IdP-initiated SSO Setting up Single Sign-On Services

6-6 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation Over time, the LDAP server may close some connections due to a long inactivity period, and if left unchecked, this can result in errors and a degradation of performance in Oracle Identity Federation. You can set an inactivity attribute that tells Oracle Identity Federation how long an LDAP connection should be kept in a pool before being removed due to inactivity. By default the inactivity timeout is set to 300 seconds. To set the inactivity settings for Oracle Identity Federation, enter the WLST script environment for Oracle Identity Federation and set the following properties: ■ Set the ldapconnectioninactivitytimeout long property from the authnengines group to the inactivity timeout in seconds to configure the LDAP Authentication Engine Inactivity Timeout as in this example: setConfigPropertyauthnengines, ldapconnectioninactivitytimeout, 300, long ■ Set the userldapconnectioninactivitytimeout long property from the datastore group to the inactivity timeout in seconds to configure the LDAP user data store Inactivity Timeout as in this example: setConfigPropertydatastore, userldapconnectioninactivitytimeout, 300, long ■ Set the fedldapconnectioninactivitytimeout long property from the datastore group to the inactivity timeout in seconds to configure the LDAP Federation Data Store Inactivity Timeout as in this example: setConfigPropertydatastore, fedldapconnectioninactivitytimeout, 300, long

6.3.2 Configuring the LDAP Read Timeout Setting

When Oracle Identity Federation is integrated with LDAP servers for user data store, federation data store or LDAP authentication engine, the server communicates with the LDAP directory to retrieve user attributes, authenticate users, look up users and perform related operations. Sometimes, the LDAP server can become unresponsive, causing the threaduser to wait for a response or an error. To avoid waiting too long for an error when the server is not responding, Oracle Identity Federation sets a read timeout property on the LDAP connection: if the LDAP server does not respond before the read timeout period, an error is generated, Oracle Identity Federation closes the connection, opens a new one and re-issues the LDAP command. It is possible to set the read timeout setting to tell the Oracle Identity Federation server how long to wait for data from the LDAP server. By default the read timeout is set to 10 seconds. To set the read timeout settings for Oracle Identity Federation, enter the WLST script environment for Oracle Identity Federation, and set the following properties if necessary examples are included: ■ Set the ldapconnectionreadtimeout long property from the authnengines group to the read timeout in seconds to configure the LDAP Authentication Engine Read Timeout: setConfigPropertyauthnengines, ldapconnectionreadtimeout, long, 10 Additional Server Configuration 6-7 ■ Set the userldapconnectionreadtimeout long property from the datastore group to the read timeout in seconds to configure the LDAP user data store read timeout: setConfigPropertydatastore, userldapconnectionreadtimeout, long, 10 ■ Set the fedldapconnectionreadtimeout long property from the datastore group to the read timeout in seconds to configure the LDAP federation data store read timeout: setConfigPropertydatastore, fedldapconnectionreadtimeout, long, 10

6.3.3 ECID Support for LDAP Connections

Oracle Identity Federation 11g supports execution context ID ECID for DMS and audit purposes. When creating an LDAP connection with Oracle Internet Directory, Oracle Identity Federation can pass the ECID context to the OID LDAP Connection. This feature is disabled by default. To enable disable the feature, set the following properties to true false: ■ Set the ldapuseecid boolean property in authnengines group of config for LDAP authn engine ■ Set the userldapuseecid boolean property in authnengines group of config for the LDAP user store ■ Set the fedldapuseecidboolean property in authnengines group of config for LDAP federation data store

6.4 Additional Configuration for High Availability

This section contains additional topics for high availability configuration: ■ Configuring High Availability LDAP Servers ■ Configuring the HTTP Session State SleepRetry Interval

6.4.1 Configuring High Availability LDAP Servers

By default, Oracle Identity Federation is not configured to integrate with a high availability LDAP server. To integrate Oracle Identity Federation with HA LDAP servers to serve as user data store, federation data store, or authentication engine, Oracle Identity Federation needs to be configured for based on the LDAP servers function. Enter the WLST script environment for Oracle Identity Federation, then set the following properties as needed: ■ To integrate the user data store with an HA LDAP server, set the userldaphaenabled boolean property from the datastore group to true; otherwise set it to false: setConfigPropertydatastore, Note: The LDAP server for which ECID support is being enabled must be Oracle Internet Directory 11g Release 1 11.1.1 or later.