Configuring Oracle Identity Federation

6-36 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation 2. Navigate to Administration, then Service Provider, then SAML 2.0, then Assertion Settings .

3. Uncheck Map User via Federated Identity.

4. Uncheck Map User via Attribute Query.

5. Check Map User via NameID.

6. Enable Email Address NameID Format, and enter the attribute of the user record

holding the email address mail typically for LDAP server.

7. Check Error when User Mapping fails; this will force Oracle Identity Federation

to return a 401 error to the browser if the user cannot be located. 8. Apply the changes.

6.16.4 Example 2: Simple Assertion Mapping without Federated Identities with an LDAPSQL Query

In this example, Oracle Identity FederationSP uses the NameID contained in the assertion to look up a local user in the LDAP user data store. The format of the NameID is emailAddress, and the search uses the mail attribute of the LDAP user record. The server is configured to use the LDAPSQL Query functionality to locate the user. Perform the following steps to configure Oracle Identity FederationSP: 1. Log in to Fusion Middleware Control. 2. Navigate to Administration, then Service Provider, then SAML 2.0, then Assertion Settings .

3. Uncheck Map User via Federated Identity.

4. Check Map User via Attribute Query.

5. Enter the following LDAP query in the Attribute Query field: mail=orafed-nameid-value

6. Uncheck Map User via NameID.

7. Check Error when User Mapping fails; this forces Oracle Identity Federation to

return a 401 error to the browser if the user cannot be located. 8. Apply the changes.

6.16.5 Example 3: Complex Assertion Mapping without Federated Identities with an LDAPSQL Query

In this example, Oracle Identity FederationSP uses the SAML attributes for email address and last name in the assertion to look up a local user in the LDAP user data store. The mail and sn local attributes are obtained from the LDAP user record. The attributes in the assertion are referenced as email and lastname. Oracle Identity FederationSP is not configured for attribute name mapping, so the LDAP query uses the attribute names contained in the SAML assertion; if attribute name mapping was configured, the LDAP query would use the names resulting from the attribute name mapping refer to Section 5.9, Configuring Attribute Mapping and Filtering for more information. Additional Server Configuration 6-37 The server is configured to use the LDAPSQL query functionality to locate the user. Perform the following configuration steps: 1. Log in to Fusion Middleware Control. 2. Navigate to Administration, then Service Provider, then SAML 2.0, then Assertion Settings .

3. Uncheck Map User via Federated Identity.

4. Check Map User via Attribute Query.

5. Enter the following LDAP query in the Attribute Query field: mail=emailsn=lastname

6. Uncheck Map User via NameID.

7. Check Error when User Mapping fails; this forces Oracle Identity Federation to

return a 401 error to the browser if the user cannot be located. 8. Apply the changes. 6.16.6 Example 4: Assertion Mapping without Federated Identities using LDAPSQL Query and NameID Mapping In this example, Oracle Identity FederationSP uses the email address contained in the NameID to locate the user. If the operation fails, the last name SAML attribute from the assertion is used to look up a local user in the LDAP user data store, using the local attributes mail and sn from the LDAP user record. The server is configured to use both NameID Mapping and LDAPSQL Query to locate the user. Perform the following steps to configure Oracle Identity FederationSP: 1. Log in to Fusion Middleware Control. 2. Navigate to Administration, then Service Provider, then SAML 2.0, then Assertion Settings .

3. Uncheck Map User via Federated Identity.

4. Check Map User via Attribute Query.

5. Enter the following LDAP query in the Attribute Query field: sn=lastname

6. Check Map User via NameID.

7. Enable Email Address NameID Format, and enter the attribute of the user record

holding the email address mail typically for LDAP server.

8. Check Error when User Mapping fails; this forces Oracle Identity Federation to

return a 401 error to the browser if the user cannot be located. 9. Apply the changes.

6.16.7 Example 5: Assertion Mapping without Federated Identities for a Specific IdP

If Oracle Identity FederationSP needs an attribute-based authentication configuration specific to a peer identity provider, the setup information must be stored in the IdPs entry in the Federations list.