Proxy Server Architecture Options

Planning Oracle Identity Federation Deployment 2-3

2.1.3 Server Security

Oracle Identity Federation provides secure communication using: ■ SSL Encryption ■ Certificate-based Authentication ■ Certificate Repository and Validation

2.1.3.1 SSL Encryption

Oracle Identity Federation provides secure SSL communication between partner domains. SSL encryption is an option you can enable or disable for the server instance at installation time.

2.1.3.2 Certificate-based Authentication

For initial setup and testing, identity providers and service providers can use default self-signed certificates. Before going into production, however, you will want to ensure that your installation is set up to use third-party CA certificates.

2.1.3.3 Certificate Repository and Validation

Oracle Identity Federation provides a repository where you can store a list of trusted CAs and certificate revocation lists CRLs. If certificate validation is enabled for the server, Oracle Identity Federation will validate every certificate used to verify incoming signatures for the SAML and WS-Federation protocols. To validate a certificate, the server tries to locate the certificate or its issuer as a trusted certificate, and checks that the certificate is not in a CRL.

2.1.4 Protocol

When installing Oracle Identity Federation, you must decide the federation protocols that your server will support. Oracle Identity Federation works with these protocols: ■ SAML 1.0 ■ SAML 1.1 ■ SAML 2.0 ■ WS-Federation ■ OpenID As the Oracle Identity Federation administrator, you must determine which federation protocols you will utilize for your server. Note: For more information about SSL configuration, see Section 8.1.1.1, Setting up SSL on Oracle WebLogic Server See Also: ■ Section 5.10.2, Security and Trust - Provider Metadata for information about enabling certificate validation ■ Section 5.10.1, Security and Trust - Wallet for details about the certificate repository 2-4 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation For more information, refer to Section 1.1.4, Federation Protocols .

2.2 Profiles and Bindings

This section discusses profiles and bindings, and contains these topics: ■ Supported Protocols ■ Choosing a Profile

2.2.1 Supported Protocols

Having selected the protocols your federation server instance will support, you must choose which protocol profiles, security transport bindings, and other features you will implement. This section outlines Oracle Identity Federation protocol support.

2.2.1.1 SAML 2.0 Protocol

Table 2–1 shows the SAML 2.0 protocol profiles and security transport binding combinations that Oracle Identity Federation supports.

2.2.1.2 SAML 1.x and WS-Federation Protocol

Table 2–2 shows the SAML 1.x and WS-Federation WS-Fed protocol profiles and security transport binding combinations that Oracle Identity Federation supports. Table 2–1 Oracle Identity Federation Profiles and Bindings for SAML 2.0 Function Profiles Bindings SAML 2.0 Single Sign-On Artifact x Single Sign-On HTTP Post x Logout HTTP Redirect x Logout HTTP Post x Name ID Registration HTTP Redirect x Name ID Registration HTTP Post x Name ID Registration SOAP x Federation Termination HTTP Redirect x Federation Termination HTTP Post x Federation Termination SOAP x Attribute Retrieval SOAP x Table 2–2 Oracle Identity Federation Profiles and Bindings for SAML 1.x and WS-Federation Function Profiles Bindings SAML 1.01.1 WS-Federation Single Sign-On Artifact x Single Sign-On HTTP Post x x