Navigate to IdM Data Stores, then Authentication Engines, and enable the

6-26 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation returned in the assertion from the WS-Trust server. The User Attribute Name is used to reference that attribute in Oracle Identity Federation, Assertion Attribute Name is the name of the attribute recognized by the STS, and FormatNamespace is the namespace to which the attribute is bound. The required claim from Oracle Identity Federation to the STS is the concatenation of the namespace, , and the assertion attribute name. For example: ■ Add an attribute entry User Attr Name=lastname, Assertion Attr Name=surname, Format or Namespace=http:schemas.xmlsoap.orgws200505identityclaims. Check the Require From Infocard box. ■ Add another attribute entry with User Attr Name=firstname, Assertion Attr Name=givenname, Format or Namespace=http:schemas.xmlsoap.orgws200505identityclaims. Check the Require From Infocard box. 6. Configure Oracle Identity Federation to map the assertion that the Personal Card Issuer will provide to a local user. For example, in the Oracle Identity Federation Settings tab, in the Assertion Setting tabs, uncheck the Map User via NameID box, check Map User via Attribute Query and enter the following LDAP query: sn=lastnamegivenname=firstname 7. Save the changes.

8. Check or uncheck the Supports Authentication Mechanism Claims box to

indicate whether the authentication mechanism should be listed as a required Infocard attribute. Not all WS-Trust servers support the ability to specify the requested authentication mechanism through the use of attributes. 9. Save the changes.

6.12.1.4 Add Infocard Managed STS

For Oracle Identity Federation to accept an assertion from a remote STS, the Oracle Identity Federation server needs to have a trust relationship with the remote server. This trust is established by having the STS defined and enabled in the servers federations. In Fusion Middleware Control, locate the Oracle Identity Federation instance and perform the following operations: 1. Add an entry by entering the STS provider ID, selecting IdP and the WS-Fed 1.1 version.

2. Select the STS, and click Update.

3. Enter the IdP signature verification certificate.

4. From the SSOInfocard Mode drop-down, select either Infocard if the STS only

supports Infocard protocol, or Single Sign-On and Infocard if the STS supports both Infocard and SSO protocols. 5. Infocard states that the relying party Oracle Identity Federation in the present case must list the attributes or claims that the STS should include in the assertion it creates. With the attributes and the optional NameID contained in the assertion, the Oracle Identity Federation server can map the assertion to a local user record if configured for that operation. Additional Server Configuration 6-27 To add attributes to be requested for the STS, click Attribute Mappings. 6. Configure attribute mapping to list the attributes that the Oracle Identity Federation server will require when the card selector is invoked. For each attribute marked Require from Infocard, Oracle Identity Federation requires the given attribute be returned in the assertion from the WS-Trust server. The User Attribute Name is used to reference that attribute in Oracle Identity Federation, Assertion Attribute Name is the name of the attribute recognized by the STS, and FormatNamespace is the namespace to which the attribute is bound. The required claim from Oracle Identity Federation to the STS is the concatenation of the Namespace, , and the assertion attribute name. For example: ■ Add an attribute entry with User Attr Name=lastname, Assertion Attr Name=surname, Format or Namespace=http:schemas.xmlsoap.orgws200505identityc laims. Check the Require From Infocard box. ■ Add another attribute entry for User Attr Name=firstname, Assertion Attr Name=givenname, Format or Namespace=http:schemas.xmlsoap.orgws200505identityc laims. Check the Require From Infocard box. 7. Configure Oracle Identity Federation to map the assertion that is provided by the Personal Card Issuer to a local user. For example, in the Oracle Identity Federation Settings tab, in the Assertion Setting tabs, uncheck the Map User via NameID box, check Map User via Attribute Query and enter the following LDAP query: sn=lastnamegivenname=firstname 8. Save the changes.

6.12.2 Client-side Infocard Setup

This section contains these topics: ■ Import the Oracle Identity Federation SSL Certificate ■ Create a Personal Infocard

6.12.2.1 Import the Oracle Identity Federation SSL Certificate

The client machine must trust the Oracle Identity Federation SSL certificate for Windows Cardspace to trust Oracle Identity Federation and allow the user to use Infocards stored on the local computer. If the client does not trust the certificate authority that generated the SSL server, you must import the certificate. Take these steps to import the certificate: 1. Using Internet Explorer, navigate to the URL with format https:host:port. 2. Right-click on the page.

3. Select Properties.

4. Select Certificates.

5. Click the Certification Path tab.

6. Select the CA that issued the certificate and view the certificate.