Oracle Access Manager Setting up Single Sign-On Services

Additional Server Configuration 6-5 Check that the query parameter values are correctly URL-encoded. An example of such a URL is: http:oif_host:oif_ portfedidpinitiatesso?providerid=http3A2F2Fsp.comreturnurl=http3A2FFProt ectedAppHost2FProtectedAppPath

6.2 Working with Affiliations

The run-time functioning of affiliations depends on whether the Oracle Identity Federation server is acting as an IdP or an SP. Oracle Identity Federation Acting as IdP When Oracle Identity Federation is an IdP, provided the affiliationSP is present and enabled in the circle of trust, the Oracle Identity Federation server is ready to process any requests originating from service providers using the affiliation. Oracle Identity Federation Acting as SP As an SP, you can trigger a single sign-on operation with an IdP using an affiliation to which the SP belongs. To do so, include a federationid query parameter in the URL protected by the IdM back-end, and set the parameter value to the affiliation ID. For example with an Oracle Single Sign-On back-end, assuming that a resource is protected by mod_osso and configured for Oracle Identity Federation authentication, requesting the URL of this resource with the federationid query parameter instructs Oracle Identity Federation to use an affiliation when performing single sign-on with a peer IdP. Here is an example of such a URL: http:protected_res_host:protected_res_ portpath?federationid=http3A2FFaffiliationid It is also possible to directly access the http:oif_host:oif_ portfedspinitiatesso URL with the same federationid query parameter. In this case, Oracle Identity Federation triggers a single sign-on operation, and uses the Unsolicited SSO RelayState for the peer IdP as the URL to which the user is redirected after successful authentication.

6.3 Additional LDAP Configuration

This section contains topics for LDAP configuration and maintenance: ■ Configuring the LDAP Inactivity Setting ■ Configuring the LDAP Read Timeout Setting ■ ECID Support for LDAP Connections

6.3.1 Configuring the LDAP Inactivity Setting

When Oracle Identity Federation is integrated with high availability LDAP servers to serve as user data store, federation data store, or authentication engine, the server keeps a pool of LDAP connections that can be re-used for subsequent requests. Note: The Unsolicited SSO RelayState is set by navigating to Federations , then Edit Trusted Provider in Fusion Middleware Control. 6-6 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation Over time, the LDAP server may close some connections due to a long inactivity period, and if left unchecked, this can result in errors and a degradation of performance in Oracle Identity Federation. You can set an inactivity attribute that tells Oracle Identity Federation how long an LDAP connection should be kept in a pool before being removed due to inactivity. By default the inactivity timeout is set to 300 seconds. To set the inactivity settings for Oracle Identity Federation, enter the WLST script environment for Oracle Identity Federation and set the following properties: ■ Set the ldapconnectioninactivitytimeout long property from the authnengines group to the inactivity timeout in seconds to configure the LDAP Authentication Engine Inactivity Timeout as in this example: setConfigPropertyauthnengines, ldapconnectioninactivitytimeout, 300, long ■ Set the userldapconnectioninactivitytimeout long property from the datastore group to the inactivity timeout in seconds to configure the LDAP user data store Inactivity Timeout as in this example: setConfigPropertydatastore, userldapconnectioninactivitytimeout, 300, long ■ Set the fedldapconnectioninactivitytimeout long property from the datastore group to the inactivity timeout in seconds to configure the LDAP Federation Data Store Inactivity Timeout as in this example: setConfigPropertydatastore, fedldapconnectioninactivitytimeout, 300, long

6.3.2 Configuring the LDAP Read Timeout Setting

When Oracle Identity Federation is integrated with LDAP servers for user data store, federation data store or LDAP authentication engine, the server communicates with the LDAP directory to retrieve user attributes, authenticate users, look up users and perform related operations. Sometimes, the LDAP server can become unresponsive, causing the threaduser to wait for a response or an error. To avoid waiting too long for an error when the server is not responding, Oracle Identity Federation sets a read timeout property on the LDAP connection: if the LDAP server does not respond before the read timeout period, an error is generated, Oracle Identity Federation closes the connection, opens a new one and re-issues the LDAP command. It is possible to set the read timeout setting to tell the Oracle Identity Federation server how long to wait for data from the LDAP server. By default the read timeout is set to 10 seconds. To set the read timeout settings for Oracle Identity Federation, enter the WLST script environment for Oracle Identity Federation, and set the following properties if necessary examples are included: ■ Set the ldapconnectionreadtimeout long property from the authnengines group to the read timeout in seconds to configure the LDAP Authentication Engine Read Timeout: setConfigPropertyauthnengines, ldapconnectionreadtimeout, long, 10