Setup Example of a Pre-processing Plug-in

Custom Actions 12-17

12.5.2 Configuring Oracle Identity Federation for the Plug-in

Configure Oracle Identity Federation to forward the user to a post-processing plug-in rather than to the SP engine at the end of the SSO flow by performing these tasks: ■ identify the SP engine whose flow will be modified. Choices are: Oracle SSO, Oracle Access Manager, Test SP, Proxy engines. ■ Set the following two properties: – Create or set the web context property, referencing the web context where the custom JSP page or servlet of the post-processing plug-in resides. This property is located in the spengines group of the Oracle Identity Federation configuration. – the relative path property referencing the path in the web context where the custom JSP page or servlet resides. Table 12–2 shows how to set the properties for each SP engine: Use the WLST commands to set these properties in the Oracle Identity Federation configuration. For example, the following commands, in the WLST script environment for the Oracle Identity Federation instance, configure a post-processing plug-in to be invoked before the Oracle SSO SP engine at the end of the federated SSO operation: setConfigPropertyspengines, osso-login-context, rootcontext, string setConfigPropertyspengines, osso-login, relativepath, string

12.5.3 Example of a Post-processing Plug-in

This section shows a simple post-processing plug-in to be invoked by Oracle Identity Federation, at the end of a federated SSO and before the Oracle Access Manager SP Engine, to check that the user referenced in the assertion actually belongs to the local domain of the identity provider IdP. Oracle Identity Federation can have multiple IdPs as federation partners, each authenticating users on behalf of the Oracle Identity Federation SP and the local domain where the federation server is deployed. In a typical scenario: ■ the user is redirected to the IdP for authentication ■ the IdP creates an assertion containing the users identity ■ Oracle Identity FederationSP maps the incoming assertion to a local user record and creates an authenticated session in the domain. Table 12–3 SP Engine Configuration for Post-processing Plug-in SP Engine web context property relative path property Oracle Single Sign-On osso-login-context default missing osso-login default userspretosso Oracle Access Manager oam-login-context default missing oam-login default userspretoam TestSP testsp-login-context default missing testsp-login default usertestspretsso Fed SSO Proxy proxy-login-context default missing proxy-login default userproxyretsso