Create the IdP Discovery Service Page

Additional Server Configuration 6-23 ■ the user selects a card ■ the Identity Selector connects to the STS server to retrieve a SAML assertion. Note: the SAML assertion is encrypted using the Oracle Identity Federation SSL server certificate. ■ the Identity Selector presents the SAML assertion to Oracle Identity Federation ■ Oracle Identity Federation decrypts the assertion using its encryption keystore, and validates the signature ■ Oracle Identity Federation maps the SAML assertion to a local user, using the SAML 1.x or SAML 2.0 assertion mapping modules, based on the settings listed in the Service Provider page on the SAML 1.x and SAML 2.0 tabs. Note: this step is similar to a Federation SSO flow, when Oracle Identity Federation acts as the service provider. ■ After mapping the assertion to a local user record, the authentication phase is complete and Oracle Identity Federation resumes the operation it was performing before the Infocard authentication engine was invoked The Infocard authentication engine can additionally request optional attributes from the Infocard providers. If the Infocard engine is instructed to return some attributes requested by Oracle Identity Federation acting as IdP, because some of the assertion contents rely on user session attributes populated by the authentication engines, the engine adds those attributes as optional claims to be requested to the Infocard providers. This section contains these topics: ■ Server-side Infocard Setup ■ Client-side Infocard Setup

6.12.1 Server-side Infocard Setup

Server-side setup includes the following: ■ Set up JCE Policy Files for Oracle WebLogic Server ■ Update the Oracle Identity Federation Configuration ■ Add Personal Card Issuer STS ■ Add Infocard Managed STS

6.12.1.1 Set up JCE Policy Files for Oracle WebLogic Server

Take these steps: 1. Download JavaTM Cryptography Extension JCE Unlimited Strength Jurisdiction policy files from this URL: http:www.oracle.comtechnetworkjavajavasedownloadsindex .html 2. Unzip the files in all the JAVA_HOMEjrelibsecurity directories located under the Middleware home f older to find those directories, look for US_ export_policy.jar files. For every JAVA_HOMEjrelibsecurity directory, overwrite the default low strength local_policy.jar and US_ export_policy.jar files with the ones provided by Oracle. 6-24 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation 3. Restart the administration server and the managed server where Oracle Identity Federation is running.

6.12.1.2 Update the Oracle Identity Federation Configuration

Go to the Oracle Identity Federation instance in Fusion Middleware Control, and perform the following operations:

1. Infocard Authentication requires SSL. Configure SSL on Oracle WebLogic Server

as explained in Section 8.1, Configuring SSL for Oracle Identity Federation , and enable SSL on the Oracle Identity Federation server. You need to create a new SSL keystore if it does not already exist. The SSL server certificate must use the RSA public key algorithm since it is required for SAML encryption operations

2. For the Oracle Identity Federation encryption wallet, use the SSL keystore used for

SSL support in Oracle WebLogic Server. When you use this keystore, the Infocard client uses the SSL server certificate to encrypt the assertion, thus requiring Oracle Identity Federation to use as the encryption wallet the key pair used for SSL traffic.

3. Load the SSL Java keystore as the Oracle Identity Federation encryption wallet.

Navigate to Administration, then Security and Trust, and upload the new wallet keystore, specifying the password and alias.

4. Navigate to IdM Data Stores, then Authentication Engines, and enable the

Infocard engine. Depending on whether the engine should map the WS-Trust assertion to a record from the user data store, check or uncheck the box for Map Assertion to User . See Also: What Is a Middleware Home? in the Oracle Fusion Middleware Administrators Guide. Note: You must re-distribute the metadata to trusted partners since the encryption keystore was modified. Note: You can configure Oracle Identity Federation to add the authentication mechanism as a required claim, so that it is able to request a specific authentication method from the Infocard providers. To enable this feature, check the Include Authentication Mechanism box.