Configuring SAML Single Sign-on Produces 403 Error

28-4 Oracle Fusion Middleware Administrators Guide for Oracle WebCenter Figure 28–4 Settings Pane - Providers

5. Click New to add a new provider.

The Create a New Authentication Provider pane displays see Figure 28–5 . Figure 28–5 Create a New Authentication Provider Pane 6. Enter a name for the provider for example OIDAuthenticator for a provider that authenticates the user for the Oracle Internet Directory. 7. Select the authenticator appropriate for your LDAP directory from the list of authenticators. Be sure to select the authenticator associated with the LDAP you are configuring rather than choosing the generic DefaultAuthenticator. For example, for OID select OracleInternetDirectoryAuthenticator, or for iPlanet select IPlanetAuthenticator.

8. Click OK to save your settings.

The Settings pane displays with the new authentication provider see Figure 28–6 . Configuring the Identity Store 28-5 Figure 28–6 Settings Pane - Authentication Providers 9. In the list of Authentication Providers, click the newly created provider. The Settings Pane for the new authentication provider displays see Figure 28–7 . Figure 28–7 Settings Pane for Authenticator 10. Set the Control Flag to SUFFICIENT. Setting the Control Flag to SUFFICIENT indicates that if a user can be authenticated successfully by this authenticator, then the authentication provider should accept that authentication and should not invoke any additional authenticators. Note: If the authentication fails, it falls through to the next authenticator in the chain. Therefore, be sure all subsequent authenticators also have their control flag set to SUFFICIENT. 28-6 Oracle Fusion Middleware Administrators Guide for Oracle WebCenter

11. Click Save to save this setting.

12. Open the Provider Specific tab to enter the details for the LDAP server. The Provider Specific pane displays see Figure 28–8 . Figure 28–8 Provider Specific Pane 13. Enter the details specific to your LDAP server. Note: The table below shows values appropriate for OID. For the permissible values for other LDAPs, such as Active Directory, see the appendix OPSS System and Configuration Properties in the Oracle Fusion Middleware Security Guide. Parameter Value Description Host: The LDAP servers server ID for example, ldap_hostexample.com Port: The LDAP servers port number for example, 3060 Principal: The LDAP user DN used to connect to the LDAP server for example, cn=orcladmin Credential: The password used to connect to the LDAP server Configuring the Identity Store 28-7

14. Click Save.

15. Return to the Providers tab and reorder the providers so that the new authentication provider is on top, followed by any other authenticators with the DefaultAuthenticator placed at the end of the list. All should have their control flags set to SUFFICIENT so that subsequent authenticators can authenticate identities that fall through from the new provider all the way through to the DefaultAuthenticator which is used only for the default file-based embedded LDAP. For example, logins such as the default administrator account are not typically created in the LDAP directory, but still need to be authenticated to start up the server. Unless identities are allowed to fall through to the DefaultAuthenticator, the default administrator account will not be authenticated. For more information about the DefaultAuthenticator and the default administrator account, see Section 28.5, Moving the Administrator Account to an External LDAP Server. 16. Restart the Administration Server and the managed server for the changes to take effect.

28.2 Tuning the Identity Store for Performance

For OVD, the only object class against which attributes are looked up is inetOrgPerson and its parent object classes. Since the Profile Gallery can display attributes not defined in inetOrgPerson, all the additional attributes not covered in inetOrgPerson would require an additional round trip to the identity store. For best performance when using OVD in a production environment, Oracle recommends that you add the following configuration entry in bold to the domain-level jps-config.xml file: -- JPS WLS LDAP Identity Store Service Instance -- User Base DN: Specify the DN under which your Users start for example, cn=users,dc=example,dc=com Group Base DN: Specify the DN that points to your Groups node for example, cn=groups,dc=example,dc=com Use Retrieved User Name as Principal Checked Must be turned on All Users Filter: uid=objec tclass=person Search to find all users under the User Base DN User From Name Filter: uid=uobje ctclass=person User Name Attribute: uid Note: Do not use the REQUIRED control flag if you are using multiple authenticators. If a REQUIRED control flag is found in the list of authenticators, regardless of its position, no further authenticators will be examined. Parameter Value Description