Authenticating with an IdM Solution in IdP Mode Propagating Authentication State to Oracle Access Manager in SP Mode

2-18 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation Figure 2–9 Authenticating with Oracle Access Manager in SP Mode The flow for authenticating a user at a peer provider with Oracle Access Manager is as follows: ■ The user is at the peer IdP Step 1. ■ The IdP redirects the user to Oracle Identity Federation as SP with an authentication assertion Steps 2,3. ■ Oracle Identity Federation processes the assertion, creates a local Oracle Identity Federation session, and forwards the user to the authentication module with the identification Step 4. ■ The authentication module interacts with Oracle Access Manager to create an Oracle Access Manager authenticated session Step 5. ■ The authentication module redirects the user to the protected resource Step 6. ■ WebGate Web Agent grant the user access to the protected resource Step 7.

2.3.5 Propagating Authentication State to Oracle Single Sign-On in SP Mode

In this mode, Oracle Identity Federation uses the federation protocols to identify a user, and requests the authentication module to create an authenticated session at Oracle Single Sign-On so that the user can access the requested resource, which is protected by mod_osso. The request originates at a peer IdP, and Oracle Identity Federation authenticates in SP mode. Planning Oracle Identity Federation Deployment 2-19 Figure 2–10 Authenticating with Oracle Single Sign-On in SP Mode The flow for authenticating a user at a peer provider with Oracle Single Sign-On is as follows: ■ The user is at the peer IdP Step 1. ■ The IdP redirects the user to Oracle Identity Federation as SP with an authentication assertion Steps 2,3. ■ Oracle Identity Federation processes the assertion, creates a local Oracle Identity Federation session, and forwards the user to the authentication module with the identification Step 4. ■ The authentication module redirects the user to Oracle Single Sign-On with the user identification Steps 5,6. ■ Oracle Single Sign-On creates a local authenticated session and grants access to the resource protected by mod_osso Steps 7,8.

2.3.6 HTTP Basic Authentication

Oracle Identity Federation can be configured to accept HTTP basic credentials without requiring an identity and access management system. This corresponds to using the JAAS authentication engine. Note: For more information about an environment where Oracle Identity Federation and Oracle Single Sign-On protect resources and either component can be the authentication mechanism, see Integrating with Oracle Identity Federation in Oracle Application Server Single Sign-On Administrators Guide.