Configuring for eAuth Mode

Additional Server Configuration 6-15 – redirects the user for logout from the remote Federation partners involved in the current user session: this operation is called Global Logout. – finishes the logout operation once the global logout is complete. You can disable the Global Logout flow with Fusion Middleware Control in two ways: ■ globally, by selecting the Local Logout Only setting described in Section 5.2, Configuring Server Properties . ■ on a per-provider basis, by selecting the Do not perform Global Logout with this Provider setting on the Oracle Identity Federation Settings tab of the partner configuration section. While these two approaches provide static control over the logout flow behavior, on-demand global logout lets you specify whether the user can invoke the global logout protocol at runtime. To specify whether the user can choose global logout, you configure the federation server by setting the slouserprefenabled boolean property of the serverconfig group as follows: ■ true to allow the user to choose global logout ■ false to disallow the user from choosing global logout To set the property, enter the WLST script environment for the Oracle Identity Federation server instance, and set the following property: setConfigPropertyserverconfig, slouserprefenabled, true, boolean When on-demand global logout is enabled, the user can choose to perform the WS-FedSAML Logout operation by specifying the globalslo query parameter when invoking the Oracle Identity Federation logout service URL. This parameter is of type boolean, and accepts one of two values: ■ true, meaning that the global logout operation should be performed ■ false, meaning that only the local logout should be performed Following the instructions in Section 4.2.5, Launch the Logout Process , the user invokes the service with a URL similar to: http:hostname:portfeduserlogout?returnurl=http3A2F2Fanotherhostname2Fpath globalslo=false

6.9 Protecting the SOAP Endpoint

Oracle Identity Federation provides two methods to protect the SOAP endpoint used in the SAML 1.x SAML 2.0 Liberty 1.x protocols: ■ SSL with Client Authentication via SSL Certificate: the SOAP endpoint is protected with SSL, and by requiring an SSL Client certificate ■ HTTP Basic Authentication: with this method, the SOAP endpoint is protected using the HTTP Basic Authentication mechanism. Topics include: Note: Liberty 1.x support is deprecated. 6-16 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation ■ SSL Client Authentication ■ HTTP Basic Authentication

6.9.1 SSL Client Authentication

Refer to Section 8.1, Configuring SSL for Oracle Identity Federation for details on how to: ■ configure SSL to protect the SOAP URL ■ configure Oracle Identity Federation to connect to SOAP endpoints protected by SSL

6.9.2 HTTP Basic Authentication

This section describes: ■ how to configure HTTP Basic Authentication on the server to protect SOAP URLs ■ how to configure the credentials that are used when connecting to a remote server protected by HTTP basic authentication using the SOAP protocol

6.9.2.1 Configuring HTTP Basic Authentication to protect the SOAP URLs

This section lists the steps needed to protect the SOAP endpoints. The configuration changes are made on the Oracle WebLogic administration server. The steps are as follows: Configure Oracle WebLogic Server to check created policies 1. Log in to the Oracle WebLogic Server Administration Console.

2. On the left-hand pane, select Security Realm, and navigate to myrealm, then

Configuration , then Advanced.

3. Select the following settings:

■ Check roles and Policies: All Web applications and EJBs ■ When Deploying Web Applications or EJBs: Initialize roles and policies from DD Click Save. 4. Stop the Administration server by navigating to Environment, then Servers, then Control , selecting AdminServer and clicking Shutdown - Force Shutdown Now. 5. From a terminal window, start the Administration server by invoking the script: DOMAIN_HOMEbinstartWebLogic.sh. Create a Group and a User 1. Log in to the Oracle WebLogic Server Administration Console.

2. On the left-hand pane, select Security Realms and navigate to myrealm, then

Users and Groups , then Groups.

3. Click New and select a name for example, soapusers. Click OK.

Note: When it is integrated with Oracle Single Sign-On with mod_ osso, Oracle Identity Federation cannot be protected using HTTP Basic Authentication.