The Agent Service Interface feature delivered with ITM 6.2.2 was designed to provide human and programmatic clients visibility and control over agent data, commands, and configuration directly without requiring a TEP or tacmd.  Access is provided via an XML over http interface exposed from the http service associated with a particular agent application. To find the service, point your browser to http://agenthost:1920 or https://agenthost:3661. From the resulting set of links, choose the one associated with the “Service Point: <3 letter product code>agent” label. From there you will be prompted for the userid and password associated with the host OS’s administrative account. After successful authentication, you can select one of these reports: agent information, situation, history, or queries. Additionally, you can make a service interface request directly such as to get a report of situation activity or to recycle a situation.

The Centralized Configuration Server feature delivered with ITM 6.2.2 FP2 allowed administrators to perform large scale agent configuration to autonomous agents by making an https server or the Agent Service Interface of a 6.2.2 FP2 agent available to other agents as a configuration file server. Additionally, it allowed administrative users of an agent’s Agent Service Interface to issue requests that would cause the agent to download a file from the Centralized Configuration Server to its file system on demand.

To limit access of the file download request to authorized users, the Access Authorization Group Profile (AAGP) facility was developed and included with FP2 levels of the Agent Service Interface. It is an XML document structured way of associating groups of users or individual users with the services provided by the Agent Service Interface. The following are the default product-provided default AAGP groups that are automatically loaded upon agent start up:

A. Restricted Group – The default group. The Service Interface category in this group consists of services that provide system information, operation configuration, workload monitoring, and historical data reporting capabilities. All users are in this group even those that are not specifically defined. 

B. Operation Group - This group includes Restricted Group category services and Service Interface services that provide operation control, configuration management, and application customized access capabilities.

C. Administrative Group - This group has access to all Service Interface capabilities and especially File Object (downloading configuration files on demand) and dynamically updating AAGP. 

To create your own custom settings, simply create a new AAGP file and make it available from the agent’s configured Centralized Configuration Server. The agent will periodically poll for an updated AAGP, download the document, parse it, and load the settings into memory; remember it does not store the file locally. The format of the file is as follows:

The Restricted group definition is required. If it is not include in the AAGP specification, then the product-provided default specification defined above will be in effect. The keyword *NONE specified for a component category prohibits all non-explicit users from accessing that component‘s services. For example, <SIAPI>*NONE</SIAPI> specified in Restricted group disallows general access to the Agent Service Interface component of the agent.

If the AAGP specification contains no <AAGROUP> element, then the product-provided default group definitions defined above will be in effect where the valid groups are RE, OP, and AD. There is no need to define R (restricted) group users since all users are automatically assigned to restricted group unless otherwise defined by AAGP.

Here is an example of an custom AAGP specification:

<AAGP>

   <AAGROUP>

        <GROUPNAME>Restricted</GROUPNAME>

        <SIAPI>AgentInfo</SIAPI>

        <SIAPI>AttrList</SIAPI>

        <SIAPI>ReadAttr</SIAPI>

        <SIAPI>ListSubnode</SIAPI>

        <SIAPI>TableSit</SIAPI>

        <SIAPI>SitStat</SIAPI>

        <SIAPI>SitSummary</SIAPI>

        <SIAPI>HistRead</SIAPI>

        <SIAPI>Report</SIAPI>

   </AAGROUP>

   <AAGROUP>

        <GROUPNAME>Operation</GROUPNAME>

        <INCLUDE>Restricted</INCLUDE>

        <SIAPI>PvtControl</SIAPI>

        <SIAPI>CnfgControl</SIAPI>

        <SIAPI>CnfgCommand</SIAPI>

        <SIAPI>ConfigurationArtifact</SIAPI>

        <SIAPI>PrivateConfiguration</SIAPI>

        <SIAPI>Overrides</SIAPI>

   </AAGROUP>

   <AAGROUP>

        <GROUPNAME>Administrative</GROUPNAME>

        <INCLUDE>Operation</INCLUDE>

        <SIAPI>FileObj</SIAPI>

        <SIAPI>AAGP</SIAPI>

   </AAGROUP>

   <AAUSER>

        <ID>dyang</ID>

        <ASSIGN>OP</ASSIGN>

   </AAUSER>

   <AAUSER>

        <ID>ksmith</ID>

        <ASSIGN>OP</ASSIGN>

   </AAUSER>

   <AAUSER>

        <ID>jmlake</ID>

        <ASSIGN>AD</ASSIGN>

   </AAUSER>

   <AAUSER>

        <ID>tcharris</ID>

        <ASSIGN>OP</ASSIGN>

   </AAUSER>

   <AAUSER>

        <ID>acwills</ID>

        <ASSIGN>Operation</ASSIGN>

   </AAUSER>