSecret <secret>
SSOGENOidcRedirectUri  https://app.example.com/ssogen/oidc/callback
SSOGENOidcScope        openid profile email
SSOGENOidcUserClaim    email

The addresses in this example are placeholders: take the real ones from your provider. An address you type must be on the issuer’s host; an address the discovery document supplies may be on any HTTPS host.

The discovery document is fetched at start and at each graceful restart. If the provider is unreachable then, Apache still starts; sign-ins answer 503 until the document can be fetched, and the agent retries at most every 30 seconds.

13. The paths the agent serves

Everything under /ssogen/ on a site that uses the agent belongs to the agent. Do not route these paths elsewhere; the agent answers them before any proxy or file rule.

Path	Mode	What it is
/ssogen/login	all	Starts a sign-in.
/ssogen/logout	all	Signs out. Link people to this address.
/ssogen/loggedout	all	The default page after sign-out.
/ssogen/callback	ssogen	Where SSOGEN returns the browser after sign-in.
/ssogen/acs	saml	Where the identity provider posts its response.
/ssogen/saml/login	saml	The same as /ssogen/login.
/ssogen/saml/slo	saml	Single logout with the identity provider.
/ssogen/oidc/callback	oidc	Where the OpenID provider returns the browser.

A path that does not belong to the site’s mode answers 404.

14. Names from earlier versions

These earlier spellings are still accepted as they are:

Earlier name	Name now
SsogenPlatformOrigin	SSOGENServerURL
A directive written with the prefix as Ssogen, such as SsogenClientId	The same directive; names are not case-sensitive

A configuration written for the earlier SSOGEN module for OpenID Connect must be changed by hand:

In the earlier configuration	Write now
SSOGENProviderMetadataURL	SSOGENOidcProviderMetadataURL
SSOGENClientID and SSOGENClientSecret	SSOGENOidcClientId and SSOGENOidcClientSecret
SSOGENRedirectURI with an address that ends in /redirect_uri	SSOGENOidcRedirectUri https://<site>/ssogen/oidc/callback; register this address at the provider
SSOGENCryptoPassphrase	SSOGENSessionSecret, needed only for several servers without session stickiness

Related guides

• Protect an on-premise app with the Web Agent
• Web Agent troubleshooting
• Java agent configuration reference
• Protect a Java application