Associate Oracle HTTP Server with Managed Server

Deploying Oracle Identity Federation 3-3 where AS_INST represents the application server instance home. 2. If Oracle Identity Management was installed in stand-alone mode, uncomment and set the WebLogicHost and WebLogicPort variables to reference the WebLogic managed server where Oracle Identity Federation is running for example myhost.us.mycorp.com and 7499. 3. If the Oracle Identity Management is installed in clustered mode, uncomment and set the WebLogicCluster variable to reference the Oracle WebLogic Server managed servers where Oracle Identity Federation is running for example myhost1.us.mycorp.com:7499, myhost2.us.mycorp.com:7499. 4. Save the file and exit. 5. Restart Oracle HTTP Server.

3.2.1.4 Update Oracle Identity Federation Configuration

Next, take these steps to update the Oracle Identity Federation configuration:

1. Log in to Fusion Middleware Control and navigate to the Oracle Identity

Federation instance.

2. Navigate to Administration, then Server Properties.

3. Change the hostname to reflect the hostname configured in OHS, if they are

different.

4. Change the PortSSL Enabled and SOAP PortSSL Enabled information to reflect

the OHS configuration.

5. Save the changes.

6. Since the Oracle Identity Federation metadata has changed, redistribute the

metadata to any remote partners to notify them of the changes.

3.2.2 Deploying Oracle Identity Federation with Oracle Single Sign-On

This section describes the steps needed to install and deploy Oracle Identity Federation so that it is integrated with Oracle Single Sign-On. Deployed in this manner, Oracle Identity Federation can leverage the authentication capabilities offered by Oracle Single Sign-On when local user authentication is required. Oracle Identity Federation can: ■ integrate with OHS and Oracle Single Sign-On to serve as the authentication engine ■ integrate with Oracle Single Sign-On to serve as the SP integration Module. Briefly, the steps to achieve this deployment are: ■ Create and Manage the Oracle HTTP Server Instance ■ Integrate Oracle Single Sign-On with OHS ■ Configure Oracle Identity Federation to use Oracle Single Sign-On as the Authentication Engine ■ Configure Oracle Identity Federation for Oracle Single Sign-On SP Integration See Also: Understanding Key Oracle Fusion Middleware Concepts in the Oracle Fusion Middleware Administrators Guide. See Also: Section 5.2, Configuring Server Properties 3-4 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation ■ Configure Oracle Single Sign-On ■ Testing Federated Single Sign-On Detailed instructions for these steps follow.

3.2.2.1 Create and Manage the Oracle HTTP Server Instance

To configure OHS, follow the instructions in Section 3.2.1, Deploying Oracle Identity Federation with Oracle HTTP Server .

3.2.2.2 Integrate Oracle Single Sign-On with OHS

This integration is necessary to deploy Oracle Identity Federation with Oracle Single Sign-On. Register Partner Application Start by registering the mod_osso module in 11g Release 1 11.1.1 OHS with the 10g Oracle Single Sign-On server as a partner application. For details on this procedure, refer to Configuring and Administering Partner Applications in the Oracle Application Server Single Sign-On Administrators Guide for 10g. You need to run ssoreg from the Oracle Single Sign-On server to generate an osso.conf file and manually copy it to the partner application AS_INST of the Oracle Identity Federation instance. Here is an example for registering a remote partner application on an Oracle Single Sign-On server: ORACLE_HOMEssobinssoreg.sh -site_name oif.server.com:7499 -config_mod_osso TRUE -mod_osso_url http:oif.server.com:7499 -remote_midtier -config_file oif.server.com.osso.conf Restart the OC4J_SECURITY instance of the Oracle Single Sign-On Server. After you run this command, a file named oif.server.com.osso.conf is created in the directory where the commmand was invoked. Copy that file to AS_ INSTconfigOHSOHS_NAME. Set Up mod_osso The next step is to set up mod_osso. Copy AS_INSTconfigOHSOHS_NAMEdisabledmod_osso.conf to AS_ INSTconfigOHSOHS_NAMEmoduleconf. All files in the moduleconf directory are read when OHS is started. Note: Oracle Identity Federation does not support the ability to force re-challenging the user for credentials when integrated with Oracle Single Sign-On, so that Oracle Identity Federation cannot support use cases where reauthentication must be forced. For example, if an SP sends an AuthnRequest with ForceAuthn=true to an Oracle Identity Federation IdP, and Oracle Identity Federation is integrated with Oracle Single Sign-On, the ForceAuthn flag is ignored.