Perform SP-initiated Single Sign-On

Server Administration 4-17 ■ Liberty 1.2 For the SAML 1.x protocols, only the local Oracle Identity Federation session will be deleted. The SAML 1.x remote providers will not be notified of the user terminating the session.

4.2.6 Set Signature Verification Certificate Property SAML 1.x

If you did not upload XML metadata for a SAML 1.x provider, and that provider is configured to send signed messages, you need to do the following: ■ If the provider is an IdP, you must set the IdP Signature Verification Certificate property. ■ If the provider is an SP, you must set the SP Signature Verification Certificate property.

4.2.7 Perform SP-initiated Single Sign-On SAML 1.x

Certain properties must be be set before you can perform SP Initiated SSO. After adding the SP metadata to the IdP, select it and click Edit. Set the following property in the Trusted Provider Settings section: SP Assertion Consumer Service URL: http:host:portfedspsamlv11sso After adding the IdP metadata to the SP, select it and click Edit. Set the following properties in the Trusted Provider Settings section: ■ IdP Initiated SSO URL -- http:host:portfedidpsamlv11sso for SAML 1.1 or http:host:portfedidpsamlv10sso for SAML 1.0 ■ IdP Initiated SSO Target Parameter -- any reasonable string; used by the peer provider to identify the desired resource TARGET in the case of Oracle Identity Federation. ■ IdP Initiated SSO ProviderID Parameter - providerid ■ IdP SOAP Artifact Resolution Endpoint - http:host:portfedidpsoapv11

4.2.8 Send Attribute Requests and Queries SAML 1.x

SAML 1.x defines a protocol for retrieving users attributes. You can either send an attribute request to an Oracle Identity Federation instance acting as an SP, or send a SAML 1.x attribute query to an Oracle Identity Federation instance acting as an IdP. Section 5.6, Configuring Attribute Sharing with the Oracle Access Manager AuthZ Plug-in shows how to configure an SP and IdP for attribute sharing for SAML. To send an attribute request in a SOAP envelope to the SP, use the following URL: http:sphost:portfedarsoap. To send a SAML 1.x attribute query in a SOAP envelope to the IdP, use the following URL: http:idphost:portfedaasoapv11 See Also: Section 6.8.3, Configuring On-Demand Global Logout for details about configuring Oracle Identity Federation to enable the user to launch global logout. See Also: Section 4.2.2, Obtain Server Certificates for information on how to obtain these certificates. 4-18 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation For details, see: ■ Section 5.6, Configuring Attribute Sharing with the Oracle Access Manager AuthZ Plug-in ■ Section 4.3.5, Set Up Single Sign-On for SAML 1.x and WS-Federation You can also configure attribute name and value mapping, and attribute filtering. See Section 5.9, Configuring Attribute Mapping and Filtering for details. When Oracle Identity Federation, acting as an identity provider, receives a SAML 1.x attribute query, it will need to identify the requester. Oracle Identity Federation provides two ways in which a requester can be identified: by providing an SSL client certificate, or by authenticating with HTTP basic authentication. If the requester authenticates by means of an SSL client certificate, the cn of the certificate subject must be the provider ID with which Oracle Identity Federation identifies the requester. If the requester authenticates through HTTP basic authentication, the username used by the requester must be the provider ID with which Oracle Identity Federation identifies the requester. For details on how to set up SSL with client authentication or HTTP basic authentication, see Section 6.9, Protecting the SOAP Endpoint .

4.2.8.1 NameID Format Strings when Using the Attribute Requester Service

The strings to be used for the NameID format when using the Attribute Requester service are:

4.2.9 Send Authentication Queries SAML 1.x

To send SAML 1.x authentication queries to an Oracle Identity Federation instance acting as an IdP, use a URL of the form: http:host:portfedauthnauthsoapv11 When Oracle Identity Federation, acting as an identity provider, receives a SAML 1.x authentication query, it must identify the requester. Oracle Identity Federation provides two ways in which a requester can be identified: by providing an SSL client certificate, or by authenticating through HTTP basic authentication. If the requester authenticates using an SSL client certificate, the cn of the certificate subject must be the provider ID with which Oracle Identity Federation identifies the requester. If the requester authenticates through HTTP basic authentication, the Table 4–2 NameID Formats for Attribute Requester Service Format String x509 oracle:security:nameid:format:x509 email oracle:security:nameid:format:emailaddress windows oracle:security:nameid:format:windowsdomainqualifiedname kerberos oracle:security:nameid:format:kerberos persistent oracle:security:nameid:format:persistent transient oracle:security:nameid:format:transient unspecified oracle:security:nameid:format:unspecified custom oracle:security:nameid:format:custom userid oracle:security:nameid:format:userid