About SAML 2.0 General Services

7-10 Securing Oracle WebLogic Server

7.3.2.1 About SAML 2.0 General Services

The general SAML 2.0 services you configure include the following: ■ Whether you wish to enable the replicated cache Enabling the replicated cache is required if you are configuring SAML 2.0 services on two or more WebLogic Server instances in a domain, such as in a cluster. The replicated cache enables server instances to share and be synchronized with the data that is managed by the SAML 2.0 security providers; that is, either or both the SAML 2.0 Identity Assertion provider and the SAML 2.0 Credential Mapping provider. Note that the RDBMS security store is strongly recommended if you enable the replicated cache. Therefore prior to configuring SAML 2.0 services, the preferred approach is first to create a domain that is configured to use the RDBMS security store. For more information, see Chapter 10, Managing the RDBMS Security Store. ■ Information about the local site The site information you enter is primarily for the benefit of the business partners in the SAML federation with whom you share it. Site information includes details about the local contact person who is your partners point of contact, your organization name, and your organizations URL. ■ Published site URL This URL specifies the base URL that is used to construct endpoint URLs for the various SAML 2.0 services. The published site URL should specify the host name and port at which the server is visible externally, which might not be the same at which the server is accessed locally. For example, if SAML 2.0 services are configured in a cluster, the host name and port may correspond to the load balancer or proxy server that distributes client requests to the Managed Servers in that cluster. The published site URL should be appended with saml2. For example: https:www.avitek.com:7001avitek-domainaviserversaml2 ■ Entity ID The entity ID is a human-readable string that uniquely distinguishes your site from the other partner sites in your federation. When your partners need to generate or consume an assertion, the SAML 2.0 services use the entity ID as part of the process of identifying the partner that corresponds with that assertion. ■ Whether recipient check is enabled If enabled, the recipient of the authentication request or response must match the URL in the HTTP Request. ■ Whether TLSSSL client authentication is required for invocations on the Artifact Resolution Service. If enabled, SAML artifacts are encrypted when transmitted to partners. ■ Transport Layer Security keystore alias and passphrase, the values used for securing outgoing communications with partners. ■ Whether Basic authentication client authentication is required when your partners invoke the HTTPS bindings of the local site. If you enable this setting, you also specify the client username and password to be used. These credentials are then included in the published metadata file that you share with your federated partners. Configuring Single Sign-On with Web Browsers and HTTP Clients 7-11 ■ Whether requests for SAML artifacts received from your partners must be signed. ■ Configuration settings for the SAML artifact cache. ■ Keystore alias and passphrase for the key to be used when signing documents sent to your federated partners, such as authentication requests or responses. For information about the steps for configuring SAML 2.0 general services, see Configure SAML 2.0 general services in the Oracle WebLogic Server Administration Console Help.

7.3.2.2 Publishing and Distributing the Metadata File