Using the SAML Attribute Sharing Profile

Planning Oracle Identity Federation Deployment 2-13 Oracle Identity Federation provides the attribute sharing profile for use with Oracle Access Manager to enable interoperation with SAML implementations at peer sites. For details about components and their respective roles, and how to configure Oracle Identity Federation and Oracle Access Manager, see Section 5.6.4.3, Configuring an Oracle Access Manager Policy using Attribute Sharing .

2.2.2.5 Using the WS-Federation Logout Profile

WS-Federation can be used to sign into one or more service providers using an identity provider that performs the actual authentication. To log out, the user clicks on a link at the IdP site that initiates a WS-Federation signout. Using a session cookie, Oracle Identity Federation has kept track of each SP to which the user signed on. The server returns an HTML signout page to the user’s browser. Each SP processes the signout cleanup to sign out the session created for Oracle Identity Federation.

2.2.2.6 Using OpenID Profiles and Extensions

This section describes Oracle Identity Federation support for different OpenID profiles and extensions. Attribute Exchange AX AX is an OpenID 2.0 extension allowing user attributes to be requested and returned. OIF supports AX version 1.0. Support on the IdP includes the following: ■ Profile support is enabled on the IdP, but for each SP, you must indicate whether attributes should be sent ■ Attribute definition is achieved through the existing screen on the SP Partner specific page Support on the SP includes the following: ■ Attribute definition is achieved through the existing screen on the IdP Partner specific page ■ In the attribute definition page, you can specify which attributes to request from the IdP when performing the SSO protocol. ■ A custom SP engine or a pre-processing engine can dictate at run-time which attributes must be requested from the IdP when performing the SSO protocol. Provider Authentication Policy Extension PAPE PAPE is an OpenID 2.0 extension allowing RPs to request specific authentication typestrength, including Levels of Assurance. Oracle Identity Federation supports PAPE version 1.0. Support on the IdPOP includes the following: ■ The IdP publishes in the XRDS document whether or not the PAPE extension is enabled. ■ If enabled, the IdP includes the authentication mechanism used to authenticate the user in the response to the SP. Support on the SPRP includes the following: 2-14 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation ■ If the IdP supports PAPE, and if configured to request a specific authentication mechanism, the SP indicates the mechanism to use to authenticate the user at the IdP. US Government Federal Identity, Credentialing and Access Management ICAM Profile Oracle Identity Federation supports these privacy policy and security requirements for the US Government for OpenID 2.0 deployments: ■ No Personal Identification Information referenced by the http:www.idmanagement.govdocumentsICAM_ OpenID20Profile.pdf URI. When enabled and specified in the protocol exchange, the IdP cannot include any personal information in the response to the SP. ■ Private Personal Identifier referenced by the http:schemas.xmlsoap.orgws200505identityclaimsprivate personalidentifier URI. When enabled and specified in the protocol exchange, the IdP must return an opaque ClaimedID specific to the RP. ■ GSA Profile for OpenID referenced by the http:www.idmanagement.govdocumentsICAM_ OpenID20Profile.pdf URI. When enabled and specified in the protocol exchange, the IdP must follow GSA profile rules when performing the OpenID SSO protocol. ■ NIST authentication levels referenced by the http:csrc.nist.govpublicationsnistpubs800-63SP800-63V1_ 0_2.pdf URI. When enabled, the IdP includes the NIST Level Of Assurance information in the response to the SP. OpenID Profile Request Processing Figure 2–6 shows the request processing under the OpenID profile: Note: The Oracle Identity Federation authentication mechanism is translated to OpenID authentication methods. Note: While these profiles can be enabled on Oracle Identity Federation, you must ensure that the federation server complies with the requirements.