Authentication Engines - Infocard

5-100 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation 1. A service provider, SP-1, sends an authentication request to an Oracle Identity Federation identity provider, IdP-1. 2. Oracle Identity FederationIdP-1 is using the Federated SSO Proxy authentication engine; it selects a trusted identity provider, IdP-2, takes the role of a service provider, and sends a new authentication request for the specified user to IdP-2. 3. IdP-2 authenticates the user. 4. IdP-2 sends back an assertion to Oracle Identity FederationIdP-1, who will then process this assertion. 5. If necessary, Oracle Identity FederationIdP-1 authenticates the user locally for example when a federation creation operation needs to be performed. 6. Oracle Identity FederationIdP-1 sends back a new assertion to SP-1.

5.15.8.2 Selecting the Identity Provider to Use

When an identity provider using the Federated SSO Proxy authentication engine receives an authentication request from a service provider, it will select a trusted identity provider to which to send a new request. To select the identity provider, Oracle Identity Federation maps the authentication mechanism requested by the service provider or the default mechanism if the SP did not request one to an identity provider, and sends a new request to this IdP. If the mechanism does not map to an identity provider, Oracle Identity Federation uses the default identity provider in configuration. Refer to Section 5.14.1, About Authentication Mechanisms for more information on authentication mechanisms and how protocol-specific methods are mapped to local authentication mechanisms. For example, suppose that the following mappings from local authentication mechanisms to identity providers are configured: oracle:fed:authentication:internet-protocol - http:corp-1.comidp oracle:fed:authentication:password-protected - http:corp-2.comidp and that the default identity provider is: http:corp-3.comidp. Then, if the service provider requests an authentication method that maps to the oracle:fed:authentication:internet-protocol, Oracle Identity Federation selects http:corp-1.comidp as the identity provider, but if the service provider requests oracle:fed:authentication:password-protected, Oracle Identity Federation chooses http:corp-2.comidp. If the service provider does not request an authentication method, then Oracle Identity Federation sends the new authentication request to http:corp-3.comidp. You can define the mappings from local authentication mechanisms to identity providers by following these steps:

1. Log in to Fusion Middleware Control and navigate to the Oracle Identity

Federation instance.

2. Navigate to Administration, then Service Provider.

3. In Protocol Settings, click on Configure SSO Authentication Mechanism to

Identity Provider Mapping .

4. Click Add, and select the authentication mechanism and the identity provider to

which it maps. See Also: Section 5.5, Configuring Service Providers Configuring Oracle Identity Federation 5-101

5. When you are done adding mappings, click OK. Then click Apply.

You can configure the default identity provider by following these steps: 1. Log in to Fusion Middleware Control and navigate to the Oracle Identity Federation instance.

2. Navigate to Administration, then Service Provider.

3. Select the Default SSO Identity Provider and click Apply.

5.15.8.3 Configuring the Federated SSO Proxy Authentication Engine

To correctly use the federated SSO proxy authentication engine, you need to configure authentication mechanisms. This might include:

1. Setting the default authentication mechanism

2. Mapping protocol-specific methods to local mechanisms and local mechanisms to

authentication engines

3. Mapping local authentication mechanisms to identity providers

In addition to configuring authentication mechanisms, you will need to configure the federated SSO proxy authentication engine itself. To do this, follow these steps:

1. Log in to Fusion Middleware Control and navigate to the Oracle Identity

Federation instance.

2. Navigate to Administration, then Authentication Engines.

3. In the Federated SSO Proxy tab, select Enable Authentication Engine and choose

the authentication mechanism that will be used to authenticate the user locally when needed. Refer to Section 5.14.1, About Authentication Mechanisms for more information on authentication mechanisms and how authentication mechanisms are mapped to authentication engines.

5.15.9 Authentication Engines - JAAS

The JAAS authentication engine is the default authentication engine for the Oracle Identity Federation server. WARNING: The local authentication mechanism to use when the user needs to be locally authenticated must not be mapped to the Federated SSO Proxy authentication engine. This will create a loop where IdP-1 continuously sends a request to IdP-2. IdP-1 sends a request to IdP-2 and receives an assertion. It needs to authenticate the user locally, and thus maps the mechanism to the Federated SSO Proxy authentication engine, which will prompt it to send a new request to IdP-2.