Example 4: Opt-In Mode for a Specific IdP

6-46 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation 3. Enter one of these commands based on the name format used: setFederationPropertySPproviderID,nameformatemail,attribute-name,st ring if name format is Email Address setFederationPropertySPproviderID,nameformatx500,attribute-name,str ing if name format is X509 Subject Name setFederationPropertySPproviderID,nameformatunspecified,attribute-nam e,string if name format is Unspecified setFederationPropertySPproviderID,nameformatkerberos,attribute-name, string if name format is Kerberos setFederationPropertyproviderID,nameformatwindows,attribute-name,st ring if name format is Windows Domain Qualified Name setFederationPropertyproviderID,nameformatcustom,attribute-name,str ing if name format is Custom

6.21 Configuring Audience Restrictions for Assertions

When using assertions to exchange information, SAML authorities such as an identity provider or attribute authority can set the conditions under which an assertion is valid. Typical conditions might be: ■ Time before which the assertion is not valid ■ Time after which the assertion is not considered valid any more ■ List of providers that can process the assertion. Only a provider listed in the AudienceRestictionCondition element of the assertion is able to use the assertion. The SAML specifications define the AudienceRestictionCondition as a list of Audience elements, each one referencing a provider that can process the assertion. By default, Oracle Identity Federation creates an AudienceRestrictionCondition element when generating an assertion, and includes the recipient of the assertion using these rules: ■ For SAML 1.x protocol exchanges, set the Audience as the Assertion Consumer Service URL of the service provider. ■ For SAML 2.0 protocol exchanges, set the Audience as the ProviderID of the service provider Attribute Requestor. Note: If federation store was set and a federation record exists for the user, the nameid in the federation record is used. Additional Server Configuration 6-47 ■ For WS-Fed protocol exchanges using SAML assertions, set the Audience as the ProviderID of the service provider. When Oracle Identity Federation receives and processes an assertion, by default it validates the AudienceRestrictionCondition, if present, by using the ProviderID or URL where the assertion was posted. Depending on the deployment scenario, it might be necessary to disable generation and validation of the AudienceRestrictionCondition element; you can do so either at a protocol level SAML 1.0, SAML 1.1 or SAML 2.0 assertions, or at the trusted provider level. To configure Oracle Identity Federation to control generation and processing of the AudienceRestrictionCondition for SAML 1.xSAML 2.0 assertions at a global level, enter the WLST script environment for the Oracle Identity Federation instance, and: ■ Set the audiencerestrictionenabled boolean property from the idpsaml10, idpsaml11 or idpsaml20 groups to true default to enable the generation of AudienceRestrictionCondition when creating a SAML 1.0, SAML 1.1 or SAML 2.0 assertion respectively. setConfigPropertyidpsaml11, audiencerestrictionenabled, true, boolean Set it to false to disable the generation of the condition ■ Set the audiencerestrictionenabled boolean property from the spsaml10, spsaml11 or spsaml20 groups to true default to enable the validation of AudienceRestrictionCondition when processing a SAML 1.0, SAML 1.1 or SAML 2.0 assertion respectively: setConfigPropertyspsaml11, audiencerestrictionenabled, true, boolean Set it to false to disable validation of the condition. To configure Oracle Identity Federation to enable generation and processing of the AudienceRestrictionCondition for a specific trusted provider, enter the WLST script environment for the Oracle Identity Federation instance, and set the audiencerestrictionenabled boolean property for a trusted provider referenced by REMOTE_PROVIDER_ID to true: setFederationPropertyREMOTE_PROVIDER_ID, audiencerestrictionenabled, true, boolean Set the property to false to disable generation and processing of the condition. You can also configure Oracle Identity Federation to use a custom string when: ■ Oracle Identity FederationIdP creates an assertion. Oracle Identity Federation uses the custom string specified in the configuration to populate the AudienceRestrictionCondition element ■ Oracle Identity FederationSP processes an assertion. Oracle Identity Federation validates the AudienceRestrictionCondition element, if present, by comparing it to the custom string specified in the configuration. To configure Oracle Identity Federation to use a specific audience value when validating the AudienceRestrictionCondition for SAML 1.xSAML 2.0 assertions at a global level, enter the WLST script environment for Oracle Identity Federation instance, and set the audiencerestrictionvalue string property from