The service provider must verify the XML signature on the response.

Planning Oracle Identity Federation Deployment 2-13 Oracle Identity Federation provides the attribute sharing profile for use with Oracle Access Manager to enable interoperation with SAML implementations at peer sites. For details about components and their respective roles, and how to configure Oracle Identity Federation and Oracle Access Manager, see Section 5.6.4.3, Configuring an Oracle Access Manager Policy using Attribute Sharing .

2.2.2.5 Using the WS-Federation Logout Profile

WS-Federation can be used to sign into one or more service providers using an identity provider that performs the actual authentication. To log out, the user clicks on a link at the IdP site that initiates a WS-Federation signout. Using a session cookie, Oracle Identity Federation has kept track of each SP to which the user signed on. The server returns an HTML signout page to the user’s browser. Each SP processes the signout cleanup to sign out the session created for Oracle Identity Federation.

2.2.2.6 Using OpenID Profiles and Extensions

This section describes Oracle Identity Federation support for different OpenID profiles and extensions. Attribute Exchange AX AX is an OpenID 2.0 extension allowing user attributes to be requested and returned. OIF supports AX version 1.0. Support on the IdP includes the following: ■ Profile support is enabled on the IdP, but for each SP, you must indicate whether attributes should be sent ■ Attribute definition is achieved through the existing screen on the SP Partner specific page Support on the SP includes the following: ■ Attribute definition is achieved through the existing screen on the IdP Partner specific page ■ In the attribute definition page, you can specify which attributes to request from the IdP when performing the SSO protocol. ■ A custom SP engine or a pre-processing engine can dictate at run-time which attributes must be requested from the IdP when performing the SSO protocol. Provider Authentication Policy Extension PAPE PAPE is an OpenID 2.0 extension allowing RPs to request specific authentication typestrength, including Levels of Assurance. Oracle Identity Federation supports PAPE version 1.0. Support on the IdPOP includes the following: ■ The IdP publishes in the XRDS document whether or not the PAPE extension is enabled. ■ If enabled, the IdP includes the authentication mechanism used to authenticate the user in the response to the SP. Support on the SPRP includes the following: