About the Federated SSO Proxy Authentication Engine

Configuring Oracle Identity Federation 5-101

5. When you are done adding mappings, click OK. Then click Apply.

You can configure the default identity provider by following these steps: 1. Log in to Fusion Middleware Control and navigate to the Oracle Identity Federation instance.

2. Navigate to Administration, then Service Provider.

3. Select the Default SSO Identity Provider and click Apply.

5.15.8.3 Configuring the Federated SSO Proxy Authentication Engine

To correctly use the federated SSO proxy authentication engine, you need to configure authentication mechanisms. This might include:

1. Setting the default authentication mechanism

2. Mapping protocol-specific methods to local mechanisms and local mechanisms to

authentication engines

3. Mapping local authentication mechanisms to identity providers

In addition to configuring authentication mechanisms, you will need to configure the federated SSO proxy authentication engine itself. To do this, follow these steps:

1. Log in to Fusion Middleware Control and navigate to the Oracle Identity

Federation instance.

2. Navigate to Administration, then Authentication Engines.

3. In the Federated SSO Proxy tab, select Enable Authentication Engine and choose

the authentication mechanism that will be used to authenticate the user locally when needed. Refer to Section 5.14.1, About Authentication Mechanisms for more information on authentication mechanisms and how authentication mechanisms are mapped to authentication engines.

5.15.9 Authentication Engines - JAAS

The JAAS authentication engine is the default authentication engine for the Oracle Identity Federation server. WARNING: The local authentication mechanism to use when the user needs to be locally authenticated must not be mapped to the Federated SSO Proxy authentication engine. This will create a loop where IdP-1 continuously sends a request to IdP-2. IdP-1 sends a request to IdP-2 and receives an assertion. It needs to authenticate the user locally, and thus maps the mechanism to the Federated SSO Proxy authentication engine, which will prompt it to send a new request to IdP-2. 5-102 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation Use the Enable Authentication Engine check-box to enable or disable this engine. Since JAAS is the default engine, this box is checked by default. To disable the JAAS authentication engine, another engine must be available to serve as the default engine. If necessary, first set up a different authentication engine, then return to this tab to disable the JAAS engine. Updates you make on this tab are saved if you move to tabs for other authentication engines. When you are done, click Apply to save the changes, or Revert to reset the data to its previous state. Creating and Adding Users to the oifusers Group For a user to be authenticated by the JAAS authentication engine, a corresponding user entry must exist in the security realm of the WLS Domain where Oracle Identity Federation is deployed, and must be part of the oifusers group. Follow these steps to create the oifusers group and add new users. 1. Log in to Oracle WebLogic Servers Administration Server console.

2. On the left-hand pane, select Security Realms and navigate to myrealm, then

Users and Groups , then Groups.

3. Click New and enter name oifusers.

4. Navigate to Users and Groups, then Users.

5. Click New and select a name and password.

6. Click the user you just created and select the Groups tab.

7. Select group oifusers and move it to the Chosen column. Click Save.

To enter additional users, repeat steps 4-7. After the group and users have been created, you must restart the Administration server and managed server where Oracle Identity Federation is running in order for the changes to take effect.

5.15.10 Authentication Engines - Custom

On this tab, you can set up a custom authentication engine. Note: The JAAS authentication engine does not support logout. This means that after you configure a provider to use the engine, perform single sign-on between IdP and SP, and issue the Oracle Identity Federation logout URL http:host:portfeduserlogout, the user is not logged out and can repeat the SSO flow without having to log in again. See Also: Getting Started Managing Oracle Fusion Middleware