Pre- and Post-Processing Custom Actions for SP Integration Engines

Custom Actions 12-5 7. The SP engine creates a use session in the IAM domain, and redirects the user to the protected resource.

12.1.3.2 Flow for Oracle Identity Federation Authenticating User

When Oracle Identity Federation needs to authenticate a user, the flow is as follows:

1. Oracle Identity Federation, as part of a runtime flow, determines that it needs to

locally authenticate the user. It invokes the pre-processing plug-in for the authentication engine to perform some custom tasks.

2. The pre-processing plug-in invokes the authentication engine.

3. The authentication engine uses the IAM domain to challenge and identify the user.

4. The authentication engine bundles the authentication data and invokes the

post-processing plug-in for the authentication engine to perform some custom tasks.

5. The post-processing plug-in for authentication engine invokes Oracle Identity

Federation, providing the authentication data.

6. Oracle Identity Federation resumes operations.

12.2 Pre-processing Custom Action for Authentication Engine

The pre-processing plug-in is a module to which the user is directed, as part of an authentication operation, before invoking the authentication engine. The plug-in enables custom actions to be taken before authentication. When the plug-in is in use, Oracle Identity Federation does not redirect the user to the authentication engine; rather, it forwards the user internally to the plug-in, passing it certain data for use during authentication. After performing its custom actions, the plug-in forwards the user to the correct authentication engine, along with the data originally provided by the federation server, to resume the authentication flow.

12.2.1 Implementing the Pre-processing Custom Action

Custom Action Interaction with Oracle Identity Federation When Oracle Identity Federation redirects a user to the authentication engine, it passes certain data to the engine as attributes on the HttpServletRequest object. The same data is made available to pre-processing plug-ins: ■ the authentication mechanism to use when challenging the user for identification String, identified by oracle.security.fed.authn.authnmech ■ an identifier referencing the action being performed String, identified by oracle.security.fed.authn.refid ■ the ProviderID and the description of the remote service provider for which this local authentication is requested, if a federated SSO operation is performed String, identified by oracle.security.fed.authn.providerid and oracle.security.fed.authn.providerdescription respectively ■ the identifier referencing the engine used to authenticate the user String, identified by oracle.security.fed.authn.engineid ■ the identifier of the user, if set String, identified by oracle.security.fed.authn.userid 12-6 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation ■ the Force Authentication flag, indicating whether the engine should challenge the user even if the user is already authenticated. If missing, false is assumed. Boolean, identified by oracle.security.fed.authn.forceauthn ■ the Is Passive flag, indicating whether the engine is allowed to visually interact with the user. If missing, false is assumed Boolean, identified by oracle.security.fed.authn.passive ■ Optionally, a map of attributes that need to be set by the engine; these attributes are required so that Oracle Identity FederationIdP can create the assertion with the AttributeStatement, as specified by the configuration for that specific remote provider. identified by oracle.security.fed.authn.attributes When Oracle Identity Federation receives and processes an SSO assertion, but is not able to map the assertion to a local user, the server requests that the user be locally authenticated. The map then contains this data from the assertion: – orafed-nameid-value – the users Name ID value – orafed-nameid-qualifier – the users Name ID qualifier – orafed-nameid-format – the users Name ID format – orafed-providerid – the IdPs ProviderID – orafed-assertionid - the ID of the assertion – orafed-xmlmessage - the optional XML message containing the assertion ■ Optionally, the Oracle Identity Federation session identifier, if the user already has an active session. Oracle Identity Federation passes the session identifier of the existing user session to the authentication engine, so that the engine can persist the state linked to the user, and refer to that data using the sessionID value. String, identified by oracle.security.fed.sessionid Later, when the logout flow is executed, Oracle Identity Federation passes the session identifier to the engine, so that the engine can delete the data used for this user session. Forwarding the User to the Authentication Engine After processing, the pre-processing plug-in must forward the user to the correct authentication engine the engine that Oracle Identity Federation would invoke in the absence of the plug-in. You can use the oracle.security.fed.authn.engineid attribute present in the HttpServletRequest object to determine the path to which the user must be internally forwarded. The possible engine ID values are shown in Table 12–1 : See Also: Section 10.3.2, Developing and Implementing the Authentication Module . Table 12–1 Engine IDs for Authentication Engines Engine ID Meaning osso Invoke the Oracle Single Sign-On engine by performing a forward to the endpoint referenced by fed as the root context and userauthnosso as the relative path oam Invoke the Oracle Access Manager engine by performing a forward to the endpoint referenced by fed as the root context and userauthnoam as the relative path ldap Invoke the LDAP engine by performing a forward to the endpoint referenced by fed as the root context and userauthnldap as the relative path Custom Actions 12-7

12.2.2 Configuring Oracle Identity Federation for the Custom Action

Configure Oracle Identity Federation to forward the user to a pre-processing plug-in by performing these tasks: ■ identify the authentication engine whose flow will be modified. Choices are: Oracle SSO, OAM, LDAP, RDBMS Security, RDBMS Table, Proxy, JAAS and Infocard engines ■ Create or set the following two properties: – the web context property, referencing the web context where the custom JSP Page or servlet of the pre-processing plug-in resides. This property is located in the authnengines group of the Oracle Identity Federation configuration. – the relative path property referencing the path in the web context where the custom plug-in resides. Table 12–2 shows how to set the properties for each authentication engine: rdbmssec Invoke the RDBMS security engine by performing a forward to the endpoint referenced by fed as the root context and userauthnrdbmssec as the relative path rdbmstable Invoke the RDBMS table engine by performing a forward to the endpoint referenced by fed as the root context and userauthnrdbmstb as the relative path jaas Invoke the JAAS engine by performing a forward to the endpoint referenced by fed as the root context and userauthnjaas as the relative path infocard Invoke the Infocard engine by performing a forward to the endpoint referenced by fed as the root context and userauthnic as the relative path proxy Invoke the Fed SSO Proxy engine by performing a forward to the endpoint referenced by fed as the root context and userauthnproxy as the relative path httpheader Invoke the HTTP Header engine by performing a forward to the endpoint referenced by fed as the root context and userauthnhttp as the relative path Notes: ■ The plug-in must provide the authentication engine with the data that was passed to the plug-in as part of the authentication flow namely, the attributes that were set on the HttpServletRequest object. ■ The plug-in can modify all attributes that were set on the HttpServletRequest object except for the oracle.security.fed.authn.authnmech, oracle.security.fed.authn.refid and oracle.security.fed.authn.engineid attributes. Table 12–1 Cont. Engine IDs for Authentication Engines Engine ID Meaning