Ensure that the parameter Control Flag is set to OPTIONAL initially.

16-62 Oracle Fusion Middleware Application Security Guide Expression tab : Select the authorization rule you created in Step 6: Select Authorization Rule: Default_OAM_IA_OWS_AuthZ_Rule Click Add. Click Save. Actions tab : In Step 6 you defined to whom the Allow Access part of a rule applies. Here, you specify actions for Authorization success for both rules and expressions. Click Actions, click Add, and then create a return action on Authorization Success with the following to specify what actions should be invoked when authorization succeeds. Authorization Success: Applies to Allow Access conditions. Return Type: WL_REALM Return Name: uid Return Attribute: uid Click Save.

8. Policies Tab

: No policies are needed. Default Rules apply.

9. Delegated Access Admins

: When adding URL prefixes to a policy domain, the Delegated Access Administrator must specify a server hosting the URL prefix. 10. Validate Policy Domain: Click My Policy Domains, click the new policy domain you created, then click View As a Page to see all specifications at once. 11. Proceed with Configuring Oracle Web Services Manager Policies for Web Services .

16.6.2 Configuring Oracle Web Services Manager Policies for Web Services

This section provides an overview of configuring Oracle Web Services Manager policies to protect Web services. To use the Identity Asserter with Oracle Web Services Manager, you must set up a Web service with the oraclewss_oam_token_service_policy and a corresponding client with the oraclewss_oam_token_client_policy in Oracle Web Services Manager. Note: Return Attribute uid should match the value of the login parameter for the user name to help identify the user uniquely in the Oracle Access Manager LDAP repository. Here, uid is the canonical name of the login attribute. If your LDAP directory uses a different attribute as the login attribute, the Name should still be uid. However, the Return Attribute would be whatever your login attribute is configured as mail, for example. Be careful to put these values under Return Attribute not Return Value. See Also: Oracle Access Manager Access Administration Guide, Delegating Policy Domain Administration Configuring Single Sign-On Using Oracle Access Manager 10g 16-63 About oraclewss_oam_token_service_policy This Oracle Web Services Manager policy contains the policy assertion oraclewss_ oam_token_service_template. This template uses the credentials in the WS-Security headers binary security token to authenticate users against the Oracle Access Manager identity store. The Oracle Access Manager Identity Asserter uses the ObSSOCookie token to assert the identity of users who try to access a Web service protected by the oraclewss_ oam_token_service_policy policy. A Web service that is protected by this policy must be presented with an ObSSOCookie token in a SOAP header. That is, the Web service consumes the ObSSOCookie token; it is not involved in how the token is generated. Specifically, the WebLogic Server security service detects the token type and invokes the Oracle Access Manager Identity Asserter. The Oracle Access Manager Identity Asserter then validates the ObSSOCookie token against the Oracle Access Manager Access Server and obtains the username. The username is populated as the principal in the authenticated subject. The Web service client, for example the Web application, must obtain the ObSSOCookie token to send it to the Web service. This is typically done using an AccessGate. AccessGate challenges the Web service client user for credentials depending on the authentication scheme configured in Oracle Access Manager and authenticates the user. The WebGate sends the ObSSOCookie to the users browser upon successful authentication The Web service client then sends the ObSSOCookie token in the SOAP request to the Web service. About oraclewss_oam_token_client_policy This Oracle Web Services Manager policy contains the following policy assertion: oraclewss_oam_token_client_template. This template inserts Oracle Access Manager credentials into the WS-Security header as part of the binary security token. oraclewss_oam_token_client_policy is the analogous client policy to the oraclewss_oam_token_service_policy service endpoint policy. This policy can be enforced on any SOAP-based endpoint. The following task overview outlines the procedures you must perform. Task overview: Setting policies in Oracle Web Services Manager 1. Using Oracle Web Services Manager, set up a Web service with the oraclewss_ oam_token_service_policy policy. 2. Using Oracle Web Services Manager, set up a corresponding client for the Web service with the oraclewss_oam_token_client_policy policy. 3. Configuring Providers in a WebLogic Domain for Oracle Web Services Manager . Note: Settings for the wss_oam_token_service_template are identical to the client version of the assertion: wss_oam_token_ client_template. Identity store configuration for the service template is identical to the client version of the assertion. See Also: Oracle Fusion Middleware Security and Administrators Guide for Web Services ■ Configuring Policies ■ Predefined Assertion Templates