Creating a Test Page Configuring Oracle Access Manager to Delegate Authentication to Oracle Identity Federation

Integrating Components 18-31

1. Click the Policy Configuration tab.

2. Expand Authentication Schemes under the Shared Components tree.

3. Select OIFScheme from under the Authentication Schemes and then select Open

from the menu. 4. On the Authentication Schemes page, provide the following information ■ Challenge URL : https:sso.mycompany.com:443fedusersposso ■ Context Type : Select external from the list. Accept the defaults for all other values

5. Click Apply to update the OIFScheme.

18.4.3.3 Creating an Oracle Identity Federation Authentication Policy in Oracle Access Manager

Create an authentication policy in Oracle Access Manager to enable OIF to authenticate the user. To create an authentication policy, log in to the OAM console at http:admin.mycompany.comoamconsole as the OAM administration user. Then perform the following steps:

1. Click the Policy Configuration tab.

2. Expand IAM Suite under the Application Domains section.

3. Click Authentication Policies, and then select Create from the menu.

4. On the Authentication Policy page, provide the following details: ■ Name : The name of the authentication policy, for example: OIF Policy. ■ Description : The description for the policy ■ Authentication Scheme : Select OIF Scheme from the menu

5. Click Apply.

18.4.3.4 Creating a Test Page

Create a test page to validate that Oracle Identity Federation is integrated with Oracle Access Manager. Create a file called oif_sso.html on WEBHOST1 and WEBHOST2, in the directory ORACLE_INSTANCE configOHScomponenthtdocs with the following content: html body center p h2 OIF Protected Resource h2 p center body html 18-32 Oracle Fusion Middleware Enterprise Deployment Guide for Oracle Identity Management

18.4.3.5 Creating a Resource in Oracle Access Manager

Create a resource for the Oracle Identity Federation URL to be protected by Oracle Access Manager. In SP mode, Oracle Identity Federation authenticates the user and then propagates the authentication state to Oracle Access Manager. The resource created here is for the purposes of testing. To create a resource, log in to the OAM console at http:admin.mycompany.comoamconsole as the OAM administration user. Then perform the following steps:

1. Click the Policy Configuration tab.

2. Expand IAM Suite under the Application Domains section.

3. Click Resources, and then select Open from the menu.

4. On the IAM Suite Resources page, click New Resources to bring up the Resources

page.

5. On the Resources page, provide the following details:

■ Type : Select HTTP ■ Host Identifier : IAMSuiteAgent ■ Resource URL : oif_sso.html ■ Protection Level : Protected ■ Authorization Policy : Protected Resource Policy ■ Authentication Policy : Select the Authentication Policy created in Section 18.4.3.3, Creating an Oracle Identity Federation Authentication Policy in Oracle Access Manager, for example: OIF Policy. 6. Click Apply.

18.4.3.6 Configuring Oracle Access Manager to Delegate Authentication to Oracle Identity Federation

The Oracle Identity Federation resources protected by Oracle WebGate are directed to Oracle Access Manager for authentication. In SP Mode, Oracle Identity Federation authenticates the user and propagates the authentication state to Oracle Access Manager. To enable Oracle Identity Federation to authenticate the user, Oracle Access Manager must be configured to redirect the user to Oracle Identity Federation for authentication. This is done by registering Oracle Identity Federation as Delegated Authentication Protocol DAP partner with Oracle Access Manager. Proceed as follows on IDMHOST1 to register Oracle Identity Federation as DAP Partner with Oracle Access Manager: 1. Ensure that the keystore generated in the previous section is available on IDMHOST1. 2. Start the wlst shell from the IAM_ORACLE_HOMEcommonbin directory. For example, on Linux and UNIX-based systems, you would type: .wlst.sh On Windows you would type: .wlst.cmd 3. Connect to the WebLogic Administration Server using the following wlst connect command: Integrating Components 18-33 connectAdminUser,AdminUserPassword,t3:hostname:port For example: connectweblogic,admin_password,t3:ADMINVHN.mycompany.com:7001 4. Use the registerOIFDAPPartner command to register Oracle Identity Federation as a DAP partner with Oracle Access Manager. The syntax is: registerOIFDAPPartnerkeystoreLocation=path_to_keystore, logoutURL=OIF_ logout_URL , rolloverTime= where: ■ path_to_keystore is the location of the Keystore file on IDMHOST1, for example: u01apporacleproductfmwkeystoreskeystore ■ OIF_logout_URL is the OIF Servers logout URL. Use https:oifhost:oifportfeduserspsloosso?doneURL=https: oamhost:oam portoamlogout.jsp as the logout URL Use sso.mycompany.com as the value for oifhost and oamhost. Use 443 as the value for oifport and oamport. ■ rollover_time is the rollover interval for the keys used to encrypt ordecrypt SASSO tokens. For example: wls:IDMDomainserverConfig registerOIFDAPPartnerkeystoreLocation=u01apporacleproductfmwkeystoresk eystore, logoutURL=https:sso.mycompany.comfeduserspsloosso?doneURL=https:sso.myc ompany.comoamlogout.jsp Registration Successful 5. Restart the Administration Server and the Oracle Access Manager and Oracle Identity Federation Managed Servers by following the steps in Section 20.1, Starting and Stopping Oracle Identity Management Components.

18.4.4 Validating Oracle Identity Federation Integration with Oracle Access Manager

Before the configuration can be validated, obtain the provider metadata and register the providers. For the purposes of validating, Oracle Identity Federation will act as both an Identity Provider and a Service Provider.

18.4.4.1 Generating Provider Metadata

Proceed as follows to generate the IdP and SP metadata. Note: Once all of the Oracle Access Manager managed servers are shut down, it is not possible to access the WebLogic Administration console. Once single sign-on has been configured, access to the WebLogic Administration console is controlled through Oracle Access Manager, which requires at least one Oracle Access Manager managed server to be running.