Configuring a Custom User Name Mapper

5-38 Securing Oracle WebLogic Server ■ X.501 distinguished names passed via CSIv2 The default user name mapper uses the subject DN of the digital certificate or the distinguished name to map to the appropriate user in the WebLogic Server security realm. For example, the user name mapper can be configured to map a user from the Email attribute of the subject DN smithexample.com to a user in the WebLogic Server security realm smith. Use Default User Name Mapper Attribute Type and Default Username Mapper Attribute Delimiter attributes of the WebLogic Identity Assertion provider to define this information: ■ Default User Name Mapper Attribute Type—The subject distinguished name DN in a digital certificate used to calculate a username. Valid values are: C, CN, E, L, O, OU, S and STREET. ■ Default User Name Mapper Attribute Delimiter—Ends the username. The user name mapper uses everything to the left of the value to calculate a username. The default delimiter is . For more information, see Configure a user name mapper in the Oracle WebLogic Server Administration Console Help.

5.9.9 Configuring a Custom User Name Mapper

You can also write a custom user name mapper to map a token to a WebLogic Server user name according to whatever scheme is appropriate for your needs. The custom user name mapper must be an implementation of the weblogic.security.providers.authentication.UserNameMapper interface. You then configure the custom user name mapper in the active security realm, using the User Name Mapper Class Name attribute of the WebLogic Identity Assertion provider. For more information, see Configure a custom user name mapper in the Oracle WebLogic Server Administration Console Help. 6 Configuring Single Sign-On with Microsoft Clients 6-1 6 Configuring Single Sign-On with Microsoft Clients The following sections explain how to set up single sign-on SSO with Microsoft clients, using Windows authentication based on the Simple and Protected Negotiate SPNEGO mechanism and the Kerberos protocol, together with the WebLogic Negotiate Identity Assertion provider. ■ Section 6.1, Overview of Single Sign-On with Microsoft Clients ■ Section 6.2, System Requirements for SSO with Microsoft Clients ■ Section 6.3, Single Sign-On with Microsoft Clients: Main Steps ■ Section 6.4, Configuring Your Network Domain to Use Kerberos ■ Section 6.5, Creating a Kerberos Identification for WebLogic Server ■ Section 6.6, Configuring Microsoft Clients to Use Windows Integrated Authentication ■ Section 6.7, Creating a JAAS Login File ■ Section 6.8, Configuring the Identity Assertion Provider ■ Section 6.9, Using Startup Arguments for Kerberos Authentication with WebLogic Server ■ Section 6.10, Verifying Configuration of SSO with Microsoft Clients

6.1 Overview of Single Sign-On with Microsoft Clients

Single sign-on SSO with Microsoft clients allows cross-platform authentication between Web applications or Web services running in a WebLogic domain and .NET Web service clients or browser clients for example, Internet Explorer in a Microsoft domain. The Microsoft clients must use Windows authentication based on the Simple and Protected Negotiate SPNEGO mechanism. Cross-platform authentication is achieved by emulating the negotiate behavior of native Windows-to-Windows authentication services that use the Kerberos protocol. In order for cross-platform authentication to work, non-Windows servers in this case, WebLogic Server need to parse SPNEGO tokens in order to extract Kerberos tokens which are then used for authentication. For more information about Windows and Kerberos, see http:technet.microsoft.comen-uslibrarybb742431.aspx .