Configuring JavaEE Security Example of Plug-in and Redirect Page

12 Custom Actions 12-1 12 Custom Actions Custom actions enable site-specific operations to be executed during an Oracle Identity Federation flow before and after an authentication engine or SP integration engine is invoked. Oracle Identity Federation implements custom actions using the pre- and post-processing action plug-ins. This chapter explains how to implement custom actions. ■ Introduction to Custom Actions ■ Pre-processing Custom Action for Authentication Engine ■ Post-processing Custom Action for Authentication Engine ■ Pre-processing Custom Action for SP Integration Engine ■ Post-processing Custom Action for SP Engine

12.1 Introduction to Custom Actions

The pre- and post-processing plug-ins are implemented as JSP or JavaEE servlets, invoked during an authentication flow: ■ before and after invoking an authentication engine ■ before and after invoking an SP integration engine You can use custom actions with all authentication engines and SP integration engines, including custom engines. This section explains how the actions work and how they interact with Oracle Identity Federation: ■ Pre- and Post-Processing Custom Actions for Authentication Engines ■ Pre- and Post-Processing Custom Actions for SP Integration Engines ■ Custom Actions Architecture

12.1.1 Pre- and Post-Processing Custom Actions for Authentication Engines

Oracle Identity Federation invokes an authentication engine to identify the user when required at run-time. The following steps describe the typical flow of events.

1. Oracle Identity Federation takes these steps:

■ determines that the user must be identified Note: Oracle Identity Federation is also referred to here as the federation server. 12-2 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation ■ selects the authentication engine to be used ■ retrieves the location of the authentication engine ■ internally forwards the user to the authentication engine, specifying the root context and the relative path of the engines endpoint 2. The authentication engine, which is a pluggable module that interacts with external authentication providers to establish user identity, takes these steps: ■ interacts with the user to obtain credentials. For example, an LDAP authentication engine displays a login page to accept user credentials, which are then validated against an LDAP directory. ■ if successful, internally forwards the user back to Oracle Identity Federation with the authentication information, which consists of the user identifier and the time at which identity was established. 3. Oracle Identity Federation analyzes the information and creates or updates the user session. You can use custom actions to: ■ manipulate the data exchanged between the federation server and the authentication engine; for example, to construct email address from the username johndoe-johndoemycompany.com ■ perform additional steps during authentication; for example, to contact an external data source or system to obtain more information about the user. To set up a custom action plug-in: ■ implement a pre-processing action plug-in to be performed before invoking the authentication engine ■ implement a post-processing plug-in for any actions or changes to be performed after authentication, when the user is redirected from the authentication engine to Oracle Identity Federation ■ deploy the plug-in to the WebLogic managed server where Oracle Identity Federation is running ■ configure Oracle Identity Federation to invoke the plug-in instead of the authentication engine so that the plug-in can perform pre-processing tasks ■ configure the authentication engine to invoke the plug-in instead of redirecting to Oracle Identity Federation, so that the plug-in can perform post-processing tasks.

12.1.2 Pre- and Post-Processing Custom Actions for SP Integration Engines

When Oracle Identity Federation is acting as a service provider, either: ■ the Identity and Access Management IAM system, for example Oracle Access Manager, invokes Oracle Identity Federation to perform a federated SSO operation to authenticate the user at a remote identity provider, or ■ a remote identity provider initiates a federated SSO operation for the user to access a protected resource in the SP domain Note: If the default out-of-the-box authentication engine is in use, you will need to modify the Oracle Identity Federation configuration; if a custom engine is in use, you will need to update the engine. Custom Actions 12-3 When the IAM system invokes Oracle Identity Federation for federated SSO, the flow is as follows: 1. A user attempts to access a resource protected by the IAM system. 2. The IAM system determines that the user needs to be authenticated by means of a federated SSO operation. 3. The IAM system redirects the user to the Oracle Identity Federation SP engine with which it is integrated. 4. The Oracle Identity Federation SP integration module, which could be a custom module, performs some operations and internally forwards the user to Oracle Identity Federation, specifying the information needed for the operation. For example, it can specify the authentication mechanism to use, the relay state, and so on. 5. Oracle Identity Federation processes the information, triggers the federated SSO operation, and redirects the user to the remote identity provider for authentication. 6. The identity provider identifies the user, creates an assertion, and redirects the user back to Oracle Identity FederationSP. 7. Oracle Identity Federation validates the assertion, maps it to a user in the local domain, and creates an Oracle Identity Federation session for the user. 8. Oracle Identity Federation internally forwards the user back to the SP integration module that triggered the flow or to the default SP integration module in case of an IdP-initiated SSO operation. 9. The SP integration module processes the data, creates a web access session, and redirects the user to the protected resource. 10. The IAM system grants the user access to the resource. You can use custom actions to customize the data exchanged between the federation server and the SP integration module, and perform certain actions in the process. To set up a custom action plug-in: – implement a pre-processing plug-in when actions or changes must occur before the SP Integration Module redirects the user to Oracle Identity Federation to start the flow. – implement a post-processing plug-in when actions or changes must happen after the federated SSO operation, when the user is redirected from Oracle Identity Federation to the SP Integration Module. – deploy the plug-in to the WebLogic Managed Server where Oracle Identity Federation is running – configure the SP integration module to invoke the plug-in instead of redirecting to Oracle Identity Federation, so that the plug-in can perform the custom tasks. Note: If the default out-of-the-box SP integration module is in use, you will need to modify the Oracle Identity Federation configuration; if a custom engine is in use, you will need to update the engine.