Error 401: Unable to Access the Application Error 403: Unable to Access the Application

17 Configuring Single Sign-On using OracleAS SSO 10g 17-1 17 Configuring Single Sign-On using OracleAS SSO 10g The chapter describes how to implement SSO using OracleAS SSO OSSO 10g. It includes the following major sections: ■ Deploying the OracleAS 10g Single Sign-On OSSO Solution ■ Synchronizing the User and SSO Sessions: SSO Synchronization Filter ■ Troubleshooting for an OSSO Identity Asserter Deployment

17.1 Deploying the OracleAS 10g Single Sign-On OSSO Solution

The OracleAS Single Sign-On solution provides single sign-on access to Web Applications. Oracle Internet Directory is the LDAP-based repository. This solution is intended for applications that have been deployed on Oracle WebLogic Server but do not yet have single sign-on implemented. Requirements and steps to configure the OSSO solution are explained in New Users of the OSSO Identity Asserter on page 17-4. Applications that are already using the OracleAS Single Sign-On solution with the JPS login module and dynamically re-directing requests to OSSO are unaffected by the new OSSO solution. In this case, there is no need to configure the new OSSO Authentication Provider described in this section. This section is divided as follows: ■ Using the OSSO Identity Asserter ■ New Users of the OSSO Identity Asserter ■ Troubleshooting for an OSSO Identity Asserter Deployment

17.1.1 Using the OSSO Identity Asserter

This section describes the expected behavior when you implement the OracleAS Single Sign-On Identity Asserter. This section is divided as follows: ■ Oracle WebLogic Security Framework Note: Oracle recommends using Oracle Access Manager 11g, as described in Introduction to Oracle Access Manager 11g SSO on page 15-1. 17-2 Oracle Fusion Middleware Application Security Guide ■ OSSO Identity Asserter Processing ■ Consumption of Headers with OSSO Identity Asserter

17.1.1.1 Oracle WebLogic Security Framework

Figure 17–1 illustrates the location of components in the Oracle WebLogic Security Framework, including the OSSO Identity Asserter. Additional details follow. Figure 17–1 Location of OSSO Components in the Oracle WebLogic Security Framework At the top of the figure, Oracle HTTP Server is installed. This installation includes mod_weblogic and mod_osso, which are required to pass the identity token to the Providers and Oracle WebLogic Server. The Oracle WebLogic Server includes the partner application and the Identity Asserter also known as the Identity Assertion Provider. The 10g OracleAS Single Sign-On server OSSO Server, on the right side of the figure, communicates directly with the directory server and Oracle HTTP Server.

17.1.1.2 OSSO Identity Asserter Processing

Figure 17–2 illustrates the processing that occurs when you have OSSO implemented with the Identity Asserter. Additional details follow the figure. Note: For simplicity in text, this chapter uses the generic name of the WebLogic Server plug-in for Apache: mod_weblogic. For Oracle HTTP Server, the name of this plug-in differs from release 10g to 11g: ■ Oracle HTTP Server 10g: mod_wl actual binary name is mod_wl_ 20.so ■ Oracle HTTP Server 11g: mod_wl_ohs actual binary name is mod_wl_ohs.so