Securing Access to Oracle Internet Directory Nodes

Configuring the OPSS Security Store 8-21

1. Log in to Fusion Middleware Control and navigate to Domain Security

Security Provider Configuration , or to Cell Security Security Provider Configuration to display the Security Provider Configuration page.

2. Expand, if necessary, the area Identity Store Provider, and click Configure to

display the page Identity Store Configuration. 3. Manage custom properties, as appropriate, using the buttons Add and Delete. 4. When finished, click OK to save your settings and to return to the Security Provider Configuration page.

8.7.2 Configuring Properties and Property Sets

A property set is collection of properties typically used to define the properties of a service instance or generic properties of the domain. For a list of OPSS configuration properties, see Appendix F.2, OPSS Configuration Properties. The elements property and properySet in the file DOMAIN_HOMEconfigfmwconfigjps-config.xml are used to define property and property sets. Property sets can be referenced by the element propertySetRef. To define a property or a property set, proceed as follows:

1. Log in to Fusion Middleware Control and navigate to Domain Security

Security Provider Configuration , or to Cell Security Security Provider Configuration to display the Security Provider Configuration page.

2. Expand, if necessary, the area Advanced Properties, and click Configure to

display the Advanced Properties page, in which you can enter properties and property sets.

3. To enter a property, click Add in the Properties area to display the dialog Add

New Property , and enter a property name and value. When finished, click OK. The entered property appears on the Properties table.

4. To enter a property set, click Add Property Set in the Property Sets area to display

the dialog Add Property Set, and enter the property set name. 5. To enter a property in a property set, select a property set from the existing ones, then click Add Property to display the dialog Add New Property, and then enter a property name and value. The entered property is added to the list of properties in the selected property set.

6. Use the button Delete to remove a selected item from any table. When finished

entering or editing properties and property sets, click OK. 7. Restart the Oracle WebLogic Server. Changes do not take effect until the server has been restarted. The addition or deletion of property sets modifies the domain configuration file DOMAIN_HOMEconfigfmwconfigjps-config.xml; the changes do not take effect until the server is restarted. The elements property and propertySet added by the previous procedure are inserted directly under the element jpsConfig. 8-22 Oracle Fusion Middleware Application Security Guide

8.7.3 Specifying a Single Sign-On Solution

This section explains the OPSS Single Sign-On SSO Framework and how to configure an SSO solution using Fusion Middleware Control, in the following sections: ■ The OPSS SSO Framework ■ Configuring an SSO Solution with Fusion Middleware Control ■ OAM Configuration Example

8.7.3.1 The OPSS SSO Framework

The OPSS SSO Framework provides a way to integrate applications in a domain with an SSO solution. Specifically, it provides applications a common set of APIs across SSO products, to handle login, logout and auto login. One of these solutions, the OAM solution, is available out-of-the-box, and it includes the following features: ■ Dynamic authentication - Upon accessing a part of a secured artifact that requires authentication, the application triggers authentication and redirects the user to be authenticated by the appropriate solution. ■ Auto login - A user who has initially accessed an application anonymously registers an account with the application; upon a successful registration, the user is redirected to the authentication URL; the user can also be automatically logged in without being prompted. ■ Global logout - When a user logs out of one application, the logout propagates across to any other application that is enabled by the solution. For a configuration example of an OAM solution, see OAM Configuration Example . An SSO solution must provide a standard way for applications to login and logout users. After successful authentication, the SSO service is responsible to redirect the user to the appropriate URL. It is assumed that the domain where the solution is applied has been configured to allow the Subject to contain the anonymous user and role before login and after logout, and authenticated roles after login. It is also assumed that the SSO provider has implemented a Credential Mapping Service. In the case of the out-of-the-box OAM solution, the provider implements CredentialMapperService that produces the appropriate OAM token. The OPSS SSO framework does not support multi-level authentication. Integration with the desired SSO solution requires a separate installation and appropriate configuration of the solution. For details about recommended solutions, see Part IV, Single Sign-On Configuration .

8.7.3.2 Configuring an SSO Solution with Fusion Middleware Control

To specify the SSO solution used by a domain, proceed as follows:

1. Log in to Fusion Middleware Control and navigate to Domain Security

Security Provider Configuration or Cell Security Security Provider Configuration to display the Security Provider Configuration page.

2. In that page, click the Configure in the Single Sign-On Provider area to display the

Single Sign-On Provider page.

3. In that page, check the box Configure Single Sign-On, to allow entering data for

the provider. All boxes are grayed out until this box is checked.