Oracle Single Sign-On Setting up Single Sign-On Services

6-4 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation

6.1.3 SP-initiated SSO

When Oracle Identity Federation server is acting as a service provider, a user can initiate an SSO operation by directly requesting a service at the Oracle Identity FederationSP instance. The URL to be requested on Oracle Identity Federation is: https:OIF_host:OIF_portfedspinitiatesso URL Query Parameters It is possible to specify URL query parameters when requesting the URL: ■ providerid - This is the identifier of the identity provider to use to perform the SSO operation optional. If missing, the default SSO provider, set in Fusion Middleware Control by navigating to Service Provider, then Common, then Default SSO Identity Provider , is used. ■ federationid - This is the identifier of the affiliation to use for SSO optional. ■ returnurl - This is the URL to which the user is sent after a successful SSO operation. It is required if the Unsolicited Relay State property, set in Fusion Middleware Control by navigating to Federations, then Service Providers Common , is empty. An example of such a URL is: http:oif_host:oif_ portfedspinitiatesso?providerid=http3A2F2Fidp.comreturnurl=http3A2FFProt ectedAppHost2FProtectedAppPath Check that the query parameter values are correctly URL-encoded.

6.1.4 IdP-initiated SSO

Oracle Identity Federation provides the ability to initiate an SSO operation by directly requesting a URL at the Oracle Identity Federation instance acting as an IdP; this is called an SSO IdP-initiated operation. The url to be requested on Oracle Identity Federation is of the form: https:oif_host:oif_portfedidpinitiatesso URL Query Parameters It is possible to specify query parameters when requesting that URL: ■ providerid - This is the identifier of the service provider to use to perform the SSO operation optional. ■ federationid - This is the identifier of the affiliation to use for the SSO optional. ■ returnurl - This is the URL to which the user is sent after a successful SSO operation optional. See Also: Section 6.2, Working with Affiliations for more information See Also: Section 6.2, Working with Affiliations for more information Additional Server Configuration 6-5 Check that the query parameter values are correctly URL-encoded. An example of such a URL is: http:oif_host:oif_ portfedidpinitiatesso?providerid=http3A2F2Fsp.comreturnurl=http3A2FFProt ectedAppHost2FProtectedAppPath

6.2 Working with Affiliations

The run-time functioning of affiliations depends on whether the Oracle Identity Federation server is acting as an IdP or an SP. Oracle Identity Federation Acting as IdP When Oracle Identity Federation is an IdP, provided the affiliationSP is present and enabled in the circle of trust, the Oracle Identity Federation server is ready to process any requests originating from service providers using the affiliation. Oracle Identity Federation Acting as SP As an SP, you can trigger a single sign-on operation with an IdP using an affiliation to which the SP belongs. To do so, include a federationid query parameter in the URL protected by the IdM back-end, and set the parameter value to the affiliation ID. For example with an Oracle Single Sign-On back-end, assuming that a resource is protected by mod_osso and configured for Oracle Identity Federation authentication, requesting the URL of this resource with the federationid query parameter instructs Oracle Identity Federation to use an affiliation when performing single sign-on with a peer IdP. Here is an example of such a URL: http:protected_res_host:protected_res_ portpath?federationid=http3A2FFaffiliationid It is also possible to directly access the http:oif_host:oif_ portfedspinitiatesso URL with the same federationid query parameter. In this case, Oracle Identity Federation triggers a single sign-on operation, and uses the Unsolicited SSO RelayState for the peer IdP as the URL to which the user is redirected after successful authentication.

6.3 Additional LDAP Configuration

This section contains topics for LDAP configuration and maintenance: ■ Configuring the LDAP Inactivity Setting ■ Configuring the LDAP Read Timeout Setting ■ ECID Support for LDAP Connections

6.3.1 Configuring the LDAP Inactivity Setting

When Oracle Identity Federation is integrated with high availability LDAP servers to serve as user data store, federation data store, or authentication engine, the server keeps a pool of LDAP connections that can be re-used for subsequent requests. Note: The Unsolicited SSO RelayState is set by navigating to Federations , then Edit Trusted Provider in Fusion Middleware Control.