Configuring RDBMS Session Cache

Additional Server Configuration 6-11

6.6 Session Repository Configuration

This section contains topics related to maintaining the session repository.

6.6.1 Storing Assertion Attributes of User Session

The Oracle Identity Federation server features a session store containing the session information of the currently authenticated users. This session repository is capable of storing attributes that Oracle Identity Federation can use, when acting as identity provider IdP, to populate SSO assertions. The attributes stored in the user session can be added to the store in two ways: ■ by a custom authentication engine, by setting a list of attributes to be saved in the user session ■ with Oracle Identity Federation acting as a service provider SP, when processing an incoming assertion; Oracle Identity Federation can save the attributes contained in the assertion, and the NameID and providerID in the user session By default, for performance reasons, the storage of assertion information in the user session is disabled when Oracle Identity Federation acts as an SP. To configure the Oracle Identity Federation server to store the assertion information, enter the WLST script environment for Oracle Identity Federation instance, and set the following property: ■ Set the sessionstoreassertionattrs boolean property from the spglobal group to true if the attributes contained in the assertion, and the NameID and providerID, should be stored in the user session: setConfigPropertyspglobal, sessionstoreassertionattrs, true, boolean ■ otherwise set it to false: setConfigPropertyspglobal, sessionstoreassertionattrs, false, boolean

6.7 Additional HTTP Configuration

This section contains additional topics for HTTP configuration for Oracle Identity Federation: ■ Configuring HTTP-Only Flag for HTTP Cookies Set by Oracle Identity Federation ■ Precautions when Customizing the Page in HTTP Post Profile ■ Using a 303 Status Code for Redirects

6.7.1 Configuring HTTP-Only Flag for HTTP Cookies Set by Oracle Identity Federation

A non-standard extension to RFC2965 extends the set-cookie header further by specifying an HttpOnly flag. When you set this flag, the client browser should not make the cookie contents available to scripting environments. For example, the JavaScript document.cookie method should not return the cookie contents. This significantly protects against cross-site scripting and similar attacks. By default Oracle Identity Federation does not set the HttpOnly flag. 6-12 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation The Oracle Identity Federation server can be configured to set the HttpOnly flag when setting in the users browser: ■ the cookie used by Oracle Identity Federation to reference the user session ■ the Oracle Access Manager cookie To configure Oracle Identity Federation to set the HttpOnly header, enter the WLST script environment for Oracle Identity Federation and set the following properties: 1. Set the cookiehttponlyenabled boolean property from the serverconfig group to true if the HttpOnly flag should be set when sending the Oracle Identity Federation cookie to the browser, otherwise set it to false: setConfigPropertyserverconfig, cookiehttponlyenabled, true, boolean 2. Set the oamcookiehttponlyenabled boolean property from the spengines group to true if the HttpOnly flag should be set when sending the Oracle Access Manager cookie to the browser, otherwise set it to false: setConfigPropertyspengines, oamcookiehttponlyenabled, true, boolean

6.7.2 Precautions when Customizing the Page in HTTP Post Profile

The SAMLWS-Fed specifications define a POST profile where a SAMLWS-Federation server will redirect a users browser to a remote SAMLWS-Fed implementation through the use of an HTML form. Typically, such a server would send the browser an HTML page containing a FORM with: ■ the action URL referencing the remote server ■ some hidden fields containing SAMLWS-Fed message, andor some attributes When using that profile, the Oracle Identity Federation server prepares the action URL, the providerID referencing the remote server, and the list of hidden fields to send to the remove server. It then hands over this data to the postprofile.jsp page contained in the web.war of the ORACLE_IDM_ HOMEfedinstalloif.ear file that uses the information to build the HTML page to be presented to the browser. You can customize that page to: ■ Modify what is displayed to the browser ■ Add extra fields to send to the remote server When modifying the file to fit the particular needs of a deployment, be careful not to interfere with the POST profile, which can occur for example if you remove the required parametersfields, such as the action URL or the hidden fields set by the Oracle Identity Federation server. To modify the file, unzip the oif.ear and the web.war, make the modification, and re-package the web.war and EAR file. Note: The remote SAMLWS-Federation server may not be able to process these fields, since they might not be compliant with the specifications.