Validating Target URLs for SSO and Logout Operations

6-30 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation When an error occurs, the server returns an error code 404, 401 or 500 showing the Oracle WebLogic Server error page to the user. You can configure Oracle Identity Federation to redirect the user to a custom page based on the error code. Set the string property or urlerrornnn from the serverconfig configuration group to the URL to which the user should be redirected when Oracle Identity Federation returns the error, where nnn is 401, 404, or 500. Thus, you can set the urlerror401, urlerror404, and urlerror500 properties.

6.13.4 Configuring Schema Validation for SSO Protocol Messages

Oracle Identity Federation supports XML schema validation for SSO protocol messages. This feature is implemented with the schemavalidationenabled property; validation is off by default. To enable schema validation, enter the script environment for the Oracle Identity Federation server instance, and set the schemavalidationenabled property to true: setConfigPropertyserverconfig,schemavalidationenabled,true,boolean To disable validation, set the property to false default value. setConfigPropertyserverconfig,schemavalidationenabled,false,boolean

6.14 Additional Federation Data Store Configuration

When Oracle Identity Federation is configured to use an LDAP server or an RDBMS as its federation data store, the server performs various operations to create, locate, update, or delete federation records. A federation record typically consists of the following data: ■ IdP NameID: name identifier data created by the identity provider and used in the SAML messages ■ SP NameID: name identifier data optionally set by the service provider during a Name Identifier Management update operation. If that NameID is set, it is used in SAML messages; otherwise, the IdP NameID is used. Notes: ■ 401 errors occur during Fed SSO operation if the federated SSO fails. ■ 404 errors are raised when the user tries to access one of the Oracle Identity Federation servlets fedidp, fedsp, feduser... and the page is not found. ■ 500 errors occur when fatal exceptions occur at runtime. ■ If the server cannot initialize correctly, Oracle Identity Federation is unable to redirect the user to the urlerror500 URL. Additional Server Configuration 6-31 During an operation that consumes an assertion, when Oracle Identity Federation acts as a service provider, the server tries to locate the federation record referenced in the NameID element contained in the assertion. By default, it first performs a lookup based on the SP NameID; if no results are returned, it performs a lookup based on the IdP NameID. In some deployments, Oracle Identity Federation: ■ might not be configured to do any NameID Management protocol exchanges, and ■ might not have any of its federation records updated to set an SP NameID that is, the administrator never performed an update operation on any federation records using the administrative tools In this case, the first federation record lookup performed during assertion consumption using the SP NameID will never return any records and serves to increase the response time. If SP NameID lookup is not needed, it is possible to disable it to improve performance. To enable or disable the lookup, enter the WLST script environment for Oracle Identity Federation and make this configuration change: ■ Set the fedusespnameidlookup boolean property from the datastore group to true to enable the SP NameID lookup. ■ Set the fedusespnameidlookup boolean property from the datastore group to false to disable the SP NameID lookup For example: setConfigPropertydatastore, fedusespnameidlookup, false, boolean

6.15 Setting up Backwards Compatibility for Oracle Identity Federation 10g and ShareID service URLs

Background Oracle Identity Federation 10g, and SHAREidCOREid Federation 2.x, provided service URLs for SAML 1.x and WS-Federation protocol support which were different from the SAML 2.0 and Liberty 1.x service URLs. These URLs have been modified in the 11g Oracle Identity Federation for consistency with the SAML 2.0 and Liberty 1.x service URLs. Customers upgrading to Oracle Identity Federation 11g, who use SAML 1.x or WS-Federation, must inform their partner providers of the new single sign-on service URLs. To ease that transition, Oracle Identity Federation 11g provides a separate module that allows backwards compatibility with the SHAREid service URLs. This module is a JavaEE application you can deploy alongside Oracle Identity Federation, to handle requests for the ShareIDOracle Identity Federation 10g service URLs and redirectforward them to the corresponding Oracle Identity Federation 11g service URLs. Note: By default, the SP NameID lookup is enabled. Note: Liberty 1.x support is deprecated.