Configuring RDBMS Data Compression

6-12 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation The Oracle Identity Federation server can be configured to set the HttpOnly flag when setting in the users browser: ■ the cookie used by Oracle Identity Federation to reference the user session ■ the Oracle Access Manager cookie To configure Oracle Identity Federation to set the HttpOnly header, enter the WLST script environment for Oracle Identity Federation and set the following properties: 1. Set the cookiehttponlyenabled boolean property from the serverconfig group to true if the HttpOnly flag should be set when sending the Oracle Identity Federation cookie to the browser, otherwise set it to false: setConfigPropertyserverconfig, cookiehttponlyenabled, true, boolean 2. Set the oamcookiehttponlyenabled boolean property from the spengines group to true if the HttpOnly flag should be set when sending the Oracle Access Manager cookie to the browser, otherwise set it to false: setConfigPropertyspengines, oamcookiehttponlyenabled, true, boolean

6.7.2 Precautions when Customizing the Page in HTTP Post Profile

The SAMLWS-Fed specifications define a POST profile where a SAMLWS-Federation server will redirect a users browser to a remote SAMLWS-Fed implementation through the use of an HTML form. Typically, such a server would send the browser an HTML page containing a FORM with: ■ the action URL referencing the remote server ■ some hidden fields containing SAMLWS-Fed message, andor some attributes When using that profile, the Oracle Identity Federation server prepares the action URL, the providerID referencing the remote server, and the list of hidden fields to send to the remove server. It then hands over this data to the postprofile.jsp page contained in the web.war of the ORACLE_IDM_ HOMEfedinstalloif.ear file that uses the information to build the HTML page to be presented to the browser. You can customize that page to: ■ Modify what is displayed to the browser ■ Add extra fields to send to the remote server When modifying the file to fit the particular needs of a deployment, be careful not to interfere with the POST profile, which can occur for example if you remove the required parametersfields, such as the action URL or the hidden fields set by the Oracle Identity Federation server. To modify the file, unzip the oif.ear and the web.war, make the modification, and re-package the web.war and EAR file. Note: The remote SAMLWS-Federation server may not be able to process these fields, since they might not be compliant with the specifications. Additional Server Configuration 6-13

6.7.3 Using a 303 Status Code for Redirects

Oracle Identity Federation implements the SAMLWS-FedLiberty protocols that provide single sign-on SSO capabilities to HTTP clients, such as browsers. The protocols and profiles exercised at runtime during SSO operations can involve some HTTP redirects, where the Oracle Identity Federation server issues an HTTP redirect command to the browser. By default, Oracle Identity Federation uses the 302 HTTP status code when issuing a redirect. It is possible to configure the Oracle Identity Federation server to instead use a 303 HTTP status code when issuing a redirect provided the client supports HTTP 1.1. To configure Oracle Identity Federation to use the 303 HTTP status code when possible, enter the WLST script environment for the Oracle Identity Federation instance, and set the following property: ■ Set the redirectuse302 boolean property from the serverconfig group to false if the Oracle Identity Federation server should use 303 HTTP status code when possible: setConfigPropertyserverconfig, redirectuse302, false, boolean ■ otherwise set the property to true.

6.8 Additional Protocol Configuration

This section contains these topics: ■ Configuring for eAuth Mode ■ Configuring the SAML 2.0 LDAP Attribute Profile ■ Configuring On-Demand Global Logout

6.8.1 Configuring for eAuth Mode

You can configure the Oracle Identity Federation server to comply with the eAuth specifications. Most of the configuration is performed through Fusion Middleware Control, but the specifications require the presence of two attributes in the SSO assertion that can only be configured through the MBeansWLST scripts: ■ the us:gov:e-authentication:basic:specVer attribute containing the version of the eAuth specifications supported by this server ■ the us:gov:e-authentication:basic:Sid attribute containing the session identifier of the user performing the single sign-on To configure Oracle Identity Federation to set those two attributes for a specific provider and to set the value of the eAuth version, enter the WLST script environment for Oracle Identity Federation instance, and set the following properties if needed: ■ Set the eauthmodeenabled boolean property for the remote provider to true to enable the eAuth mode: setFederationPropertyREMOTE_PROVIDER_ID, eauthmodeenabled, true, boolean Note: Liberty 1.x support is deprecated.