Implementing the Service Developing and Implementing the Integration Module

10-22 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation This way, when an internal forward occurs from the federation server to the SP integration engine, the cookie set by the latter is available in the HTTP Request.

10.4.3 Sample Integration Modules

The next two sections provide examples of implementing a custom authentication engine: ■ Sample Integration Module 1: Oracle WebLogic Server JavaEE Integration ■ Sample Integration Module 2: Customized Single Sign-On Integration

10.4.4 Sample Integration Module 1: Oracle WebLogic Server JavaEE Container Integration

This section shows a simple SP integration engine that uses the javax.servlet.http.HttpSession to set an attribute. The presence of this attribute shows whether a user is authenticated. Setup The SP integration engine will not interact with the user data store used by Oracle Identity Federation. Packaging The SP integration engine consists of a Web application with a root context set to engine, and contains two JSP pages: ■ wlsintegration.jsp, which processes the request from the federation server and creates an HttpSession with a feduserid attribute containing the user’s identifier ■ application.jsp, which serves as an application. It looks for the HttpSession’s feduserid attribute, and triggers a Federation SSO if the attribute is not found Adding or Modifying an SP Integration Engine To add or modify the SP integration engine take these steps: Note: Oracle strongly discourages users from deploying any applications on the Oracle WebLogic Managed Server other than the ones for custom integration and authentication described as sample integration modules 1 and 2 below, because doing so introduces potential security risks. Extraneous applications deployed in the Oracle WebLogic Managed Server can potentially affect the security of the federation server by allowing rogue software to change the behavior of the server flows. Note: The example in this section is intended for illustration only and should not be used in a production environment. Indeed, it supposes that other applications deployed on the Oracle WebLogic Managed Server will consume data set by the SP integration engine, which is an approach strongly discouraged by Oracle. Furthermore, this example might not function properly in certain deployments, especially when propagating HttpSession across J2EE applications. Integrating with Third-Party Identity and Access Management Modules 10-23 1. Go to Fusion Middleware Control and navigate to the Oracle Identity Federation instance.

2. Navigate to Administration, then SP Integration Modules. Click the Custom SP

Engine tab.

3. To add an SP integration engine, click Add and enter a name for that SP

integration engine. Oracle Identity Federation generates an ID for that new engine: this ID is reference by TEST_ENGINE_ID for this test 4. To modify an SP integration engine, select it and: ■ Enable the engine ■ Set engine as the Web Context of the authentication engine ■ Set wlsintegration.jsp as the Login Relative Path of the SP integration engine ■ Select the authentication mechanism to use if a local authentication procedure needs to occur during the assertion processing this can happen when Federated Identities are used to map the assertion to a user record, if the Federation record does not exist: in this case, the user will need to be locally authenticated in order to perform the one time operation that will create the record 5. Save your changes. Implementation of application.jsp page buffer=5 autoFlush=true session=false page language=java import=java.net. response.setHeaderCache-Control, no-cache; response.setHeaderPragma, no-cache; response.setHeaderExpires, Thu, 29 Oct 1969 17:04:19 GMT; String userid = Stringrequest.getSession.getAttributefeduserid; if userid == null || userid.length == 0 { request.setAttributeoracle.security.fed.sp.engineid, TEST_ENGINE_ ID; request.setAttributeoracle.security.fed.sp.usedefault, Boolean.TRUE; request.setAttributeoracle.security.fed.sp.relaystate, engineapplication.jsp; request.getSession.getServletContext.getContextfed.getRequestDispatcher spstartsso.forwardrequest, response; return; } Welcome =userid Implementation of wlsintegration.jsp page buffer=5 autoFlush=true session=false page language=java import=java.util. response.setHeaderCache-Control, no-cache; response.setHeaderPragma, no-cache; response.setHeaderExpires, Thu, 29 Oct 1969 17:04:19 GMT; See Also: Section 5.16, Configuring SP Integration Modules 10-24 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation String userid = Stringrequest.getAttributeoracle.security.fed.sp.userid; String targetURL = Stringrequest.getAttributeoracle.security.fed.sp.relaystate; request.getSession.setAttributefeduserid, userid; response.sendRedirecttargetURL; Logout Since this application sets up an HttpSession in the Oracle WebLogic Managed Server instance, the SP integration engine must be integrated in the logout flow see Section 10.5, Logout .

10.4.5 Sample Integration Module 2: Customized Single Sign-On Integration

This section shows an SP integration engine that uses a simple Single Sign-On framework based on a cookie containing the username and the expiration time of the authenticated session. Setup The SP integration engine will not interact with the user data store used by Oracle Identity Federation. The engine will set up a cookie, for the entire domain, containing the users identifier as a String variable and the session timeout as a long. Packaging The SP integration engine consists of a Web application with a root context set to engine, and contains two JSP pages: ■ domainintegration.jsp, which processes the request from the Oracle Identity Federation server and creates a cookie with the user ID and session timeout ■ domainapplication.jsp, which serves as an application. It looks for the cookie and triggers a federation SSO if the cookie is not found. Adding or Modifying an SP Integration Engine To add or modify the SP integration engine take these steps:

1. Go to Fusion Middleware Control and navigate to the Oracle Identity Federation

instance.

2. Navigate to Administration, then SP Integration Modules. Click the Custom SP

Engine tab.

3. To add an SP integration engine, click Add and enter a name for that SP

integration engine. Oracle Identity Federation will generate an ID for that new engine: this ID is reference by TEST_ENGINE_ID for this test

4. To modify an SP integration engine, select it and:

■ Enable the engine Note: This example is intended for illustration only and should not be used in a production environment. For example, the cookies set in this example are not encrypted, allowing an attacker to impersonate a user by manually constructing such cookies. Integrating with Third-Party Identity and Access Management Modules 10-25 ■ Set engine as the Web Context of the authentication engine ■ Set domainintegration.jsp as the Login Relative Path of the SP integration engine ■ Select the authentication mechanism to use if a local authentication procedure needs to occur during the assertion processing this can happen when Federated Identities are used to map the assertion to a user record, if the Federation record does not exist: in this case, the user will need to be locally authenticated in order to perform the one-time operation that will create the record 5. Save your changes. Implementation of domainapplication.jsp page buffer=5 autoFlush=true session=false page language=java import=java.net., java.util. response.setHeaderCache-Control, no-cache; response.setHeaderPragma, no-cache; response.setHeaderExpires, Thu, 29 Oct 1969 17:04:19 GMT; Cookie[] cookies = request.getCookies; String userid = null; Date timeout = null; forint i = 0, size = cookies = null ? cookies.length : 0; i size; i++ { String name = cookies[i].getName; if spintegrationcookie.equalsname{ String value = cookies[i].getValue; StringTokenizer st = new StringTokenizervalue, ; userid = st.nextToken; timeout = new DateLong.parseLongst.nextToken; break; } } if userid == null || userid.length == 0 { request.setAttributeoracle.security.fed.sp.engineid, TEST_ENGINE_ID; request.setAttributeoracle.security.fed.sp.usedefault, Boolean.TRUE; request.setAttributeoracle.security.fed.sp.relaystate, enginedomainapplication.jsp; request.getSession.getServletContext.getContextfed.getRequestDispatcher spstartsso.forwardrequest, response; return; } Welcome =userid. You are logged until =timeout Implementation of domainintegration.jsp page buffer=5 autoFlush=true session=false page language=java import=java.util. response.setHeaderCache-Control, no-cache; response.setHeaderPragma, no-cache; response.setHeaderExpires, Thu, 29 Oct 1969 17:04:19 GMT; String userid = Stringrequest.getAttributeoracle.security.fed.sp.userid; String targetURL = See Also: Section 5.16, Configuring SP Integration Modules