Infocard Authentication requires SSL. Configure SSL on Oracle WebLogic Server

6-26 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation returned in the assertion from the WS-Trust server. The User Attribute Name is used to reference that attribute in Oracle Identity Federation, Assertion Attribute Name is the name of the attribute recognized by the STS, and FormatNamespace is the namespace to which the attribute is bound. The required claim from Oracle Identity Federation to the STS is the concatenation of the namespace, , and the assertion attribute name. For example: ■ Add an attribute entry User Attr Name=lastname, Assertion Attr Name=surname, Format or Namespace=http:schemas.xmlsoap.orgws200505identityclaims. Check the Require From Infocard box. ■ Add another attribute entry with User Attr Name=firstname, Assertion Attr Name=givenname, Format or Namespace=http:schemas.xmlsoap.orgws200505identityclaims. Check the Require From Infocard box. 6. Configure Oracle Identity Federation to map the assertion that the Personal Card Issuer will provide to a local user. For example, in the Oracle Identity Federation Settings tab, in the Assertion Setting tabs, uncheck the Map User via NameID box, check Map User via Attribute Query and enter the following LDAP query: sn=lastnamegivenname=firstname 7. Save the changes.

8. Check or uncheck the Supports Authentication Mechanism Claims box to

indicate whether the authentication mechanism should be listed as a required Infocard attribute. Not all WS-Trust servers support the ability to specify the requested authentication mechanism through the use of attributes. 9. Save the changes.

6.12.1.4 Add Infocard Managed STS

For Oracle Identity Federation to accept an assertion from a remote STS, the Oracle Identity Federation server needs to have a trust relationship with the remote server. This trust is established by having the STS defined and enabled in the servers federations. In Fusion Middleware Control, locate the Oracle Identity Federation instance and perform the following operations: 1. Add an entry by entering the STS provider ID, selecting IdP and the WS-Fed 1.1 version.

2. Select the STS, and click Update.

3. Enter the IdP signature verification certificate.

4. From the SSOInfocard Mode drop-down, select either Infocard if the STS only

supports Infocard protocol, or Single Sign-On and Infocard if the STS supports both Infocard and SSO protocols. 5. Infocard states that the relying party Oracle Identity Federation in the present case must list the attributes or claims that the STS should include in the assertion it creates. With the attributes and the optional NameID contained in the assertion, the Oracle Identity Federation server can map the assertion to a local user record if configured for that operation.