Server Tuning Advanced Tuning Configurations

Oracle Identity Federation Performance Tuning 24-5 ■ AuthnRequest for SSO Artifact profile: when Oracle Identity Federation acts as an IdP for Liberty 1.x protocol, the server stores the AuthnRequest message in the RDBMS when the artifact profile is used. ■ Assertion Response for SSO Artifact profile: when Oracle Identity Federation acts as an IdP for SSO protocols, the server stores the Response message containing the Assertion in the RDBMS when the artifact profile is used. This must be enabled if attributes are contained in the assertion. ■ User Session Data: Oracle Identity Federation stores some session data related to the user at run time. If several attributes are stored in the User Session set by a custom Authentication Engine, or because the Attributes Assertion storage was enabled when Oracle Identity Federation was a service provider, then compression should be used. See Configuring RDBMS Data Compression in Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation.

24.4 Oracle HTTP Server Tuning

If Oracle Identity Federation is fronted by Oracle HTTP Server OHS, then the configuration of the HTTP Server can be tuned to increase performance. For more information on Oracle HTTP Server, see Oracle Fusion Middleware Administrators Guide for Oracle HTTP Server. The following parameters can be changed in the httpd.conf file of the OHS. For additional Oracle HTTP tuning configurations, see Chapter 5, Oracle HTTP Server Performance Tuning . Consult your use case scenarios to determine what your settings should be. ■ Timeout ■ KeepAlive ■ MaxKeepAliveRequests ■ KeepAlive TimeOut ■ MinSpareServers ■ MaxSpareServers ■ StartServers ■ MaxClients ■ MaxRequestPerChild After modifying these parameters, save and restart OHS.

24.5 SAML Protocol Tuning

The Security Assertion Markup Language SAML protocol involves interacting with remote servers through the use of the Simple Object Access Protocol SOAP.

24.5.1 SOAP Connections

The Oracle Identity Federation server uses the SOAP protocol to send SAML Requests and to receive SAML Responses. To optimize performance, configure the following SOAP connections: 24-6 Oracle Fusion Middleware Performance and Tuning Guide ■ Total maximum number of SOAP connections that Oracle Identity Federation can open at the same time ■ Maximum number of SOAP connections that Oracle Identity Federation can open at the same time to a given remote server For more information, see SOAP Binding in Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation.

24.5.2 XML Digital Signatures

The SAML and WS-Fed protocols of Oracle Identity Federation rely on XML Digital Signatures to ensure the authenticity of messages and that messages are not tampered with. When possible, sign the Assertion andor the Response to prevent any modifications. When no XML Digital Signature is present on the message, the audited message that is archived does not contain any data that proves the authenticity and integrity of the message. Configuring Oracle Identity Federation to not sign Assertion andor Response may be appropriate if: ■ Performance must be improved ■ SSL with SSL authentication is enabled for SOAP communications ■ Disabling XML Digital Signatures is compliant with company security regulations

24.5.3 POST and Artifact Single Sign-On Profiles

There are two Single Sign-On profiles defined by the SAML specifications: ■ POST Profile In the POST profile, the Assertion transits through the users browser, therefore the Assertion andor the Response must be signed to ensure that the content has not been modified. ■ Artifact Profile In the Artifact profile, the Identity Provider creates a random identifier referencing the Assertion in the IdPs local store. The Assertion is provided directly from the Identity Provider to the Service Provider. That identifier is carried by the users browser and presented to the Service Provider that contacts the Identity Provider to de-reference the identifier and retrieve the corresponding Assertion. If the SOAP connection made from the SP to the IdP is encrypted using the SSL protocol with an SSL Server Certificate, then the SP authenticates the IdP and the content of the communication has not been tampered with: in this case, the Note: The content of the Assertion is viewable unless SAML 2 Encryption is used. Encrypting the Assertion is optional, but XML Encryption is resource intensive and decreases performance Note: If the performance must be improved and if using the POST profile is compliant with company security regulations, then configuring Oracle Identity Federation to use the POST profile may be an option to improve performance. Oracle Identity Federation Performance Tuning 24-7 transport layer is providing the authenticity and the integrity of the message, and the XML Digital Signature on the SAML Response and Assertion can be optional. If no XML Digital Signature is present on the message, then the audited message that is archived does not contain any data that proves the authenticity and integrity of the message. Note: Since the Artifact profile involves additional communication flow between the Service Provider and the Identity Provider, performance may be slower when using the Artifact profile.