Specifying Certificate Usage Obtain Server Certificates

Server Administration 4-17 ■ Liberty 1.2 For the SAML 1.x protocols, only the local Oracle Identity Federation session will be deleted. The SAML 1.x remote providers will not be notified of the user terminating the session.

4.2.6 Set Signature Verification Certificate Property SAML 1.x

If you did not upload XML metadata for a SAML 1.x provider, and that provider is configured to send signed messages, you need to do the following: ■ If the provider is an IdP, you must set the IdP Signature Verification Certificate property. ■ If the provider is an SP, you must set the SP Signature Verification Certificate property.

4.2.7 Perform SP-initiated Single Sign-On SAML 1.x

Certain properties must be be set before you can perform SP Initiated SSO. After adding the SP metadata to the IdP, select it and click Edit. Set the following property in the Trusted Provider Settings section: SP Assertion Consumer Service URL: http:host:portfedspsamlv11sso After adding the IdP metadata to the SP, select it and click Edit. Set the following properties in the Trusted Provider Settings section: ■ IdP Initiated SSO URL -- http:host:portfedidpsamlv11sso for SAML 1.1 or http:host:portfedidpsamlv10sso for SAML 1.0 ■ IdP Initiated SSO Target Parameter -- any reasonable string; used by the peer provider to identify the desired resource TARGET in the case of Oracle Identity Federation. ■ IdP Initiated SSO ProviderID Parameter - providerid ■ IdP SOAP Artifact Resolution Endpoint - http:host:portfedidpsoapv11

4.2.8 Send Attribute Requests and Queries SAML 1.x

SAML 1.x defines a protocol for retrieving users attributes. You can either send an attribute request to an Oracle Identity Federation instance acting as an SP, or send a SAML 1.x attribute query to an Oracle Identity Federation instance acting as an IdP. Section 5.6, Configuring Attribute Sharing with the Oracle Access Manager AuthZ Plug-in shows how to configure an SP and IdP for attribute sharing for SAML. To send an attribute request in a SOAP envelope to the SP, use the following URL: http:sphost:portfedarsoap. To send a SAML 1.x attribute query in a SOAP envelope to the IdP, use the following URL: http:idphost:portfedaasoapv11 See Also: Section 6.8.3, Configuring On-Demand Global Logout for details about configuring Oracle Identity Federation to enable the user to launch global logout. See Also: Section 4.2.2, Obtain Server Certificates for information on how to obtain these certificates.