Implementing the Pre-processing Custom Action

12-8 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation Use the WLST commands to set these properties in the Oracle Identity Federation configuration. For example, the following commands, in the WLST script environment for the Oracle Identity Federation instance, configure a pre-processing plug-in to be invoked before the Oracle SSO engine: setConfigPropertyauthnengines, osso-login-context, rootcontext, string setConfigPropertyauthnengines, osso-login, relativepath, string

12.3 Post-processing Custom Action for Authentication Engine

The user is directed to the post-processing plug-in module, as part of an authentication operation, after the authentication engine has completed processing and before the user is directed to Oracle Identity Federation. The plug-in enables custom actions to be taken after authentication. When the plug-in is in use, the authentication engine forwards the user internally to the plug-in, passing it the authentication data. After performing its custom actions, the plug-in forwards the user to Oracle Identity Federation, supplying the authentication data.

12.3.1 Implementing the Post-processing Plug-in

Custom Action Interaction with Oracle Identity Federation When the authentication engine redirects the user to Oracle Identity Federation during the authentication flow, it provides the following data to the plug-in as attributes on the HttpServletRequest object: Table 12–2 Authentication Engine Configuration for Pre-processing Plug-in Authentication Engine web context property relative path property Oracle Single Sign-On osso-login-context default missing osso-login default userauthnosso Oracle Access Manager oam-login-context default missing oam-login default userauthnoam LDAP ldap-login-context default missing ldap-login default userauthnldap RDBMS Security rdbmssec-login-context default missing rdbmssec-login default userauthnrdbmssec RDBMS Table rdbmstable-login-context default missing rdbmstable-login default userauthnrdbmstb JAAS jaas-login-context default missing jaas-login default userauthnjaas Infocard infocard-login-context default missing infocard-login default userauthnic Fed SSO Proxy proxy-login-context default missing proxy-login default userauthnproxy HTTP Header httpheader-login-context default missing httpheader-login default userauthnhttp Note: The available authentication engines are: Oracle SSO, OAM, LDAP, RDBMS Security, RDBMS Table, Proxy, JAAS Infocard, and HTTP Header. Custom Actions 12-9 ■ The identifier of the user String, identified by oracle.security.fed.authn.userid ■ Authentication time Date, identified by oracle.security.fed.authn.authntime ■ Expiration time of the authenticated session Date, identified by oracle.security.fed.authn.expirationtime ■ The authentication mechanism used to identify the user String, identified by oracle.security.fed.authn.authnmech ■ The identifier referencing the action that was being performed, from the request String, identified by oracle.security.fed.authn.refid ■ The identifier referencing the engine used to authenticate the user String, identified by oracle.security.fed.authn.engineid ■ Optionally, a map of attributes to be stored in the user session. This map has String objects as keys and a set of objects as values identified by oracle.security.fed.authn.attributes. ■ Optionally, the Oracle Identity Federation session identifier that Oracle Identity Federation uses to reference the Oracle Identity Federation user session. This allows the engine and Oracle Identity Federation to share the same identifier to reference the user session. String, identified by oracle.security.fed.sessionid Later, when the logout flow is executed, Oracle Identity Federation passes the sessionID that is being logged out to the engine, so that the engine can delete the data used for this user session.

12.3.2 Configuring Oracle Identity Federation for the Plug-in

To configure Oracle Identity Federation to forward the user to a post-processing plug-in following the authentication flow, set the following properties: ■ Create or set the web context property, referencing the web context where the custom JSP Page or servlet resides. This property is located in the serverconfig group of the Oracle Identity Federation configuration. Set the authncontext string property in serverconfig, default missing. ■ Set the relative path property referencing the path in the web context where the custom JSP Page or servlet resides. Set the authnpath string property in serverconfig, default userloginsso. Use the WLST commands to set these properties in the Oracle Identity Federation configuration. Notes: ■ The plug-in must provide Oracle Identity Federation server with the data that was passed to it as part of the authentication flow; this consists of attributes that were set on the HttpServletRequest object. ■ The plug-in can modify all attributes that were set on the HttpServletRequest object except the oracle.security.fed.authn.authnmech, oracle.security.fed.authn.refid, and oracle.security.fed.authn.engineid attributes. 12-10 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation For example, the following commands, in the WLST script environment for the Oracle Identity Federation instance, configure a post-processing plug-in to be invoked after all the authentication engines: setConfigPropertyserverconfig, authncontext, rootcontext, string setConfigPropertyserverconfig, authnpath, relativepath, string

12.3.3 Example of a Post-processing Custom Action

This section shows a simple post-processing plug-in that is invoked by all the built-in authentication engines before the user is redirected to Oracle Identity Federation at the end of a local authentication operation. This plug-in accesses a custom cookie presented by the browser, extracts data from it, and sets it as Oracle Identity Federation session attributes that can then be used during the operation that creates the assertion. Oracle Identity Federation supports the concept of session attributes set by the authentication engine during a local authentication operation: ■ Oracle Identity Federation acts as an IdP ■ The authentication engine flow sets some attributes as session attributes called attr1 and attr2 ■ Oracle Identity Federation is configured to send the session attributes referenced as attr1 and attr2 when creating an assertion for specific service provider partners This sample shows how a post-processing plug-in can set session attributes in a local authentication flow where a built-in authentication engine is used. In this sample, the plug-in adds the following attributes, extracted from a custom cookie that is previously set by another component, after a successful authentication: ■ cookie-language, containing the preferred language of the user ■ cookie-homepage, containing the preferred home page of the user

12.3.3.1 Set-up

A custom component sets the cookie used in this example.

12.3.3.2 Packaging

The post-processing plug-in consists of a Web application with a root context set to plugin, and contains one JSP page, cookieextract.jsp, which extracts the data from the custom cookie and set it as session attributes; the plug-in redirects the user to the federation server by means of an internal forward to resume the flow.

12.3.3.3 Oracle Identity Federation Configuration

To configure Oracle Identity Federation to invoke the post-processing plug-in before the Oracle Identity Federation server at the end of local authentication flow, take these steps: 1. Enter the WLST script environment for the Oracle Identity Federation instance. 2. Set the authncontext property containing the root context of the post-processing plug-in page: setConfigPropertyserverconfig, authncontext, plugin, string