OAM Identity Asserter Configuring Identity Assertion for SSO with Oracle Access Manager 11g

15-26 Oracle Fusion Middleware Application Security Guide

f. Ensure that the parameter Control Flag is set to OPTIONAL initially.

7. In the Change Center, click Activate Changes.

8. DefaultAuthenticator

: Under the Providers tab, select DefaultAuthenticator, which changes its control flag to SUFFICIENT.

9. Reorder

: Under the Providers tab, reorder the providers so that DefaultAuthenticator is first OAMAuthenticator follows DefaultAuthenticator.

10. Oracle Access Manager Authenticator REQUIRED or the Only Authenticator

: Perform the following steps to set user rights for booting Oracle WebLogic Server.

a. Create an Administrators group in the directory server, if one does not already

exist or any other group for which you want boot access. b. Confirm that the LDAP user who boots Oracle WebLogic Server is included in the Administrators or other group.

c. From the WebLogic Administration Console, go to Security Realms, myrealm,

Roles and Policies, Global Roles.

d. Select View Conditions for the Admin Role.

e. Add the group and click Save. 11. Reboot the WebLogic Server.

12. Once the server has started, reset the Authentication Provider parameter Control

Flag to the appropriate value REQUIRED, OPTIONAL, or SUFFICIENT. See Also: Oracle Access Manager Authentication Provider Parameter List on page 16-14 for descriptions and values of the common and provider-specific parameters Note: Do not set the parameter Control Flag to REQUIRED until you have verified that the Authentication Provided is operational and configured correctly. Note: If the Oracle Access Manager Authenticator flag is set to REQUIRED, or if Oracle Access Manager Authenticator is the only Authentication provider, perform the next step to ensure that the LDAP user who boots Oracle WebLogic Server is included in the administrator group that can perform this task. By default the Oracle WebLogic Server Admin Role includes the Administrators group. Note: To provide access to any other group, you must create that group in the directory server and add the user who boots WebLogic Server in that group. Note: The recommended value is REQUIRED. To prevent a known issue, see JAAS Control Flag on page 16-74. Configuring Single Sign-On with Oracle Access Manager 11g 15-27 13. Proceed with Configuring the Application Authentication Method for the Authenticator .

15.2.4.2 Configuring the Application Authentication Method for the Authenticator

This topic describes how to create the application authentication method for Oracle Access Manager Authenticator. When you use the Oracle Access Manager Authenticator, all web.xml files in the application EAR file must specify BASIC in the element auth-method for the appropriate realm. The auth-method can use BASIC or FORM values. While these look like similar values in Oracle Access Manager, the auth-method specified in web.xml files are used by Oracle WebLogic Server not Oracle Access Manager. To configure the application authentication method for the Authenticator 1. Locate the web.xml file in the application EAR file: WEB-INFweb.xml 2. Locate the auth-method in login-config and enter BASIC. For example: security-constraint web-resource-collection web-resource-nameprotectedweb-resource-name url-patternservleturl-pattern web-resource-collection auth-constraint role-nameauth-usersrole-name auth-constraint security-constraint login-config auth-methodBASICauth-method login-config security-role descriptionAuthenticated Usersdescription role-nameauth-usersrole-name security-role 3. Save the file. 4. Redeploy and restart the application. 5. Repeat for each web.xml file in the application EAR file. 6. Proceed with Mapping the Authenticated User to a Group in LDAP .

15.2.4.3 Mapping the Authenticated User to a Group in LDAP

This topic describes how to map the authenticated user to a group in LDAP. To do this, you must edit the weblogic.xml file. For example, you might need to map your role-name auth-users to a group named managers in LDAP. See Also: Oracle Fusion Middleware Deploying Applications to Oracle WebLogic Server Note: For the Oracle Access Manager Authenticator, Oracle recommends auth-method BASIC in login-config within web.xml.