Launch the Logout Process

4-18 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation For details, see: ■ Section 5.6, Configuring Attribute Sharing with the Oracle Access Manager AuthZ Plug-in ■ Section 4.3.5, Set Up Single Sign-On for SAML 1.x and WS-Federation You can also configure attribute name and value mapping, and attribute filtering. See Section 5.9, Configuring Attribute Mapping and Filtering for details. When Oracle Identity Federation, acting as an identity provider, receives a SAML 1.x attribute query, it will need to identify the requester. Oracle Identity Federation provides two ways in which a requester can be identified: by providing an SSL client certificate, or by authenticating with HTTP basic authentication. If the requester authenticates by means of an SSL client certificate, the cn of the certificate subject must be the provider ID with which Oracle Identity Federation identifies the requester. If the requester authenticates through HTTP basic authentication, the username used by the requester must be the provider ID with which Oracle Identity Federation identifies the requester. For details on how to set up SSL with client authentication or HTTP basic authentication, see Section 6.9, Protecting the SOAP Endpoint .

4.2.8.1 NameID Format Strings when Using the Attribute Requester Service

The strings to be used for the NameID format when using the Attribute Requester service are:

4.2.9 Send Authentication Queries SAML 1.x

To send SAML 1.x authentication queries to an Oracle Identity Federation instance acting as an IdP, use a URL of the form: http:host:portfedauthnauthsoapv11 When Oracle Identity Federation, acting as an identity provider, receives a SAML 1.x authentication query, it must identify the requester. Oracle Identity Federation provides two ways in which a requester can be identified: by providing an SSL client certificate, or by authenticating through HTTP basic authentication. If the requester authenticates using an SSL client certificate, the cn of the certificate subject must be the provider ID with which Oracle Identity Federation identifies the requester. If the requester authenticates through HTTP basic authentication, the Table 4–2 NameID Formats for Attribute Requester Service Format String x509 oracle:security:nameid:format:x509 email oracle:security:nameid:format:emailaddress windows oracle:security:nameid:format:windowsdomainqualifiedname kerberos oracle:security:nameid:format:kerberos persistent oracle:security:nameid:format:persistent transient oracle:security:nameid:format:transient unspecified oracle:security:nameid:format:unspecified custom oracle:security:nameid:format:custom userid oracle:security:nameid:format:userid Server Administration 4-19 username used by the requester must be the provider ID with which Oracle Identity Federation identifies the requester. For details on how to set up SSL with client authentication or HTTP basic authentication, see Section 6.9, Protecting the SOAP Endpoint .

4.3 Managing Identity Federations

You use Oracle Identity Federation server’s Federations page in Fusion Middleware Control to view and manage the server’s trusted providers. To view the page in Fusion Middleware Control, select the instance of interest, and navigate to Oracle Identity Federation, then Administration, then Federations. Topics in this section include: ■ Search for a Provider ■ Add Trusted Providers ■ Update Trusted Providers ■ Delete Trusted Providers ■ Set Up Single Sign-On for SAML 1.x and WS-Federation

4.3.1 Search for a Provider

Use this feature to locate a provider from your trusted providers. In the text box, enter the Provider ID, or the provider description. Click the search icon. You can enter a partial Provider ID or description. For example, enter a port number to display only servers that listen on the specified port.

4.3.2 Add Trusted Providers

To add a trusted provider to your server’s trusted providers:

1. In Fusion Middleware Control, select the server instance in the topology panel at

left.

2. Navigate to Oracle Identity Federation, then Administration, then Federations.

3. On the Federations page, click Add.

The Add Trusted Provider dialog appears. You can supply the provider details here or upload from the file system.