The distributed authentication service (DAS) lets you hide OpenAM services back in the data center behind the DAS in the DMZ. What I committed today into the install guide on deploying the DAS is quite basic, aimed at those who like me are just getting started with the feature.
First, I installed OpenAM in one VirtualBox guest, and then configured the DAS on another VirtualBox guest to point to the OpenAM server. In order to see something satisfying after configuration, I configured a realm that sends a user who successfully logs in to a “successful login” page. It’s not exactly a deployment example for the data center, but should help you get started with DAS.