Add Trusted Providers Managing Identity Federations

Server Administration 4-21 1. In Fusion Middleware Control, select the server instance in the topology panel at the left.

2. Navigate to Oracle Identity Federation, then Administration, then Federations.

3. On the Federations page, click Add.

4. Select the option to Add Provider Manually. Fill in the required attributes, and

click OK to add the trusted provider. Fill in the Required Attributes for SAML 1.x You can choose to upload SAML1.x metadata, which can then be generated by Oracle Identity Federation. The peer providers signing certificate and the artifact resolution SOAP endpoint parameters are automatically filled in. Take these steps to achieve this task: 1. On the Federations page, select the SAML 1.X provider and click Edit.

2. Select the option to Update Manually.

3. Select the Trusted Provider Settings tab.

4. If the peer provider is an identity provider: a. In the Identity Provider Authority Settings section enter the peer provider’s signing certificate, in the New Signature Verification Certificate field.

b. In the Initiate SSO URL field, enter the URL used by the peer provider to

initiate the SSO flow.

c. In the Initiate SSO Target Parameter field, enter the parameter used by the

peer provider to identify the desired resource TARGET in the case of Oracle Identity Federation.

d. In the Initiate SSO Provider ID Parameter field, enter the name of the

parameter that the peer provider uses to identify the provider ID of the service provider. For an Oracle Identity Federation peer identity provider, the parameter name must be providerid.

e. In the Artifact Resolution SOAP Endpoint field, enter the URL used by the

peer provider to receive SOAP requests to resolve artifacts

f. In the Artifact Source ID field, enter a source ID parameter. Oracle Identity

FederationSP uses this value to find the users preferred identity provider from its list of known IdPs. If no source ID is specified, Oracle Identity Federation automatically generates it as the SHA-1 digest of the provider ID. For example, an Oracle Identity Federation peer identity provider might have the following Initiate SSO URL, using the configuration entered in steps b, c, and d above: http:saml.example.comfedidpinitiatesso?TARGET=protected -resource-urlproviderid=sp-provider-id-uri 5. If the peer provider is a service provider: a. In the Service Provider Requester Settings section enter the peer provider’s signing certificate, in the New Signature Verification Certificate field.

b. In the Assertion Consumer Service URL field, enter the URL used by the peer

provider to consume the assertion. 4-22 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation Fill in the Required Attributes for WS-Federation SSO Take these steps to achieve this task: 1. On the Federations page, select the WS-Fed 1.1 provider and click Edit.

2. Select the option to Update Manually.

3. Select the Peer Provider Settings tab.

4. If the peer provider is an identity provider: a. In the Identity Provider Authority Settings section enter the peer provider’s signing certificate, in New Signature Verification Certificate field.

b. In the Identity Realm Secure Token URL field, add the URL of the peer

provider to which the authentication request should be sent. 5. If the peer provider is a service provider:

a. In the Resource Realm Secure Token URL field, enter the URL of the peer

provider to which the assertion should be sent. b. From the Assertion TypeVersion drop-down list, select the version of the assertion that should be sent to this service provider. Required Properties to Send to Peer Provider - WS-Federation As IdP needs to send to peer provider SP ■ ProviderID https:server_name:server_portfedidp ■ Signing Certificate ■ Identity Realm Secure Token URL The URL to which authentication requests should be sent https:server_name:server_ port fedidpwsfed11 As SP, needs to send to peer provider IdP ■ ProviderID https:server_name:server_portfedsp ■ Resource Realm Secure Token URL The URL to which assertions should be sent https:server_name:server_portfedspwsfed11 ■ Assertion TypeVersion The version of the assertion to be sent; optional Required Properties to Send to Peer Provider - SAML 1.x The IdP needs to send to peer provider SP ■ ProviderID https:server_name:server_portfedidp ■ Signing Certificate ■ IdP initiate SSO URL the URL to which authentication requests should be sent For SAML 1.1: https:server_name:server_portfedidpsamlv11sso For SAML 1.0: https:server_name:server_portfedidpsamlv10sso ■ IdP Artifact resolution URL URL for sending artifact query https:server_name:server_portfedidpsoapv11