Locating the User Automatic Account Linking Based on Attribute Query Mapping

6-40 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation 1. Log in to Fusion Middleware Control. 2. Navigate to Administration, then Service Provider, then SAML 2.0, then Assertion Settings .

3. Check Map User via Attribute Query.

4. Enter the LDAP or SQL query to be used during the lookup procedure of the automatic account linking operation.

6.17.3 Example 1: Automatic Account Linking through NameID mapping for SAML 2.0

In this example, Oracle Identity FederationSP uses the NameID contained in the assertion to look up a local user in the LDAP user data store. The format of the NameID is emailAddress, and the search uses the mail attribute of the LDAP user record. The server is configured to use the NameID mapping functionality to locate the user during automatic account linking. Perform the following steps to configure Oracle Identity FederationSP: 1. Log in to Fusion Middleware Control. 2. Navigate to Administration, then Service Provider, then SAML 2.0, then Assertion Settings .

3. Check Map User via Federated Identity.

4. Check Map Enable Auto Account Linking.

5. Uncheck Map User via Attribute Query.

6. Check Map User via NameID.

7. Enable Email Address NameID Format, and enter the attribute of the user record

holding the email address mail typically for LDAP server. 8. Apply the changes.

6.17.4 Example 2: Simple Automatic Account Linking through LDAPSQL Query

In this example, Oracle Identity FederationSP uses the NameID contained in the assertion to look up a local user in the LDAP user data store and automatically create the federation record. The format of the NameID is emailAddress, and the search uses the mail attribute of the LDAP user record. The server is configured to use the LDAPSQL query functionality to locate the user. Perform the following steps to configure Oracle Identity FederationSP: 1. Log in to Fusion Middleware Control. 2. Navigate to Administration, then Service Provider, then SAML 2.0, then Assertion Settings .

3. Check Map User via Federated Identity.

4. Check Map Enable Auto Account Linking.

5. Check Map User via Attribute Query.

6. Set the attribute query to mail=orafed-nameid-value

7. Uncheck Map User via NameID.

8. Apply the changes. Additional Server Configuration 6-41

6.17.5 Example 3: Complex Automatic Account Linking through LDAPSQLQuery

In this example, Oracle Identity FederationSP uses the email address and the last name SAML attributes in the assertion to look up a local user in the LDAP user data store and automatically creates the federation record. The local attributes mail and sn from the LDAP user record are used. The attributes in the assertion are referenced as email and lastname. Oracle Identity FederationSP is not configured for attribute name mapping, so the LDAP query uses the attribute names contained in the SAML assertion; if attribute name mapping were configured, the LDAP query would use the names resulting from attribute name mapping refer to Section 5.9, Configuring Attribute Mapping and Filtering for more information on Attribute Name Mapping. The server is configured to use the LDAPSQL query functionality to locate the user. Perform the following steps to configure Oracle Identity FederationSP:

1. Log in to Fusion Middleware Control.

2. Navigate to Administration, then Service Provider, then SAML 2.0, then Assertion Settings 3. Check Map User via Federated Identity. 4. Check Map Enable Auto Account Linking. 5. Check Map User via Attribute Query. 6. Set the Attribute Query to mail=emailsn=lastname.

7. Uncheck Map User via NameID.

8. Apply the changes.

6.17.6 Example 4: Automatic Account Linking through LDAPSQL Query and NameID Mapping

In this example, Oracle Identity FederationSP uses the email address contained in the NameID to locate the user to create the federation record. If the operation fails, Oracle Identity FederationSP uses the last name SAML attribute from the assertion to look up a local user in the LDAP user data store. The local attributes mail and sn from the LDAP user record are used. The server is configured to use the NameID Mapping and LDAPSQL Query features to locate the user. Perform the following steps to configure Oracle Identity FederationSP: 1. Log in to Fusion Middleware Control. 2. Navigate to Administration, then Service Provider, then SAML 2.0, then Assertion Settings .

3. Check Map User via Federated Identity.

4. Check Map Enable Auto Account Linking.

5. Check Map User via Attribute Query.

6. Set the Attribute Query to sn=lastname.

7. Check Map User via NameID.

8. Enable Email Address NameID Format, and enter the attribute of the user record

holding the email address mail typically for LDAP server.