Configuring Identity Provider to send attributes in SSO Assertions
a. Clicking the Enabled box next to the
formats you wish to enable. b. Mapping each format to an attribute in the user data store. 4. Click Apply. See Also: Section 5.6.5, Configuring Oracle Identity Federation as an SP Attribute Requester for instructions on how to configure the default attribute authority and the SubjectDN to IdP mappingsParts
» Oracle Fusion Middleware Online Documentation Library
» Challenges of Identity Federation
» Federation Use Cases Federated Identity Management
» Concepts Federated Identity Management
» SAML Basics Federation Protocols
» Evolution of the Federated Identity Standards SAML 1.x
» Features and Benefits of Oracle Identity Federation
» Architecture About Oracle Identity Federation
» High-Level Processing Flow About Oracle Identity Federation
» Browser POST Profile Federation Protocol Profiles
» Browser Artifact Profile Federation Protocol Profiles
» SOAP Binding Federation Protocol Profiles
» Browser HTTP Redirect Profile
» Name Identifier Management Profiles
» SAML Attribute Sharing Profile
» OpenID Profiles and Extensions
» Affiliations About Oracle Identity Federation
» Cryptographic Provider Example of Federation Event Flow Supported Standards and Applications
» Role in Federation Architecture Options
» Proxy Server Architecture Options
» SAML 2.0 Protocol SAML 1.x and WS-Federation Protocol
» OpenID 2.0 Protocol Supported Protocols
» Secure HTTP HTTPS is required to transmit a user request from a browser to the
» The identity provider must use an XML signature to sign responses it sends to a
» The service provider must verify the XML signature on the response.
» Using the SAML Attribute Sharing Profile
» Using the WS-Federation Logout Profile Using OpenID Profiles and Extensions
» Engines in Oracle Identity Federation Authenticating with a Repository
» Propagating Authentication State to Oracle Single Sign-On in SP Mode
» HTTP Basic Authentication Authentication Engines
» Federation Data Store Data Repositories
» User Data Store Data Repositories
» Session and Message Data Stores Configuration Data Store
» Required Components Installation Requirements
» Profiles Deployment and Architecture Considerations
» Repositories Deployment and Architecture Considerations
» Transient Session and Message Storage
» Security for Assertions Deployment and Architecture Considerations
» Connection Tuning Deployment and Architecture Considerations
» High Availability Deployment and Architecture Considerations
» Typical Deployment Scenario Reference Server Footprint Topology
» Implementation Checklist Oracle Fusion Middleware Online Documentation Library
» Introduction Oracle Fusion Middleware Online Documentation Library
» Install Oracle HTTP Server Manage the Oracle HTTP Server Instance
» Associate Oracle HTTP Server with Managed Server
» Log in to Fusion Middleware Control and navigate to the Oracle Identity
» Navigate to Administration, then Server Properties.
» Change the hostname to reflect the hostname configured in OHS, if they are
» Change the PortSSL Enabled and SOAP PortSSL Enabled information to reflect
» Save the changes. Update Oracle Identity Federation Configuration
» Since the Oracle Identity Federation metadata has changed, redistribute the
» Navigate to Administration, then Service Provider Integration Modules, then
» Click Regenerate OSSO Secret to create an encryption key that will be saved in a
» Navigate to Administration, then Authentication Engines, then Oracle SSO.
» Create and Manage the Oracle HTTP Server Instance Configure Oracle Single Sign-On
» Go to the Oracle Access Manager console and navigate to the Policy Manager.
» In the Authorization Rule, go to the Actions tab, click Modify and in the
» Navigate to Administration, then Authentication Engines, then Oracle Access
» Check the Logout Enabled box if logout needs to be enabled recommended.
» Check the Clear Cookie box if resetting the Oracle Access Manager cookie is
» Check Redirect to Logout URL and fill in the URL if Oracle Identity Federation
» Expand the Oracle Access Manager Properties section.
» Enter the default authorization rule that will be used when creating the policy
» The available Oracle Identity Federation authentication mechanisms are listed in
» Click Configure Oracle Access Manager.
» Deploying Oracle Identity Federation with Oracle Access Manager 11g
» Authentication Overview Oracle Identity FederationSP Authenticating to Oracle Access Manager
» Select and click Update for all the federation schemes that were created in Oracle
» Click Add to add a new step.
» Select the second credential_mapping plugin and click add.
» Select the validate_password plugin and click add.
» Requirements Deploying Oracle Identity Federation with Oracle Directory Server Enterprise Edition
» Configuring Oracle Identity Federation Without a Web Proxy Server
» Configuring Oracle Identity Federation Behind a Web Proxy Server
» Navigate to Administration, then Service Provider Integration Modules.
» In the Test SP tab, selectunselect Enable Engine.
» Select Default SP Integration Module to be Test SP Note: The test SP engine
» Use the Test SP Engine for SP-Initiated SSO
» Use the Test SP Engine with IdP-Initiated SSO
» 11g Server Signing Certificate
» About Roles Deployment Planning
» Other Planning Tasks About the Oracle Identity Federation Server Administrator
» Administering Oracle Identity Federation
» Oracle Identity Federation Log Files
» Versions Provider-specific Metadata Obtain Server Metadata
» Specifying Certificate Usage Obtain Server Certificates
» Perform SP-initiated Single Sign-On
» Perform IdP-initiated Single Sign-On
» Send Authentication Queries SAML 1.x
» Add Trusted Providers Managing Identity Federations
» Update Trusted Providers Delete Trusted Providers
» Set Up Single Sign-On for SAML 1.x and WS-Federation
» In the Initiate SSO URL field, enter the URL used by the peer provider to
» In the Initiate SSO Target Parameter field, enter the parameter used by the
» In the Initiate SSO Provider ID Parameter field, enter the name of the
» In the Artifact Resolution SOAP Endpoint field, enter the URL used by the
» In the Artifact Source ID field, enter a source ID parameter. Oracle Identity
» In the Assertion Consumer Service URL field, enter the URL used by the peer
» About Federated Identities Identities - Federations
» Identities - Users Identities - Search Options
» Managing Credentials for Oracle Identity Federation
» Server Configuration Data Data Maintained by Oracle Identity Federation
» User Federation Data Data Maintained by Oracle Identity Federation
» Host Connection Properties Configuring Server Properties
» Outbound Connection Properties Configuring Server Properties
» Configuring Identity Providers - Common Properties
» Configure SAML 2.0 IdP Properties
» Configure SAML 1.x IdP Properties
» Configure WS-Federation IdP Properties Configure OpenID IdP Properties
» Configure Service Provider - Common Properties
» Configure SAML 2.0 SP Properties
» Configure SAML 1.x SP Properties
» Configure WS-Federation 1.1 SP Properties
» Configure OpenID SP Properties
» Components Used for Attribute Sharing
» Click Add and fill out the Define a new Authorization Scheme form:
» Log in to Oracle Access Manager as a Master or Delegated Access Administrator.
» Fill out the General panel form:
» Select the Authorization Rules panel and add an authorization rule for each set of
» Configuring Oracle Identity Federation as an IdP Attribute Responder
» Configuring Oracle Identity Federation for SSL
» Configuring Identity Provider to send attributes in SSO Assertions
» Overview of the Service Interface
» Attribute Request Message Web Services Interface for Attribute Sharing
» Attribute Response Message Clicking the Enabled box next to the
» Interface WSDL Clicking the Enabled box next to the
» Attribute Name Mapping Introduction to Attribute Mapping and Filtering
» Attribute Value Mapping Introduction to Attribute Mapping and Filtering
» Attribute Value Filtering Introduction to Attribute Mapping and Filtering
» Under the Name Mappings tab, click Add to add an attribute name mapping, with
» Under the Value Mappings tab, click Add to add an attribute value mapping,
» Security and Trust - Wallet Security and Trust - Provider Metadata
» Security and Trust - Trusted CAs and CRLs
» Navigate to Services, then JDBC, then Data Sources.
» Click New. Configuring Oracle Identity Federation for RDBMS User Data Store
» Navigate to Administration, then Data Stores.
» In the User Data Store section, click Edit.
» Select Database from the Repository Type dropdown list.
» Enter the following properties:
» Click OK. Configuring Oracle Identity Federation for RDBMS User Data Store
» Navigate to Administration, then Data Stores. In the User Data Store section, click Edit.
» Select LDAP Directory from the Repository Type dropdown list.
» Configuring Oracle Virtual Directory as User Data Store
» In the user data store configuration, in the Server URL field, enter a list of
» Click OK. Configuring No User Data Store
» Click New. Configuring Oracle Identity Federation for an RDMBS Federation Data Store
» In the Federation Data Store section, click Edit.
» Configuring Oracle Identity Federation for an LDAP Federation Data Store
» Manage the Session Data Store and the Message Data Store
» In the Configuration Data Store section, click Edit.
» Select File System from the Repository Type dropdown list.
» Click New. Using an RDBMS Configuration Data Store
» Click OK. Using an RDBMS Configuration Data Store
» When the RDBMS Configuration Data Store is Down
» Create the Oracle Identity Federation Schema Using RCU
» Configure Authentication Mechanisms - Local
» Configure Authentication Mechanisms - SAML 2.0
» Configure Authentication Mechanisms - SAML 1.x
» Configure Authentication Mechanisms - WS-Federation 1.1
» Configuring the HTTP Header Authentication Engine
» In the Authentication Engines section, click Configure to manage the HTTP
» To add an HTTP header to be collected and saved as a session attribute:
» Authentication Engines - Oracle Single Sign-On
» Authentication Engines - Oracle Access Manager
» Authentication Engines - Database Security
» User ID: The unique identifier with which the user will be identified in Oracle
» Click Apply. Configuring Oracle Identity Federation for RDBMS Authentication Engine
» Authentication Engines - Infocard
» About the Federated SSO Proxy Authentication Engine
» Navigate to Administration, then Service Provider.
» In Protocol Settings, click on Configure SSO Authentication Mechanism to
» Click Add, and select the authentication mechanism and the identity provider to
» When you are done adding mappings, click OK. Then click Apply.
» Select the Default SSO Identity Provider and click Apply.
» Setting the default authentication mechanism
» Mapping protocol-specific methods to local mechanisms and local mechanisms to
» Mapping local authentication mechanisms to identity providers
» Navigate to Administration, then Authentication Engines.
» In the Federated SSO Proxy tab, select Enable Authentication Engine and choose
» Authentication Engines - JAAS
» Authentication Engines - Custom
» SP Integration module - Oracle Single Sign-On
» SP Integration module - Oracle Access Manager
» SP Integration module - Test SP Engine
» SP Integration Module - Custom
» Oracle Single Sign-On Setting up Single Sign-On Services
» Oracle Access Manager Setting up Single Sign-On Services
» SP-initiated SSO Setting up Single Sign-On Services
» IdP-initiated SSO Setting up Single Sign-On Services
» Working with Affiliations Oracle Fusion Middleware Online Documentation Library
» Configuring the LDAP Inactivity Setting
» Configuring the LDAP Read Timeout Setting
» ECID Support for LDAP Connections
» Configuring High Availability LDAP Servers
» Configuring the HTTP Session State SleepRetry Interval
» Configuring RDBMS Session Cache
» Configuring RDBMS Data Compression
» Storing Assertion Attributes of User Session
» Configuring HTTP-Only Flag for HTTP Cookies Set by Oracle Identity Federation
» Precautions when Customizing the Page in HTTP Post Profile
» Using a 303 Status Code for Redirects
» Configuring the SAML 2.0 LDAP Attribute Profile Configuring On-Demand Global Logout
» On the left-hand pane, select Security Realm, and navigate to myrealm, then
» Select the following settings:
» On the left-hand pane, select Security Realms and navigate to myrealm, then
» Click New and select a name for example, soapusers. Click OK.
» Click Sav Oracle Fusion Middleware Online Documentation Library
» Preliminary Steps to Set Up the CDC
» Create the IdP Discovery Service Page
» Set up JCE Policy Files for Oracle WebLogic Server
» Infocard Authentication requires SSL. Configure SSL on Oracle WebLogic Server
» For the Oracle Identity Federation encryption wallet, use the SSL keystore used for
» Load the SSL Java keystore as the Oracle Identity Federation encryption wallet.
» Navigate to IdM Data Stores, then Authentication Engines, and enable the
» Navigate to Administration, then Federations, and add a WS-Fed 1 IdP
» Select the STS, click Update, then select Update Manually.
» From the SSOInfocard Mode drop-down, select either Infocard if the STS only
» Click the Certification Path tab.
» Click Install Certificates, and import the certificate in the trusted root
» Go to the Windows control panel.
» Double-click Windows Cardspace if it is not present, install .NET from the
» Select Create a Personal Card and fill in the fields.
» Save the changes. Create a Personal Infocard
» Validating Target URLs for SSO and Logout Operations
» Providing XML Message to SP Engine after SSO Completes
» Customizing Error Pages Additional Run-time Configuration
» Configuring Schema Validation for SSO Protocol Messages
» Additional Federation Data Store Configuration
» Setting up Backwards Compatibility for Oracle Identity Federation 10g and ShareID service URLs
» Locating a User Mapping Users through Attributes and NameID in SP Mode
» Configuring Oracle Identity Federation
» Example 1: Assertion Mapping without federated identities using NameID for SAML 2.0
» Example 2: Simple Assertion Mapping without Federated Identities with an LDAPSQL Query
» Example 3: Complex Assertion Mapping without Federated Identities with an LDAPSQL Query
» Example 5: Assertion Mapping without Federated Identities for a Specific IdP
» Locating the User Automatic Account Linking Based on Attribute Query Mapping
» Example 1: Automatic Account Linking through NameID mapping for SAML 2.0
» Example 2: Simple Automatic Account Linking through LDAPSQL Query
» Example 5: Automatic Account Linking via Attribute Query for a Specific IdP
» Modes of Operation Configuring Oracle Identity Federation
» Example 1: Off Mode User Opt-In and Opt-Out for Single Sign-On
» Example 2: Opt-In Mode Example 3: Opt-Out Mode
» Example 4: Opt-In Mode for a Specific IdP
» Overriding NameID Mapping Per Partner
» Configuring Audience Restrictions for Assertions
» Certificate Path Validation Oracle Fusion Middleware Online Documentation Library
» Oracle Identity Federation Home Page
» About Sensor Weights Performance Summary
» Event Metrics Performance Summary
» State Events Performance Summary
» Phase Events Performance Summary
» Availability Oracle Fusion Middleware Online Documentation Library
» Types of Logs About Oracle Identity Federation Logging
» Log Levels About Oracle Identity Federation Logging
» Message IDs About Oracle Identity Federation Logging
» thread interrupt Messages Common Log Messages
» Audit Levels About Auditing in Oracle Identity Federation
» In the Audit Level menu, select Custom as the audit level.
» Click Save. Go to the Keystores tab, and click Lock Edit.
» Click Save. Setting up SSL on Oracle WebLogic Server
» Go to the SSL tab. In the Identity section, fill in properties as follows:
» Go to the SSL tab, then Advanced.
» Click Save, and click Activate Changes.
» Update the port and SOAP port, if necessary to reflect the SSL port configured in
» Check the SSL Enabled checkbox.
» To force the use of SSL if a request is received at a non-SSL port, check the Force
» To force client authentication, check the Require Client Certificate box. Leave
» Click Apply. Configuring Oracle Identity Federation
» Log in to the Oracle WebLogic Server administration console and navigate to
» Select the server for which you want to set up SSL.
» Go to the Keystores tab, and click Lock Edit.
» In Keystores, select an option that includes Custom Identity and the Trust
» In the Trust section, fill in the properties with the Trust Keystore information.
» Click Save, then click Activate Changes.
» Alternative Way to Configure Oracle Identity Federation as SSL Client
» Connecting to an LDAP Server over SSL
» Setting up JCE Policy Files for Oracle WebLogic Server
» Setting up the WLST Environment
» Executing the Commands Introduction to Command-Line Tools for Oracle Identity Federation
» Description Syntax Example addConfigMapEntryInMap
» Description Syntax Example addConfigPropertyMapEntry
» Description Syntax Example addCustomSPEngine
» Description Syntax Example addFederationMapEntryInMap
» Description Syntax Example addFederationPropertyMapEntry
» Description Syntax Example changeMessageStore
» Description Syntax Example createConfigPropertyList
» Description Syntax Example createConfigPropertyMap
» Description Syntax Example createFederationPropertyMapInMap
» Description Syntax Example getConfigListValueInMap
» Description Syntax Example getConfigProperty
» Description Syntax Example getFederationProperty
» Description Syntax Example getFederationPropertyMapEntry
» Description Syntax Example loadMetadata
» Description Syntax Example removeConfigMapInMap
» Description Syntax Example removeConfigPropertyList
» Description Syntax Example removeFederationMapEntryInMap
» Description Syntax Example removeFederationPropertyList
» Description Syntax Example removePeerProviderEntry
» Background for Custom Implementations
» Architecture Architecture and Flows
» Authentication Engine Framework Architecture and Flows
» SP Integration Engine Framework
» Logout Architecture and Flows
» Requirements Architecture and Flows
» Planning a Custom Authentication Engine
» Developing and Implementing the Authentication Module
» Sample Authentication Module for Oracle Single Sign-On Integration
» Sample Authentication Module for LDAP Integration
» Planning a Custom SP Integration Engine
» Path URLs Developing and Implementing the Integration Module
» Navigate to Administration then SP Integration Modules. Click the Custom SP
» To add an SP integration engine, click Add and enter a name for that SP
» To modify an SP integration engine, select it and:
» Implementing the Service Developing and Implementing the Integration Module
» Sample Integration Modules Creating a Custom SP Integration Engine
» Sample Integration Module 1: Oracle WebLogic Server JavaEE Container Integration
» Sample Integration Module 2: Customized Single Sign-On Integration
» Changing Logout Flow Sample Logout Services Logout Service Example 1
» Logout Service Example 2 Logout
» Basic Flow of Business Processing Plug-in
» Configuring the Business Processing Plug-in Packaging the Plug-in
» Configuring JavaEE Security Example of Plug-in and Redirect Page
» Business Processing Plug-in API
» Pre- and Post-Processing Custom Actions for Authentication Engines
» Pre- and Post-Processing Custom Actions for SP Integration Engines
» Flow for Oracle Identity Federation as SP
» Oracle Identity Federation, as part of a runtime flow, determines that it needs to
» The pre-processing plug-in invokes the authentication engine.
» The authentication engine uses the IAM domain to challenge and identify the user.
» The authentication engine bundles the authentication data and invokes the
» The post-processing plug-in for authentication engine invokes Oracle Identity
» Oracle Identity Federation resumes operations.
» Implementing the Pre-processing Custom Action
» Configuring Oracle Identity Federation for the Custom Action
» Implementing the Post-processing Plug-in
» Configuring Oracle Identity Federation for the Plug-in
» Set-up Example of a Post-processing Custom Action
» Packaging Example of a Post-processing Custom Action
» Oracle Identity Federation Configuration
» Implementation of cookieextract.jsp
» Implementing the Pre-processing Plug-in
» Setup Example of a Pre-processing Plug-in
Show more