Click Apply. Configuring Oracle Identity Federation for RDBMS Authentication Engine

Configuring Oracle Identity Federation 5-99 Updates you make on this tab are saved if you move to tabs for other authentication engines. When you are done, click Apply to save the changes, or Revert to reset the data to its previous state.

5.15.8 Authentication Engines - Federated SSO Proxy

The tab contains these fields: ■ Default Authentication Engine - This is the engine used for authentications. The list-box contains all the currently enabled engines; selecting an engine from the list makes it the default engine. ■ Enable Authentication Engine - Check this box to enable the engine, and uncheck the box to disable the engine. If enabled, this engine appears on the list of available engines in the list-box associated with Default Authentication Engine. ■ Authentication Mechanism - This is the authentication mechanism that Oracle Identity Federation will use to authenticate the user locally when using the Federated SSO proxy. Updates you make on this tab are saved if you move to tabs for other authentication engines. When you are done, click Apply to save the changes, or Revert to reset the data to its previous state. Additional topics include: ■ About the Federated SSO Proxy Authentication Engine ■ Selecting the Identity Provider to Use ■ Configuring the Federated SSO Proxy Authentication Engine

5.15.8.1 About the Federated SSO Proxy Authentication Engine

When an identity provider uses the Federated SSO Proxy authentication engine to authenticate a user, it does this by taking the role of service provider, and initiating a Single Sign-On flow with a second identity provider that authenticates the user. The flow is as follows: WARNING: The authentication mechanism specified here must not map to the Federated SSO Proxy authentication engine. See Also: Section 5.15.8.1, About the Federated SSO Proxy Authentication Engine. 5-100 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation 1. A service provider, SP-1, sends an authentication request to an Oracle Identity Federation identity provider, IdP-1. 2. Oracle Identity FederationIdP-1 is using the Federated SSO Proxy authentication engine; it selects a trusted identity provider, IdP-2, takes the role of a service provider, and sends a new authentication request for the specified user to IdP-2. 3. IdP-2 authenticates the user. 4. IdP-2 sends back an assertion to Oracle Identity FederationIdP-1, who will then process this assertion. 5. If necessary, Oracle Identity FederationIdP-1 authenticates the user locally for example when a federation creation operation needs to be performed. 6. Oracle Identity FederationIdP-1 sends back a new assertion to SP-1.

5.15.8.2 Selecting the Identity Provider to Use

When an identity provider using the Federated SSO Proxy authentication engine receives an authentication request from a service provider, it will select a trusted identity provider to which to send a new request. To select the identity provider, Oracle Identity Federation maps the authentication mechanism requested by the service provider or the default mechanism if the SP did not request one to an identity provider, and sends a new request to this IdP. If the mechanism does not map to an identity provider, Oracle Identity Federation uses the default identity provider in configuration. Refer to Section 5.14.1, About Authentication Mechanisms for more information on authentication mechanisms and how protocol-specific methods are mapped to local authentication mechanisms. For example, suppose that the following mappings from local authentication mechanisms to identity providers are configured: oracle:fed:authentication:internet-protocol - http:corp-1.comidp oracle:fed:authentication:password-protected - http:corp-2.comidp and that the default identity provider is: http:corp-3.comidp. Then, if the service provider requests an authentication method that maps to the oracle:fed:authentication:internet-protocol, Oracle Identity Federation selects http:corp-1.comidp as the identity provider, but if the service provider requests oracle:fed:authentication:password-protected, Oracle Identity Federation chooses http:corp-2.comidp. If the service provider does not request an authentication method, then Oracle Identity Federation sends the new authentication request to http:corp-3.comidp. You can define the mappings from local authentication mechanisms to identity providers by following these steps:

1. Log in to Fusion Middleware Control and navigate to the Oracle Identity

Federation instance.

2. Navigate to Administration, then Service Provider.

3. In Protocol Settings, click on Configure SSO Authentication Mechanism to

Identity Provider Mapping .

4. Click Add, and select the authentication mechanism and the identity provider to

which it maps. See Also: Section 5.5, Configuring Service Providers