Server Configuration Data Data Maintained by Oracle Identity Federation

5-4 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation This means that a user can have multiple identity federation records for the same remote provider, so long as the combination of these three attributes provides uniqueness. For example, the user’s first record could be identified by a combination of ProviderXmyemail1SAML 2.0, and the second record by ProviderXmyemail2SAML 2.0. Synchronization As mentioned earlier, the federation records for a user are stored independently, and rely on a unique user attribute such as a DN or a username to link to the user record in the user data store. An event that changes a user’s unique attribute value - for example, if an employee moves to a new office location and her DN is updated - requires that the user’s federations be dropped and re-established. If a users attribute value in the user store has changed, the users federation record can be updated, for example in Fusion Middleware Control, from the Identities page. Deprovisioning Likewise, if a user record is deleted, the federation data remains. This means that the administrator must be sure to delete the user’s federation data when the user is deprovisioned. The federation data can be deleted: ■ using the LDAP server’s or database’s administration tools. For data stored in Oracle Internet Directory, see Oracle Identity Management User Reference to obtain more information. ■ using a command-line utility provided with Oracle Identity Federation. For details, see Chapter 9, Oracle Identity Federation Command-Line Tools .

5.2 Configuring Server Properties

Server properties include: ■ Host Connection Properties ■ Outbound Connection Properties

5.2.1 Host Connection Properties

These types of properties are configured for the server: ■ basic connection parameters ■ encryption settings ■ logout options Caution: Failure to delete the federation data in this situation can introduce a potential security problem. For example, consider a scenario where a new user is subsequently provisioned with the same unique attribute value - for example, the same DN or username; that user would inherit the previous user’s account linkages if they had been left around. Configuring Oracle Identity Federation 5-5 Connection Parameters You can configure the following parameters: ■ Host This is the host name of the Oracle Identity Federation instance. If there is a change to the host or port of the server, you can either define a virtual hostname or proxy server hostname, or else change the server host property. ■ Port This is the port where Oracle Identity Federation listens. Checking the SSL Enabled box enables Secure Sockets Layer SSL encryption, allowing the server to listen in HTTPS mode. Checking the Force SSL box forces communications with the server to be conducted in HTTPS mode. If true, Oracle Identity Federation checks an incoming connection to ensure that it is done over SSL. If it is not, the server redirects the user to a URL supporting SSL; the URL is built with the host name and port properties and the requested URL. ■ SOAP Port Note: This property affects server metadata. When updating this property, distribute the updated metadata to all your trusted providers. Note: ■ This setting only dictates what server port will be specified in the IdP and SP metadata when the metadata is generated. If there are several HTTP or HTTPS ports enabled for the container instance in which Oracle Identity Federation is running, a user or peer provider can access Oracle Identity Federation through any of those ports, not just the port you specify here. ■ This property affects server metadata. When updating this property, distribute the updated metadata to all trusted providers. Note: ■ This property affects server metadata. When updating this property, distribute the updated metadata to all trusted providers. ■ This setting only dictates what protocol http or https will be specified in the IdP and SP metadata when the metadata is generated. Setting this property does not configure SSL. For details of how to enable SSL, see: ■ Section 8.1, Configuring SSL for Oracle Identity Federation ■ Oracle Fusion Middleware Administrators Guide