Precautions when Customizing the Page in HTTP Post Profile

6-14 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation replace REMOTE_PROVIDER_ID with the identifier of the remote provider ■ Set the eauthversion string property from the idpglobal group to the value the Oracle Identity Federation server should use 2.0 for example: setConfigPropertyidpglobal, eauthversion, 2.0, string

6.8.2 Configuring the SAML 2.0 LDAP Attribute Profile

The SAML 2.0 specifications define the X.500 LDAP attribute profile, listing the attributes that an assertion must contain to be compliant with that profile. The requirements are as follows: ■ The format must be urn:oasis:names:tc:SAML:2.0:attrname-format:uri. ■ The name must be a URI. ■ The SAML Attribute element must specify an XML Encoding attribute and its value must be set to LDAP. The first two requirements are met by configuring the attribute for the Oracle Identity Federation server instance in Fusion Middleware Control. The last requirement is met by configuring Oracle Identity Federation with WLST scripts; a property is set for a specific provider to which Oracle Identity FederationIDPAttributeAuthority will send the attributes contained in an assertion. How to Use WLST for the X.500 LDAP Attribute Profile Enter the WLST script environment for the Oracle Identity Federation server instance, then set the attrx500ldapenabled property for the remote provider to which Oracle Identity Federation will provide the assertion. Set the attrx500ldapenabled boolean property to true to make the server compliant with the X.500 LDAP attribute profile. Otherwise set it to false: setFederationPropertyREMOTE_PROVIDER_ID, attrx500ldapenabled, true, boolean replace REMOTE_PROVIDER_ID with the identifier of the remote provider

6.8.3 Configuring On-Demand Global Logout

You can specify whether WS-FedSAML Global Logout should be executed when a logout operation is invoked at the Oracle Identity Federation server. In a typical federation deployment, when the user invokes logout at the federation server, the flow is as follows: ■ The user invokes the Oracle Identity Federation logout service at the feduserlogout URL. See Section 4.2.5, Launch the Logout Process for details about the logout service. ■ Oracle Identity Federation: – logs the user out of the various authentication engines and SP integration modules Oracle Access Manager, Oracle Single Sign-On, and others Additional Server Configuration 6-15 – redirects the user for logout from the remote Federation partners involved in the current user session: this operation is called Global Logout. – finishes the logout operation once the global logout is complete. You can disable the Global Logout flow with Fusion Middleware Control in two ways: ■ globally, by selecting the Local Logout Only setting described in Section 5.2, Configuring Server Properties . ■ on a per-provider basis, by selecting the Do not perform Global Logout with this Provider setting on the Oracle Identity Federation Settings tab of the partner configuration section. While these two approaches provide static control over the logout flow behavior, on-demand global logout lets you specify whether the user can invoke the global logout protocol at runtime. To specify whether the user can choose global logout, you configure the federation server by setting the slouserprefenabled boolean property of the serverconfig group as follows: ■ true to allow the user to choose global logout ■ false to disallow the user from choosing global logout To set the property, enter the WLST script environment for the Oracle Identity Federation server instance, and set the following property: setConfigPropertyserverconfig, slouserprefenabled, true, boolean When on-demand global logout is enabled, the user can choose to perform the WS-FedSAML Logout operation by specifying the globalslo query parameter when invoking the Oracle Identity Federation logout service URL. This parameter is of type boolean, and accepts one of two values: ■ true, meaning that the global logout operation should be performed ■ false, meaning that only the local logout should be performed Following the instructions in Section 4.2.5, Launch the Logout Process , the user invokes the service with a URL similar to: http:hostname:portfeduserlogout?returnurl=http3A2F2Fanotherhostname2Fpath globalslo=false

6.9 Protecting the SOAP Endpoint

Oracle Identity Federation provides two methods to protect the SOAP endpoint used in the SAML 1.x SAML 2.0 Liberty 1.x protocols: ■ SSL with Client Authentication via SSL Certificate: the SOAP endpoint is protected with SSL, and by requiring an SSL Client certificate ■ HTTP Basic Authentication: with this method, the SOAP endpoint is protected using the HTTP Basic Authentication mechanism. Topics include: Note: Liberty 1.x support is deprecated.