Configure SAML 1.x SP Properties

5-30 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation ■ Enable SAML 1.0 Protocol - Check the box to enable this protocol for the SP. ■ Enable Protocol Bindings - Use the drop-down to select the binding to use. ■ Messages to SendRequire Signed - Use this table when configuring a service provider to specify which message types that provider should send signed

5.5.4 Configure WS-Federation 1.1 SP Properties

Use this page to configure Oracle Identity Federation to use the WS-Federation 1.1 protocol when acting as a service provider. Provide the following information: ■ Enable WS-Federation 1.1 Protocol - Check the box to enable WS-Federation 1.1 protocol for the provider. ■ Request Authentication Context Mechanism - Use the drop-down to select the authentication mechanism that will be sent in the authentication request to the identity provider. Click Apply to save your changes, or Revert to restore the screen to its previous values.

5.5.5 Configure OpenID SP Properties

Use this page to configure the OpenID protocol in SP mode. Note: Although your configuration changes are saved when you click Apply, at least one of the protocol boxes must also be checked to ensure that the changes on this page are effective. See Also: Section 2.2.1.3, OpenID 2.0 Protocol . Configuring Oracle Identity Federation 5-31 Assertion Settings The assertion setting fields are as follows: ■ Map User via Federated Identity - Check this box to specify that the RP will use federated identities to map the incoming assertion to a user record. If not checked, user lookup is based on the assertion data. ■ Enable Auto Account Linking - Check this box to specify that the RPSP should try to map the incoming assertion to a user record when the federated identity does not exist. The mapping uses the assertion data. ■ Map User via Attribute Query - Check to enable assertion-to-user mapping through LDAPRDBMS query, and use the associated Attribute Query field. ■ Error when user Mapping fails - Check this box to display a 401 error if mapping of the incoming assertion to a user record using the assertion data fails. If not checked, the RP invokes the authentication engine to authenticate, identify, and provision the user, and the operation resumes after return from the authentication engine. Note: The authentication mechanism configured for the SP that started the flow determines which authentication engine is invoked. ■ Require Signed Assertions - Indicates whether the RPSP requires the incoming assertion to be signed. Protocol Settings The protocol setting fields are as follows: ■ Enable OpenID 2.0 Protocol - Check this box to enable the OpenID 2.0 protocol. ■ Perform OpenID Provider Discovery - Check this box to specify that the RP should discover the OP from discovery URL to initiate the SSO operation. Discovery will determine the features supported by the OP and create the authentication request accordingly. If discovery is disabled, the OpenID provider SSO URL must be 5-32 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation specified and the authentication request format is based solely on the RP configuration. ■ Force User Consent - Check this box to prompt the user for consent for any new federation that is, new ClaimedID created between the IdPOP, the RPSP and the user. ■ Default Authentication Mechanism - Holds the local authentication mechanism to use as the authentication method to authenticate the user at the IdPOP, if the assertion uses the PAPE authentication policy. ■ Enabled Session Types - Use the drop-down to list the enabled session types that can be used during the association exchange. Possible values: – no-encryption – dh-sha1 – dh-sha256 ■ Enabled Association Session Types - Use the drop-down to list the enabled association types that the OP supports. Possible values: – hmac-sha1 – hmac-sha256 ■ Default Association Session Type - Specify the default association session type from one of the enabled types. ■ Force User Consent - Check the box to prompt the user for consent for any new federation that is, new ClaimedID created between the OP, the RP, and the user. ■ Force User Consent Web Context - Contains the Web context of the OpenID consent page to be used instead of the Oracle Identity Federation OpenID built-in consent page. ■ Generate Diffie-Hellman parameters when initiating associations - Check the box to generate Diffie-Hellman parameters when initiating association of types DH-SHA1 or DH-SHA256. If not checked, default values are used. ■ Enable PAPE 1.0 - Check this box to enable the PAPE 1.0 extension. With this feature you can specify one or more of: – US Government Level of Assurance Policy – PPID Policy – US Government OpenID Trust Level 1 Policy – US Government No PII Policy

5.6 Configuring Attribute Sharing with the Oracle Access Manager AuthZ Plug-in

Attribute sharing is a joint feature of Oracle Access Manager and Oracle Identity Federation that implements the SAML Attribute Sharing Profile for X.509 Authentication-Based Systems. In this profile, a user who requests a protected resource or service is authenticated with SSL client X.509 certificates, but authorization Note: Changes in session type andor association session type require restart of the Oracle Identity Federation server.