Locating a User Mapping Users through Attributes and NameID in SP Mode

6-36 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation 2. Navigate to Administration, then Service Provider, then SAML 2.0, then Assertion Settings .

3. Uncheck Map User via Federated Identity.

4. Uncheck Map User via Attribute Query.

5. Check Map User via NameID.

6. Enable Email Address NameID Format, and enter the attribute of the user record

holding the email address mail typically for LDAP server.

7. Check Error when User Mapping fails; this will force Oracle Identity Federation

to return a 401 error to the browser if the user cannot be located. 8. Apply the changes.

6.16.4 Example 2: Simple Assertion Mapping without Federated Identities with an LDAPSQL Query

In this example, Oracle Identity FederationSP uses the NameID contained in the assertion to look up a local user in the LDAP user data store. The format of the NameID is emailAddress, and the search uses the mail attribute of the LDAP user record. The server is configured to use the LDAPSQL Query functionality to locate the user. Perform the following steps to configure Oracle Identity FederationSP: 1. Log in to Fusion Middleware Control. 2. Navigate to Administration, then Service Provider, then SAML 2.0, then Assertion Settings .

3. Uncheck Map User via Federated Identity.

4. Check Map User via Attribute Query.

5. Enter the following LDAP query in the Attribute Query field: mail=orafed-nameid-value

6. Uncheck Map User via NameID.

7. Check Error when User Mapping fails; this forces Oracle Identity Federation to

return a 401 error to the browser if the user cannot be located. 8. Apply the changes.

6.16.5 Example 3: Complex Assertion Mapping without Federated Identities with an LDAPSQL Query

In this example, Oracle Identity FederationSP uses the SAML attributes for email address and last name in the assertion to look up a local user in the LDAP user data store. The mail and sn local attributes are obtained from the LDAP user record. The attributes in the assertion are referenced as email and lastname. Oracle Identity FederationSP is not configured for attribute name mapping, so the LDAP query uses the attribute names contained in the SAML assertion; if attribute name mapping was configured, the LDAP query would use the names resulting from the attribute name mapping refer to Section 5.9, Configuring Attribute Mapping and Filtering for more information.