Reassociating the Credential and Policy Store Using Fusion Middleware Control

30 Configuring Single Sign-on 30-1 30 Configuring Single Sign-on This chapter describes the available single sign-on SSO solutions for your WebCenter Portal application to use, and how each is configured. This chapter includes the following sections: ■ Section 30.1, Introduction to Single Sign-on ■ Section 30.2, Configuring Oracle Access Manager OAM ■ Section 30.3, Configuring Oracle Single Sign-On OSSO ■ Section 30.4, Configuring SAML-based Single Sign-on ■ Section 30.5, Configuring SSO for Microsoft Clients ■ Section 30.6, Configuring SSO with Virtual Hosts Audience The content of this chapter is intended for Fusion Middleware administrators users granted the Admin role through the Oracle WebLogic Server Administration Console. Users with the Monitor or Operator roles can view security information but cannot make changes. See also, Section 1.8, Understanding Administrative Operations, Roles, and Tools.

30.1 Introduction to Single Sign-on

Single sign-on can be implemented for WebCenter applications using several solutions. This section describes their benefits and recommended application. Oracle Access Manager OAM, part of Oracles enterprise class suite of products for identity management and security, provides a wide range of identity administration and security functions, including several single sign-on options for WebCenter Spaces and WebCenter Portal applications. OAM in particular, OAM 11g is the recommended single sign-on solution for Oracle WebCenter 11g installations. For deployment environments that are already invested in Oracle 10g infrastructure, and where the Oracle Application Server Single Sign-On OSSO server is used as the primary SSO solution, WebCenter 11g can also be configured to use OSSO for single sign-on. For non-production, development environments where you do not have an enterprise-class single sign-on infrastructure like Oracle Access Manager or Oracle SSO, and you only need to provide a single sign-on capability within WebCenter Spaces and its associated Web applications like Discussions, and Worklist, you can configure a SAML-based SSO solution. If you need to provide single sign-on for other enterprise applications as well, this solution is not recommended. 30-2 Oracle Fusion Middleware Administrators Guide for Oracle WebCenter If your enterprise uses Microsoft desktop logins that authenticate with a Microsoft domain controller with user accounts in Active Directory, then configuring SSO with Microsoft Clients may also be an option to consider.

30.2 Configuring Oracle Access Manager OAM

Oracle Access Manager OAM provides flexible and extensible authentication and authorization, and provides audit services. This section describes how to configure WebCenter Spaces and WebCenter Portal applications for OAM single sign-on authentication, including how to configure the WebLogic server side and the WebCenter application as the partner application participating in SSO. The installation and configuration steps for OAM 11g and 10g are presented in the following subsections: ■ Section 30.2.1, OAM Components and Topology ■ Section 30.2.2, Roadmap to Configuring OAM ■ Section 30.2.3, Installing and Configuring OAM ■ Section 30.2.4, Configuring the WebLogic Domain for OAM ■ Section 30.2.5, Installing and Configuring the Oracle HTTP Server ■ Section 30.2.6, Additional Single Sign-on Configurations ■ Section 30.2.7, Testing Your OAM Installation

30.2.1 OAM Components and Topology

Figure 30–1 shows the components and topology required to set up single sign-on with Oracle Access Manager for a WebCenter application. Figure 30–1 OAM Single Sign-On Components and Topology Configuring Single Sign-on 30-3 OAM consists of the following components: ■ Access Server - a standalone server that provides authentication, authorization, and auditing services for Access Gates. There is one access server set up on OAM. This is done as part of the OAM install itself. ■ WebGate - an out-of-the-box plugin that intercepts Web resource HTTP requests and forwards them to the Access Server for authentication and authorization. ■ Identity Assertion Provider IAP - a type of security provider that asserts the identity of the user based on header information that is set by perimeter authentication. The OAM integration provides an OAM ID Asserter that can be configured as the OAM IAP. The OAM ID Asserter can be used for authentication or for identity assertion. For OAM SSO integration, the OAM ID Asserter should be configured as an Identity Assertion Provider IAP by selecting obSSOCookie under Active Types in the providers Common settings. OAM Single Sign-on Process Flow Figure 30–2 shows the single sign-on process flow for OAM. Figure 30–2 OAM Single Sign-on Process Flow SSO Log-in Processing with OAM Agents 1. The user requests a resource. 2. The WebGate forwards the request to OAM for policy evaluation. 3. OAM: