Perform IdP-initiated Single Sign-On

4-18 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation For details, see: ■ Section 5.6, Configuring Attribute Sharing with the Oracle Access Manager AuthZ Plug-in ■ Section 4.3.5, Set Up Single Sign-On for SAML 1.x and WS-Federation You can also configure attribute name and value mapping, and attribute filtering. See Section 5.9, Configuring Attribute Mapping and Filtering for details. When Oracle Identity Federation, acting as an identity provider, receives a SAML 1.x attribute query, it will need to identify the requester. Oracle Identity Federation provides two ways in which a requester can be identified: by providing an SSL client certificate, or by authenticating with HTTP basic authentication. If the requester authenticates by means of an SSL client certificate, the cn of the certificate subject must be the provider ID with which Oracle Identity Federation identifies the requester. If the requester authenticates through HTTP basic authentication, the username used by the requester must be the provider ID with which Oracle Identity Federation identifies the requester. For details on how to set up SSL with client authentication or HTTP basic authentication, see Section 6.9, Protecting the SOAP Endpoint .

4.2.8.1 NameID Format Strings when Using the Attribute Requester Service

The strings to be used for the NameID format when using the Attribute Requester service are:

4.2.9 Send Authentication Queries SAML 1.x

To send SAML 1.x authentication queries to an Oracle Identity Federation instance acting as an IdP, use a URL of the form: http:host:portfedauthnauthsoapv11 When Oracle Identity Federation, acting as an identity provider, receives a SAML 1.x authentication query, it must identify the requester. Oracle Identity Federation provides two ways in which a requester can be identified: by providing an SSL client certificate, or by authenticating through HTTP basic authentication. If the requester authenticates using an SSL client certificate, the cn of the certificate subject must be the provider ID with which Oracle Identity Federation identifies the requester. If the requester authenticates through HTTP basic authentication, the Table 4–2 NameID Formats for Attribute Requester Service Format String x509 oracle:security:nameid:format:x509 email oracle:security:nameid:format:emailaddress windows oracle:security:nameid:format:windowsdomainqualifiedname kerberos oracle:security:nameid:format:kerberos persistent oracle:security:nameid:format:persistent transient oracle:security:nameid:format:transient unspecified oracle:security:nameid:format:unspecified custom oracle:security:nameid:format:custom userid oracle:security:nameid:format:userid