Select the STS, and click Update. From the SSOInfocard Mode drop-down, select either Infocard if the STS only

6-28 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation

7. Click Install Certificates, and import the certificate in the trusted root

Certification Authorities.

6.12.2.2 Create a Personal Infocard

Take these steps to create a personal Infocard with Windows Cardspace:

1. Go to the Windows control panel.

2. Double-click Windows Cardspace if it is not present, install .NET from the

Microsoft download site at http:www.microsoft.comdownloads .

3. Click Add a Card.

4. Select Create a Personal Card and fill in the fields.

5. Save the changes.

6.13 Additional Run-time Configuration

This section describes additional features you can configure to manage run-time behavior. ■ Validating Target URLs for SSO and Logout Operations ■ Providing XML Message to SP Engine after SSO Completes ■ Customizing Error Pages ■ Configuring Schema Validation for SSO Protocol Messages

6.13.1 Validating Target URLs for SSO and Logout Operations

When performing the SSO and Logout protocols, Oracle Identity Federation executes the SAMLWS-Fed protocol exchanges and then redirects the user to a final target URL, such as: ■ a protected resource in case of SSO, or ■ a returnurl when performing logout These URLs can be specified as query parameters at runtime; for example, the returnurl query parameter for IdP-initiated SSO, logout flows, and so on. Here are some examples of flows where URLs can be specified: ■ a user can start an IdP-initiated SSO flow by accessing: fedidpinitiatesso?providerid=SP_PROVIDER_IDreturnurl=http3A2F2Furl.com ■ a user can start the logout flow by accessing: feduserlogout?returnurl=http3A2F2Furl.com Oracle Identity Federation lets you validate URLs that can be specified at runtime. You configure validation specifying a list of approved hostnames, or approved domains. Note: The returnurl query parameter value must be correctly URL Encoded Additional Server Configuration 6-29 By default, validation is disabled. To configure the return URL validation module, enter the WLST script environment for Oracle Identity Federation and set the returnurlvalidationenabled boolean property from the serverconfig group to true or false to enable or disable the module. For example: setConfigPropertyserverconfig, returnurlvalidationenabled, true, boolean To add a host name or domain to the list of approved URLsdomains, enter the WLST script environment for Oracle Identity Federation, and issue these commands: ■ Add a host name to the returnurlvalidationlist list: addConfigPropertyListEntryserverconfig,returnurlvalidationlist, hostname.domain.com,string ■ Add a domain to the returnurlvalidationlist list: addConfigPropertyListEntryserverconfig,returnurlvalidationlist, .domain.com,string

6.13.2 Providing XML Message to SP Engine after SSO Completes

Oracle Identity Federation acting as SP can provide an XML message containing the assertion received by the server during the federated single sign-on flow. Depending on the binding used, this can be a SAML or SOAP message. Note that: ■ The XML message is provided to the SP engine with the attributes received in the assertion. ■ The message is contained in the map referenced by orafed-xmlmessage. ■ The attributes map is stored as an attribute in the HttpServletRequest object, referenced by oracle.security.fed.sp.attributes. To enable sending the message, set the boolean property spattrsincludexmlmessage from the spglobal group to true. To disable sending the message, set the property to false.

6.13.3 Customizing Error Pages

Errors can occur in Oracle Identity Federation for various reasons, such as: ■ page not found ■ federated single sign-on SSO error ■ runtime error Note: A domain is a string beginning with ., such as .oracle.com for the Oracle domain. Note: false is the default configuration.