Examples of Value Filters

Configuring Oracle Identity Federation 5-67

5.10.1 Security and Trust - Wallet

Signing and encryption certificates for this server instance are stored in wallets. Use this page to manage the signing and encryption wallets. The page shows: ■ The type of the signature wallet; for example, PKCS12 or JKS. ■ The alias of the signing key in the wallet. ■ The type of the previous signature wallet; for example, PKCS12 or JKS. ■ The alias of the previous signing key in previous wallet. ■ The type of the encryption wallet; for example, PKCS12 or JKS. ■ The alias of the encryption key in the wallet. ■ The type of the previous encryption wallet; for example, PKCS12 or JKS. ■ The alias of the previous encryption key in previous wallet. Click Update to modify the wallet information. The Update Wallet dialog requires this information for the signing andor encryption wallet: ■ Wallet Location - You can choose an operating system file containing the wallet. ■ Password - Enter the password that was used to encrypt the private key. ■ Key Password - Only required for JKS and custom Java keystores. ■ Signing Key Alias - the alias under which the private key is stored in the wallet.

5.10.2 Security and Trust - Provider Metadata

Use this page to: ■ specify metadata signing requirements ■ generate updated metadata 5-68 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation Metadata Signing Oracle Identity Federation supports XML digital signatures in the XML metadata documents that describe the services published by a compliant federation server. Oracle Identity Federation provides the following support for metadata signatures: ■ digitally signing the metadata Oracle Identity Federation publishes ■ verifying any XML digital signature present on a metadata document that is being uploaded to the server. If the verification fails, the metadata will not be uploaded. ■ configuring the server to require an XML digital signature on provider metadata in order to upload it to the trusted providers. Use this section of the page to specify metadata signing. Provide the following information: ■ Require Signed Metadata - Check the box to specify that Oracle Identity Federation must require signed metadata when importing a descriptor to the trusted providers. Thus, peer providers must provide signed metadata to the server. ■ Sign Metadata - Check the box to require the Oracle Identity Federation server to sign its metadata. ■ Validity Period - Enter the validity period in days. Click Apply to save the changes, or Revert to reset the fields to their previous state. Generate Metadata Use this section of the page to generate and distribute metadata to peer providers after making any changes to any server configuration that affects metadata. ■ Provider Type - Select the type from the drop-down list. ■ Protocol - Select a protocol from the drop-down list. SAML 1.0, 1.1, and 2.0 protocols are supported for this function. Click Save to generate and distribute the metadata.

5.10.3 Security and Trust - Trusted CAs and CRLs

Oracle Identity Federation maintains a credential store to hold trusted certificates and CRLs. When the certificate validation store is enabled, Oracle Identity Federation uses Note: Liberty 1.x configuration and metadata uploads are available by using the WLST command-line tool.