Attribute Value Mapping Introduction to Attribute Mapping and Filtering

Configuring Oracle Identity Federation 5-59

5.9.2 Mapping and Filtering Configuration

This section explains how to configure mapping and filtering: ■ Configuring Attribute Name Mapping ■ Configuring Attribute Value Mapping ■ Configuring Attribute Value Filtering

5.9.2.1 Configuring Attribute Name Mapping

Configuration of attribute name mapping serves these purposes: On the IdP side: ■ mapping attribute names contained in assertions to local attribute names ■ determining which local attributes can be sent to the peer provider. Defining an attribute name mapping for a peer provider will authorize Oracle Identity Federation to send this attribute to the remote server. On the SP side: ■ mapping attribute names contained in SOAP client requests to names in attribute queries to the attribute authority Take these steps to define attribute name mappings: On the IdP Side 1. Log in to Fusion Middleware Control and navigate to the Oracle Identity Federation instance.

2. Navigate to Administration, then Federations.

3. Select the Attribute Requester with which you want to configure attribute sharing, and click Edit.

4. Click Edit Attribute Mappings and Filters.

5. Under the Name Mappings tab, click Add to add an attribute name mapping,

with the following fields: ■ User Attribute Name: The name of the local attribute in the user repository. If the UserID should be mapped to the assertion attribute, set this to orafed-userid. ■ Assertion Attribute Name: The name that will be used to identify the attribute in the Attribute Query and assertion ■ Format or Namespace: An optional field used to specify the format or the namespace of the SAML attribute, depending on the version. – For SAML 1.x, this fields value is used to set the SAML attributes namespace. – For SAML 2.0, this value is used to set the SAML attributes NameFormat; if this field is empty, the NameFormat of the SAML attribute will be set to urn:oasis:names:tc:SAML:2.0:attrname-format:basic; otherwise the NameFormat will hold the value specified in this field. ■ Send with SSO Assertions: Indicates whether the attribute should be sent in the assertion during an SSO operation. See Also: Section 5.11, Configuring Federations 5-60 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation ■ Get Value from User Session: Indicates whether the attribute value should be obtained from the user session. ■ Require from Infocard: Indicates whether the attribute must be passed in from Infocard. On the SP Side 1. Log in to Fusion Middleware Control and navigate to the Oracle Identity Federation instance.

2. Navigate to Administration, then Federations.

3. Select the attribute authority with which you want to configure attribute sharing, and click Edit.

4. Select Update Manually; under Oracle Identity Federation Settings, click Edit

Attribute Mappings and Filters .

5. Under the Name Mappings tab, click Add to add an attribute name mapping, with

the following fields: ■ User Attribute Name: The name used by the SOAP client in the AttributeRequest ■ Assertion Attribute Name: The name that will be used to identify the attribute in the attribute query and assertion ■ Format or Namespace: An optional field used to specify the format or the namespace of the SAML attribute, depending on the version – For SAML 1.x, this fields value is used to set the SAML attributes namespace – For SAML 2.0, this value is used to set the SAML attributes NameFormat; if this field is empty, the NameFormat of the SAML attribute will be set to urn:oasis:names:tc:SAML:2.0:attrname-format:basic; otherwise the NameFormat will hold the value specified in this field ■ Get Value from User Session: Indicates whether the attribute value should be obtained from the user session. ■ Require from Infocard: Indicates whether the attribute must be passed in from Infocard. Example The following attribute name configuration will yield the results shown here. Name Mapping in SP: Note: In order for the identity provider to send an attribute to a peer provider, a mapping for this attribute must be defined as explained above. Note: If no mapping is found for an attribute name, the service provider will map the name to itself.