Cryptographic Provider Example of Federation Event Flow Supported Standards and Applications

1-22 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation 2 Planning Oracle Identity Federation Deployment 2-1 2 Planning Oracle Identity Federation Deployment This chapter outlines Oracle Identity Federation deployment considerations and helps you understand installation options. It contains these sections: ■ Architecture Options ■ Profiles and Bindings ■ Authentication Engines ■ Data Repositories ■ Installation Requirements ■ Sizing Guidelines ■ Implementation Checklist

2.1 Architecture Options

In planning to deploy Oracle Identity Federation, you should understand the server architecture, the operating environment, and the role that your server will play in a federated exchange network. This section outlines the architectural aspects of Oracle Identity Federation deployment, including: ■ Role in Federation ■ Proxy Server ■ Server Security ■ Protocol

2.1.1 Role in Federation

As described earlier, an Oracle Identity Federation instance in a federated network can serve as an identity provider IdP, a service provider SP, or both. Identity Provider Role When a user wishes to access a protected resource in the federated network, the service provider for that resource directs the user to Oracle Identity Federation, which acts as identity provider for authentication. Oracle Identity Federation uses an authentication engine to obtain credentials and authenticate the user. Oracle Identity Federation can now assert the user’s identity to the resource SP, which authenticates the user and provides the requested application. 2-2 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation Service Provider Role A user tries to access a resource protected by an authentication engine such as Oracle Single Sign-On, which redirects the user to Oracle Identity Federation. In a service provider role, Oracle Identity Federation redirects the user to an identity provider such as a portal for global authentication. The IdP portal can now obtain credentials, authenticate the user, and redirect back to Oracle Identity Federation, which then retrieves the asserted identity from the IdP. Oracle Identity Federation redirects the authenticated user to the authentication engine, which grants access to the protected resource. Federation Topology A federation can comprise any number of identity providers and service providers. One common federation topology is referred to as the hub-and-spoke model. In this topology, there is either a single service provider accepting authentication from multiple identity providers, or a single identity provider authenticating to multiple service providers. Figure 2–1 A Hub-and-Spoke Federation Network

2.1.2 Proxy Server

You must decide what components you will put in the DMZ and whether to use a proxy server. If you put Oracle Identity Federation behind the fire wall, the proxy must forward requests and responses to the federation server, enabling transparent access to the server from an external network such as the internet. Oracle Identity Federation configuration varies depending on the type of profile being implemented. POST Profile with Proxy in SP DMZ The POST profile sends the full assertion to the SP over HTTPS. Both IdP and SP are configured to communicate through their SSL ports. When using the POST profile in production, the SP uses a proxy server in the DMZ. Artifact Profile with Proxy in IdP and SP DMZ When using the browser artifact profile, the IdP sends an artifact an identifier rather than an actual assertion. The SP receives the artifact and requests the full assertion thereafter. If you elect to use a proxy, note that proxies must be used for both IdP and SP in order to implement this profile. The proxies serve as receiver and responder services, handling the exchange of artifacts, assertion requests and assertions, and forwarding those objects to their respective providers. See Also: For more information about setting up a proxy server for Oracle Identity Federation, see Appendix B, Using Oracle HTTP Server as a Proxy for Oracle Identity Federation .