Example 3: Complex Assertion Mapping without Federated Identities with an LDAPSQL Query

6-38 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation In this example, Oracle Identity Federation SP is set up for attribute-based authentication for an IdP referenced by http:idp.com. Perform the following steps to configure Oracle Identity FederationSP: 1. Log in to Fusion Middleware Control.

2. Navigate to Administration, then Federations.

3. Select the identity provider and click Update.

4. Click the Oracle Identity Federation Settings tab.

5. Expand the Service ProviderRequester Settings section, and go to assertion

settings.

6. Uncheck Map User via Federated Identity.

7. Check Map User via Attribute Query.

8. Enter the following LDAP query in the Attribute Query field: mail=emailsn=lastname

9. Uncheck Map User via NameID.

10. Check Error when User Mapping fails; this forces Oracle Identity Federation to

return a 401 error to the browser if the user cannot be located. 11. Apply the changes.

6.17 Automatic Account Linking Based on Attribute Query Mapping

Automatic account linking at the SP allows the service provider to directly map an identity contained in an assertion to a user. When Oracle Identity Federation is acting as a service provider, and is configured to use federated identities to map the incoming SAML 2.0 assertion, it can automatically create a federation record by locating a user based on the attributes and name identifier received in an assertion. This section contains topics related to account linking: ■ Locating the User ■ Configuring Oracle Identity Federation ■ Example 1: Automatic Account Linking through NameID mapping for SAML 2.0 ■ Example 2: Simple Automatic Account Linking through LDAPSQL Query ■ Example 3: Complex Automatic Account Linking through LDAPSQLQuery ■ Example 4: Automatic Account Linking through LDAPSQL Query and NameID Mapping ■ Example 5: Automatic Account Linking via Attribute Query for a Specific IdP

6.17.1 Locating the User

When configured to use federated identities and Automatic Account Linking is enabled, the administrator has two options for locating a user record in the repository: ■ Using the Name ID Format mapping, where the NameID is linked to a user attribute. This uses the existing mapping. ■ Using an LDAPSQL query that involves the NameID and the attributes stored in the assertion. Additional Server Configuration 6-39 If both options are enabled, Oracle Identity FederationSP first uses the NameID mapping search, and if no results are returned, it uses the LDAPSQL query flow. If Oracle Identity FederationSP cannot locate the user record during this flow, the server challenges the user for credentials. The administrator specifies in Oracle Identity Federation configuration the LDAPSQL query to be used when trying to look up a user. The query contains placeholders that are replaced by the attribute and NameID values contained in the assertion. The placeholders use a NAME format in which Oracle Identity FederationSP replaces NAME with: ■ An attribute name, referencing an attribute contained in the assertion. When creating the query, Oracle Identity FederationSP replaces AttributeName with the value of the attribute referenced by AttributeName. ■ orafed-nameid-value - Oracle Identity Federation replaces this placeholder with the Name ID value ■ orafed-nameid-qualifier - Oracle Identity Federation replaces this placeholder with the Name ID qualifier ■ orafed-nameid-format - Oracle Identity Federation replaces this placeholder with the Name ID format ■ orafed-providerid - Oracle Identity Federation replaces this placeholder with the Peer ProviderID

6.17.2 Configuring Oracle Identity Federation

Only the SAML 2.0 module supports the use of federated identities, not the SAML 1.x modules. To configure Oracle Identity Federation to use federated identities for assertion to user mapping, and to enable automatic account linking operations:

1. Log in to Fusion Middleware Control.

2. Navigate to Administration, then Service Provider, then SAML 2.0, then Assertion Settings .

3. Check Map User via Federated Identity.

4. Check Enable Auto Account Linking.

To map a user using the NameID:

1. Log in to Fusion Middleware Control.

2. Navigate to Administration, then Service Provider, then SAML 2.0, then Assertion Settings .

3. Check Map User via NameID.

4. Configure the NameID Format enabled and the attribute in the user record to be

used during the lookup procedure of the automatic account linking operation. To map a user using an LDAPRDBMS query: Note: The attribute mapping module maps the attributes contained in the assertion to the attribute namevalues configured for the remote provider. The attribute name needs to reference an attribute from the list.