An Oracle Internet Directory or Oracle Sun One LDAP directory server configured

16-10 Oracle Fusion Middleware Application Security Guide Defining the wl_authen resource type in Oracle Access Manager is required only when you are using: ■ Oracle Access Manager Authenticator ■ Identity Asserter with Oracle Web Services Manager To define resource types in Oracle Access Manager 10g 1. Go to the Access System Console and log in.

2. Select the Access System Configuration tab, and then click Common Information

Configuration , Resource Type Definitions, to display the List All Resource Types page.

3. On the List All Resource Types page, click Add, to display the Define a new

Resource Type page. 4. Define the resource type with the following details: ■ Name: wl_authen ■ Display name: wl_authen ■ Resource matching: Case insensitive ■ Resource operation: LOGIN 5. Save the resource type you just defined. 6. Proceed as follows: ■ Authenticator : Configuring the Authenticator for Oracle Access Manager 10g on page 16-48 ■ Oracle Web Services Manager : Configuring Identity Assertion for Oracle Web Services Manager and OAM 10g on page 16-48

16.1.2 Configuring Global Logout for Oracle Access Manager 10g and 10g WebGates

This section discusses configuring logout for applications protected by a 10g WebGate with Oracle Access Manager 10g. In Oracle Access Manager 10g, global logout also known as single log out SLO can be handled in various ways. This section describes the recommended method. For more information on killing the ObSSOCookie, see: ■ Recommended Process for Configuring Logout ■ Alternative Process for Configuring Logout

16.1.2.1 Recommended Process for Configuring Logout

There are two steps in the Oracle-recommended approach to configuring logout: ■ Configuring WebGate for Logout using the Sample Logout File ■ Configuring Applications for Logout Note: Oracle Access Manager SSO user session tracking is performed using DOMAIN cookies, specifically the ObSSOCookie. WebGates look for the ObSSOCookie. Global or SLO for Oracle Access Manager simply means killing the ObSSOCookie. Without the ObSSOCookie, WebGates enforce a re-authentication workflow. Configuring Single Sign-On Using Oracle Access Manager 10g 16-11

16.1.2.1.1 Configuring WebGate for Logout using the Sample Logout File

WebGate configuration consist of: ■ logout.html: A logout page must be available on the Web server in the WebGate installation directory: WebGate_install_diroamssologout.html. If the file is located elsewhere on the Web server, ensure that the logout link is correctly specified to load logout.html. See the logout.html in Example 16–1 on page 16-11, which you can customize further depending on your needs. ■ logOutUrls optional: If this parameter has already been configured for the WebGate, the value oamssologout.html must be added to the existing list. ■ Web Server Configuration: Check the Oracle HTTP Server Web server configuration file, httpd.conf, on which the 10g WebGate is configured and delete the following lines if they are present LocationMatch oamsso Satisfy any LocationMatch Use Example 16–1 when you begin constructing a logout.html for logout configuration for an application protected by 10g WebGate in an OAM 10g deployment. Example 16–1 logout.html Script html head script language=javascript type=textjavascript function handleLogout { get protocol used at the server httphttps var webServerProtocol = window.location.protocol; get server host:port var webServerHostPort = window.location.host; get query string present in this URL var origQueryString = window.location.search.substring1; vars to parse the querystring var params = new Array; var par = new Array; var val; if origQueryString = null origQueryString = { params = origQueryString.split; search for end_url and redirect the user to this for var i=0; iparams.length; i++ { par = params[i].split=; if end_url == par[0] { endUrlVal = par[1]; check if val value of end_url begins with or 2F is it an URI? if endUrlVal.substring0,1 == || endUrlVal.substring0,1 == { if endUrlVal.substring0,1 ==