Attribute Value Filtering Introduction to Attribute Mapping and Filtering

5-60 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation ■ Get Value from User Session: Indicates whether the attribute value should be obtained from the user session. ■ Require from Infocard: Indicates whether the attribute must be passed in from Infocard. On the SP Side 1. Log in to Fusion Middleware Control and navigate to the Oracle Identity Federation instance.

2. Navigate to Administration, then Federations.

3. Select the attribute authority with which you want to configure attribute sharing, and click Edit.

4. Select Update Manually; under Oracle Identity Federation Settings, click Edit

Attribute Mappings and Filters .

5. Under the Name Mappings tab, click Add to add an attribute name mapping, with

the following fields: ■ User Attribute Name: The name used by the SOAP client in the AttributeRequest ■ Assertion Attribute Name: The name that will be used to identify the attribute in the attribute query and assertion ■ Format or Namespace: An optional field used to specify the format or the namespace of the SAML attribute, depending on the version – For SAML 1.x, this fields value is used to set the SAML attributes namespace – For SAML 2.0, this value is used to set the SAML attributes NameFormat; if this field is empty, the NameFormat of the SAML attribute will be set to urn:oasis:names:tc:SAML:2.0:attrname-format:basic; otherwise the NameFormat will hold the value specified in this field ■ Get Value from User Session: Indicates whether the attribute value should be obtained from the user session. ■ Require from Infocard: Indicates whether the attribute must be passed in from Infocard. Example The following attribute name configuration will yield the results shown here. Name Mapping in SP: Note: In order for the identity provider to send an attribute to a peer provider, a mapping for this attribute must be defined as explained above. Note: If no mapping is found for an attribute name, the service provider will map the name to itself. Configuring Oracle Identity Federation 5-61 Name Mapping in IdP: Results: Note that: ■ For attributes lastname, title, firstname, there is no mapping in the SP, so they are mapped to themselves. ■ For attribute middlename, there is no mapping in the IdP, so the IdP does not return any values for this attribute. If the attribute name used in the Attribute Queryassertion is the same as in the user data store, you need to explicitly define a mapping for the attribute name that maps the name to itself, as is done here for attribute title.

5.9.2.2 Configuring Attribute Value Mapping

Take these steps to define attribute value mappings: User Attribute Assertion Attribute phone telephone userid username email emailaddress id idnumber Assertion Attribute User Attribute lastname sn idnumber employeenumber telephone telephonenumber title title username uid emailaddress mail firstname givenname Attribute in SOAP client Request Attribute in SAML Attribute Query Attribute in User Datastore Attribute in SAML Assertion Attribute in Response to SOA client lastname lastname sn lastname lastname id idnumber employeenumber idnumber id phone telephone telephonenumber telephone phone title title title title title userid username uid username userid email emailaddress mail emailaddress email firstname firstname givenname firstname firstname middlename middlename - - -