Configure Authentication Mechanisms - WS-Federation 1.1

Configuring Oracle Identity Federation 5-89

5.15.1 Authentication Engines - HTTP Header

The HTTP Header authentication engine authenticates a user based on the value of an HTTP header. The typical deployment for such an engine consists of: ■ Oracle Identity Federation server deployed in the domain ■ a web server such as Oracle HTTP Server fronting the WebLogic managed server where Oracle Identity Federation is running see Section 3.2.1, Deploying Oracle Identity Federation with Oracle HTTP Server for details on how to deploy and integrate Oracle HTTP Server if it is not yet installed. ■ a web agent integrated on the web server, protecting the HTTP header authentication engine URL https:oif-host:oif-portfeduserauthnhttp ■ a web agent policy for the HTTP header authentication engine URL that instructs the agent to set the users identity as an HTTP header variable ■ Oracle Identity Federation configured to retrieve the HTTP header variable from the HTTP request that contains the users identity Since the Web agent protects the HTTP header authentication engine URL, any requests processed by the Oracle Identity Federation server on this URL means that the user was authenticated by the Web Access Management system to which the Web agent belongs.

5.15.1.1 Configuring the HTTP Header Authentication Engine

The HTTP Header tab contains these fields: ■ Enable Authentication Engine - Check this box to enable the engine, and uncheck the box to disable the engine. If enabled, this engine appears on the list of available engines in the list-box associated with Default Authentication Engine. ■ User Unique ID Header - When Oracle Identity Federation uses the HTTP header engine as an authentication engine, a Web agent is integrated with Oracle HTTP ServerOracle Identity Federation and protects an Oracle Identity Federation URL. The policy domain for the Oracle Identity Federation URL is configured to provide the user identifier as an HTTP header. Use this field to specify the name of the HTTP header containing the user identifier provided by the Web agent. ■ Logout Enabled - Check this box to enable logouts with this engine. When enabling logouts, related fields include: – Logout URL - The is the URL where Oracle Identity Federation needs to redirect the user for the Web Access Management system logout. Updates you make on this tab are saved if you move to tabs for other authentication engines. When you are done, click Apply to save the changes, or Revert to reset the data to its previous state. 5-90 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation

5.15.1.2 Configuring HTTP Header Attributes

The HTTP Header Attributes module is invoked after a successful local authentication operation that extracts HTTP headers from the users HTTP request and saves them as Oracle Identity Federation session attributes. These attributes in turn can be used to populate a SAML assertion when Oracle Identity Federation acts as an identity provider. Take these steps to configure the HTTP Header Attributes module:

1. In the Authentication Engines section, click Configure to manage the HTTP

Header Attributes module. A window appears that lists the HTTP header attributes that are collected by Oracle Identity Federation after a successful local authentication operation.

2. To add an HTTP header to be collected and saved as a session attribute:

■ Click Add. ■ To retrieve an HTTP header, enter its name in the new field. For example, to retrieve the Accept Language header, enter Accept-Language. ■ To retrieve the value of a cookie presented in the HTTP request, enter the name of the cookie, prefixed with orafed-cookie-. For example, to retrieve the value of the cookie called userLanguageCookie, enter orafed-cookie-userLanguageCookie; at runtime Oracle Identity Federation retrieves the cookie, extracts the value and sets the orafed-cookie-userLanguageCookie session attribute.

3. To delete an HTTP header:

■ Select the HTTP header to remove. ■ Click Delete. 4. Click OK to save the changes. Once the HTTP Header Attributes module is configured, you can configure Oracle Identity Federation to use these session attributes when building assertions, to populate: ■ Name Identifier values in the assertions Subject ■ Attributes in the assertion. For example, the Accept-Language and orafed-cookie-userLanguageCookie can be sent as assertion attributes by listing them in the Attribute Mappings and Filters section of a trusted service provider. The run-time flow looks like this: Note: When the user must be redirected to a Web access management URL for logout to perform some logout operations, you need to configure Oracle Identity Federation by checking Logout Enabled, and entering the URL to which the user is redirected. When Oracle Identity Federation redirects the user to that URL, it appends a return URL as a query parameter; this is the Oracle Identity Federation URL to which the user should be redirected after performing the Web access management logout operations. Oracle Identity Federation appends the query parameter to the Logout URL referenced by returnurl.