Sample Authentication Module for LDAP Integration

10-18 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation

10.4.2 Developing and Implementing the Integration Module

This section describes how to develop the integration module and how to implement it in the federation environment. ■ Path URLs ■ Adding or Modifying an SP Integration Engine ■ Implementing the Service

10.4.2.1 Path URLs

Communication between the Oracle Identity Federation engine and the SP integration engine requires internal servlet forwards that are equivalent to API calls. These forwards are achieved with the following JavaEE API: ServletContext.getContextString contextPath .getRequestDispatcherString relativePath .forwardHttpServletRequest request, HttpServletResponse response where ■ contextPath is the root context path of the web application. For example, the contextPath of Oracle Identity Federation is fed. ■ relativePath is the service URL to which the uses is forwarded, and is relative to the contextPath. For example, when starting a Federation SSO flow, the SP integration engine uses spstartsso as the relativePath when forwarding the user. Oracle Identity Federation needs to be aware of the ID and the contextPath and the relativePath of the new SP integration engine; This is the URL that will process the result of the Federation SSO operation after the federation server has processed the incoming assertion.

10.4.2.2 Adding or Modifying an SP Integration Engine

To add or modify the SP integration engine take these steps: 1. Go to Fusion Middleware Control and navigate to the Oracle Identity Federation instance.

2. Navigate to Administration then SP Integration Modules. Click the Custom SP

Engine tab.

3. To add an SP integration engine, click Add and enter a name for that SP

integration engine. Oracle Identity Federation will generate an ID for that new engine

4. To modify an SP integration engine, select it and:

■ Enable or disable the engine ■ Specify the contextPath of the SP integration engine in the Web Context field Note: the name will only be used in Fusion Middleware Control for display purposes while the ID is used during communication between Oracle Identity Federation and the authentication engine Integrating with Third-Party Identity and Access Management Modules 10-19 ■ Specify the relative path of the login service of the SP integration engine in the Login Relative Path field ■ Select the authentication mechanism to use if a local authentication procedure needs to occur during the assertion processing this can happen when Federated Identities are used to map the assertion to a user record, if the Federation record does not exist: in this case, the user will need to be locally authenticated in order to perform the one time operation that will create the record ■ Enable or disable logout ■ Specify the relative path of the logout service of the SP integration engine in the Logout Relative Path field 5. Save your changes.

10.4.2.3 Implementing the Service

Upon receiving a request from Oracle Identity Federation, the SP integration engine needs to: ■ create an authenticated session for the user ■ redirect the user to the final URL Attributes Set by SP Integration Module To initiate a Federation SSO operation, the SP integration module needs to forward the user to Oracle Identity Federation by specifying the following data as HttpServletRequest attributes: ■ An optional authentication mechanism specifying to the SP which authentication mechanism to request the IdP to use during authentication. identified by oracle.security.fed.sp.authnmech. This parameter is ignored if usedefault is true or missing. ■ An optional Provider ID referencing the IdP to use for the Federation SSO. If missing, Oracle Identity Federation will use the IdP mapped for the specified authentication mechanism. If no IdP could be found, Oracle Identity Federation will use the IdP configured as the default SSO IdP. The value is a String identified by oracle.security.fed.sp.providerid ■ An optional federation ID referencing the affiliation to use to trigger the Federation SSO, as a String identified by oracle.security.fed.sp.federationid ■ The relay state. It can contain a small string, for example a reference to some data saved in a repository or a small URL pointing to the protected resource to redirect the user to after completion of the SSO operation. identified by oracle.security.fed.sp.relaystate ■ The identifier of the SP engine that started the SSO flow, as a String identified by oracle.security.fed.sp.engineid See Also: Section 5.16, Configuring SP Integration Modules Note: if set, this parameter is used to determine the IdP to use, as described below, disregarding the usedefault parameter 10-20 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation ■ An optional boolean indicating if Oracle Identity Federation should authenticate the user locally using the authentication engines or if a Federation SSO should be started by redirecting the user to an IdP for authentication, as a Boolean identified by oracle.security.fed.sp.localauthn ; default is false ■ A Boolean object indicating whether to use the configuration stored in Oracle Identity Federation or to only start the SSO based on the information being passed by the SP engine, except the IdP identified by oracle.security.fed.sp.usedefault. If missing, true is assumed. ■ A Boolean object indicating whether the SP should ask the IdP to challenge the user even if heshe is already authenticated identified by oracle.security.fed.sp.forceauthn. This parameter is ignored if usedefault is true or missing. ■ A Boolean object indicating whether the SP should allow the IdP to create a federation record if one does not yet exist, during the SSO operation identified by oracle.security.fed.sp.allowfedcreation. This parameter is ignored if usedefault is true or missing. ■ A Boolean object indicating whether the SP should ask the IdP not to interact with the user during the SSO operation identified by oracle.security.fed.sp.passive. This parameter is ignored if usedefault is true or missing. ■ A String representing the binding to use when sending the AuthnRequest identified by oracle.security.fed.sp.requestbinding. This parameter is ignored if usedefault is true or missing. Acceptable values are httpredirect, httpost, httppostsimple depending on the protocol ■ A String representing the binding to use when sending the Response with the assertion identified by oracle.security.fed.sp.responsebinding. This parameter is ignored if usedefault is true or missing. Acceptable values are artifact or httpost depending on the protocol. ■ An optional authentication mechanism comparison specifying to the SP which authentication context comparison to request the IdP to use during authentication. identified by oracle.security.fed.sp.authnmechcomparison. This parameter is ignored if usedefault is true or missing. ■ A String representing the NameID format the SP will ask to the IdP for the SSO operation identified by oracle.security.fed.sp.nameidformat. This parameter is ignored if usedefault is true or missing. ■ Optional attributes to be requested from the identity provider during the Federation SSO operation for example when interacting with an OpenID IdP. The data is passed as a Map with Strings as keys and a set of objects as values, identified by oracle.security.fed.sp.attributes. The values is optional, while the keys contain the attribute names. Oracle Identity Federation Assertion Processing Oracle Identity Federation then performs a SAMLWS-Fed SSO operation with a remote IdP, processes the assertion, maps it optionally to a local user record and finally forwards the user back to the SP integration engine that initiated the operation by specifying the following information as HttpServletRequest attributes: ■ A Boolean object indicating if the SSO operation was successful identified by oracle.security.fed.sp.authnresult ■ The identifier of the user as a String identified by oracle.security.fed.sp.userid