Set up JCE Policy Files for Oracle WebLogic Server

Additional Server Configuration 6-25 Select Infocard as the default authentication engine if needed and save the changes. If you check the Map Assertion to User box, the incoming assertion is mapped to a user record based on the configuration on the SAML 2.0 SAML 1.x Assertion tab of the Service Provider page.

6.12.1.3 Add Personal Card Issuer STS

For Oracle Identity Federation to accept an assertion from the personal card issuer STS, it needs to have a trust relationship with the issuer. This trust is established by having the STS defined and enabled in the servers federations. In Fusion Middleware Control, locate the Oracle Identity Federation instance and perform the following operations: 1. Navigate to Administration, then Federations, and add a WS-Fed 1.1 IdP identified by http:schemas.xmlsoap.orgws200505identityissuerself

2. Select the STS, click Update, then select Update Manually.

3. From the SSOInfocard Mode drop-down, select either Infocard if the STS only

supports Infocard protocol, or Single Sign-On and Infocard if the STS supports Infocard and SSO protocols. 4. Infocard states that the relying party Oracle Identity Federation in this case should list the attributes or claims that the STS should include in the assertion it creates. With the attributes and the optional NameID contained in the assertion, Oracle Identity Federation can map the assertion to a local user record if configured for that operation. To add attributes to be requested for the STS, click Attribute Mappings. 5. Configure attribute mapping to list the attributes required by the Oracle Identity Federation server when the card selector is invoked; for each attribute marked Require from Infocard, Oracle Identity Federation requires the attribute to be Note: Leave this box unchecked in most deployments unless Infocard providers support the feature. If the box is checked, Oracle Identity Federation translates the local authentication mechanism values to SAML authentication methods, as defined in the authentication mechanisms mapping. Finally, when the box is checked, Oracle Identity Federation verifies that a given Infocard provider supports the inclusion of the authentication mechanism by looking at the provider specific property called Supports Authentication Mechanisms Claims, which is defined in the Trusted Provider settings of the Remote Provider configuration section. Note: When the Infocard authentication engine is invoked for authentication with the authentication mechanism that is mapped to the personal issuer card, only the personal issuer card is displayed on the login page. If invoked with an authentication mechanism different from the one mapped to the Personal Issuer Card, all the Infocard providers are displayed. 6-26 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation returned in the assertion from the WS-Trust server. The User Attribute Name is used to reference that attribute in Oracle Identity Federation, Assertion Attribute Name is the name of the attribute recognized by the STS, and FormatNamespace is the namespace to which the attribute is bound. The required claim from Oracle Identity Federation to the STS is the concatenation of the namespace, , and the assertion attribute name. For example: ■ Add an attribute entry User Attr Name=lastname, Assertion Attr Name=surname, Format or Namespace=http:schemas.xmlsoap.orgws200505identityclaims. Check the Require From Infocard box. ■ Add another attribute entry with User Attr Name=firstname, Assertion Attr Name=givenname, Format or Namespace=http:schemas.xmlsoap.orgws200505identityclaims. Check the Require From Infocard box. 6. Configure Oracle Identity Federation to map the assertion that the Personal Card Issuer will provide to a local user. For example, in the Oracle Identity Federation Settings tab, in the Assertion Setting tabs, uncheck the Map User via NameID box, check Map User via Attribute Query and enter the following LDAP query: sn=lastnamegivenname=firstname 7. Save the changes.

8. Check or uncheck the Supports Authentication Mechanism Claims box to

indicate whether the authentication mechanism should be listed as a required Infocard attribute. Not all WS-Trust servers support the ability to specify the requested authentication mechanism through the use of attributes. 9. Save the changes.

6.12.1.4 Add Infocard Managed STS

For Oracle Identity Federation to accept an assertion from a remote STS, the Oracle Identity Federation server needs to have a trust relationship with the remote server. This trust is established by having the STS defined and enabled in the servers federations. In Fusion Middleware Control, locate the Oracle Identity Federation instance and perform the following operations: 1. Add an entry by entering the STS provider ID, selecting IdP and the WS-Fed 1.1 version.

2. Select the STS, and click Update.

3. Enter the IdP signature verification certificate.

4. From the SSOInfocard Mode drop-down, select either Infocard if the STS only

supports Infocard protocol, or Single Sign-On and Infocard if the STS supports both Infocard and SSO protocols. 5. Infocard states that the relying party Oracle Identity Federation in the present case must list the attributes or claims that the STS should include in the assertion it creates. With the attributes and the optional NameID contained in the assertion, the Oracle Identity Federation server can map the assertion to a local user record if configured for that operation.