Use the Test SP Engine for SP-Initiated SSO

Deploying Oracle Identity Federation 3-31 ■ Use Default Configuration: If checked, Oracle Identity Federation will use the default configuration for the following properties: – Allow Federation Creation – SSO Response Binding – Name ID Format – Requested Authentication Mechanism – Authentication Mechanism Comparison If not checked, the following applies: – Allow Federation Creation: If not checked, the identity provider must not create a federation for the user, if one does not exist. Applies only to SAML 2.0 protocol – SSO Response Binding: This specifies the binding that the service provider will request the identity provider to use when sending the response. Applies only to SAML protocols – Name ID Format: This specifies the Name ID format that the service provider will request the identity provider to use when locating or creating a federation for the user. Applies only to SAML 2.0 protocol. – Requested Authentication Mechanism: This specifies the local authentication mechanism that the service provider will use. The service provider will map this local mechanism to a protocol-specific method, and specify this method in its authentication request to the identity provider. See Section 5.14.1, About Authentication Mechanisms . Applies only to SAML 2.0WS-Fed protocols. – Authentication Mechanism Comparison: If using SAML 2.0, specifies the comparator that the identity provider will use when determining the authentication mechanism to use. Options are: EXACT: the identity provider must use the requested authentication mechanism MINIMUM: the identity provider must use a mechanism that is at least as strong as the requested authentication mechanism BETTER: the identity provider must use a mechanism that is stronger than the requested authentication mechanism MAXIMUM: the identity provider must use a mechanism that is as strong as possible without exceeding the strength of the requested mechanism

3.2.7.3 Use the Test SP Engine with IdP-Initiated SSO

You can also use the test SP engine to test IdP-initiated Single Sign-On. In the service provider, simply enable the test SP engine and configure the default SP engine to be Test SP, and begin IdP-initiated SSO from the identity provider. The test SP engine will display the results of the Single Sign-On operation.

3.2.7.4 Test SP Engine Results

After Single Sign-On has been performed, the test SP engine displays the results of the operation, including: ■ SSO Authentication Result: whether the operation was successful. ■ User Identifier: the User ID of the user for which Single Sign-On was performed. 3-32 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation ■ Authentication Instant: the instant at which the identity provider authenticated the user. ■ Session Expiration Instant: the instant at which the user session will become invalid. ■ Authentication Mechanism: the local mechanism used to authenticate the user. ■ SSO Primary Status Code: The primary status code in the assertion received from the identity provider. ■ SSO Secondary Status Code: The secondary status code in the assertion received from the identity provider. ■ SSO Status Message: The status message in the assertion received from the identity provider. ■ IdP Provider ID: The Provider ID of the identity provider that authenticated the user. ■ A list of the attributes from the assertion received from the identity provider, including: – orafed-providerid: The Provider ID of the identity provider that authenticated the user. – orafed-nameid-format: The format of the Name ID of the user federation. – orafed-nameid-value: The Name ID of the user federation. – orafed-assertionid: The ID of the assertion received from the identity provider. – Any user attributes included in the assertion received from the identity provider.

3.3 Post-Upgrade Administration

This section describes actions that the administrator must take following an upgrade of Oracle Identity Federation.

3.3.1 11g Server Signing Certificate

During an upgrade from release 10g to 11g, the upgrade assistant migrates the Oracle Identity Federation 10g LibertySAML2.0 signing keycertificate as the signing certificate of the Oracle Identity Federation 11g instance for use in SAML2.0SAML1.xWS-Fed operations. If you used the Oracle Identity Federation 10g server to sign SAML 1.xWS-Fed messages, you have two options: ■ Keep the SAML1.xWS-Fed keycertificate as the Oracle Identity Federation 11g signing keycertificate for all protocols SAML2.0SAML1.xWS-Fed. To implement this, upload the 10g keystore as the 11g signing keystore. The 10g keystore can be found in the Oracle Identity Federation Administration Console by navigating to SAML1xWSFed, then Signer; the 11g keystore is located in Fusion Middleware Control by navigating to the Oracle Identity Federation instance, in the Security and Trust section. You must redistribute the SAML2.0 metadata to the remote partners after the change, so that the partners have the new signing certificate.