Configuring Oracle Identity Federation as an IdP Attribute Responder

5-46 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation set to urn:oasis:names:tc:SAML:2.0:attrname-format:basic; otherwise the NameFormat will hold the value specified in this field. – Repeat the operation to add other attribute mappings. ■ Click OK. 6. Enable and configure certificate validation: ■ Navigate to Administration, then Security and Trust ■ Select Enable Certificate Validation, and click Apply. ■ Add Trusted CAs or CRLs by clicking Add in the corresponding table and selecting the location of the CA or the CRL. Note: if certificate Validation is enabled, a Trusted CA is required to validate signatures. 7. If using SAML 2.0, enable encryption: ■ Navigate to Administration, then Service Provider. ■ In the SAML 2.0 tab, under Protocol Settings: – Check Send Encrypted NameIDs to encrypt the Name Identifiers in the AttributeQuery to the Attribute Responder. – Check Send Encrypted Attributes to encrypt the Attributes in the AttributeQuery to the Attribute Responder. ■ Click Apply. After enabling the attribute responder capability, you must configure: ■ which attributes to send ■ attribute name mappings ■ attribute value mappings ■ attribute value filters See Section 5.9, Configuring Attribute Mapping and Filtering for more information.

5.6.7 Configuring Oracle Identity Federation for SSL

To configure SSL for the server, see Section 8.1, Configuring SSL for Oracle Identity Federation . Note: For an SP using Oracle Identity Federation, the assertion Attr Name is determined by the attribute name in a ruleExpression as set in Section 5.6.4.3, Configuring an Oracle Access Manager Policy using Attribute Sharing . The attribute names must be agreed upon between the IdP and SP. Note: Configuring certificate Validation is optional. Note: Encryption is optional. Configuring Oracle Identity Federation 5-47

5.7 Configuring Identity Provider to send attributes in SSO Assertions

During a Single Sign-On operation, the identity provider can optionally include attributes in the authentication assertion to be consumed by the service provider. Take these steps to enable attributes to be sent in an assertion: 1. Log in to Fusion Middleware Control and navigate to the Oracle Identity Federation instance.

2. Navigate to Administration, then Federations.

3. Select the service provider with which you want to configure attribute sharing, and click Edit.

4. Select Update Manually.

5. Under the Oracle Identity Federation Settings tab, check Enable Attributes in

Single Sign-On . 6. Below, check the boxes to specify the Name ID formats for which attributes will be sent in assertions.

7. Click Apply.

After checking the Enable Attributes in Single Sign-On box, you need to configure: ■ the attributes to send ■ attribute name mapping ■ attribute value mappings ■ attribute value filters See Section 5.9, Configuring Attribute Mapping and Filtering for more information.

5.8 Web Services Interface for Attribute Sharing

This section describes the Oracle Identity Federations Attribute Requester Service Interface. It contains these topics: ■ Overview of the Service Interface ■ Attribute Request Message ■ Attribute Response Message ■ Interface WSDL

5.8.1 Overview of the Service Interface

The Attribute Requester Service provides a requestresponse interface using the SOAP POST protocol. The service supports the X.509 authn-based attribute sharing profile and follows the SAML AttributeQuery convention. The service can be invoked to send samlp:AttributeQuery messages to a remote identity provider. Here are the steps exercised when the web service client sends an AttributeRequest to the Oracle Identity FederationAttribute Requester server: 1. The web service client sends an AttributeRequest message using the SOAP protocol. 5-48 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation 2. Oracle Identity Federation processes the incoming AttributeRequest message, and selects the IdP to which to send the SAML AttributeQuery, based either on the IdP specified on the Request, or on the Subject contained in the AttributeRequest. 3. Oracle Identity Federation applies, for the specific remote IdP, the attribute value mapping for the optional attribute values listed in the AttributeRequest. 4. Oracle Identity Federation applies, for the specific remote IdP, the attribute name mapping for the optional attribute listed in the AttributeRequest. 5. Oracle Identity Federation sends the AttributeQuery to the remote IdP. 6. Oracle Identity Federation receives the response containing the assertion, along with the attributes sent by the IdP. 7. Oracle Identity Federation applies, for the specific remote IdP, the attribute name mapping for the attribute names listed in the assertions AttributeStatement. 8. Oracle Identity Federation applies, for the specific remote IdP, the attribute value mapping for the attribute values listed in the assertions AttributeStatement. 9. Oracle Identity Federation builds the AttributeResponse message, and returns it to the web service client in a SOAP response message.

5.8.2 Attribute Request Message

The AttributeRequest message issues a request for attribute data about a user. The AttributeRequest specifies these inputs: ■ The Subject: A string representing the user. This is a required input. ■ The Subject Format: A URI specifying how the Subject string represents the user. If not present, format oracle:security:nameid:format:x509 will be used. Valid formats are: – oracle:security:nameid:format:x509: Indicates that the Name ID is the Subject DN. – oracle:security:nameid:format:entity: Indicates that the Name ID is the identifier of an entity that provides SAML services. This Name ID Format only applies to the SAML 2.0 protocol. – oracle:security:nameid:format:emailaddress: Indicates that the Name ID is in the form of an email address. – oracle:security:nameid:format:windowsdomainqualifiedname: Indicates that the Name ID is a Windows domain qualified name A Windows domain qualified name is a string of the form DomainName\UserName, where the DomainName and \ can be omitted. – oracle:security:nameid:format:kerberos: Indicates that the Name ID is in the form of a Kerberos principal name using the format name[instance]REALM. This Name ID Format only applies to the SAML 2.0 protocol. – oracle:security:nameid:format:persistent: Indicates that the Name ID is a persistent opaque identifier for the user that is specific to an IdP and SP. This Name ID Format only applies to the SAML 2.0 protocol. – oracle:security:nameid:format:transient: Indicates that the Name ID is an opaque and temporary identifier for the user. This Name ID Format only applies to the SAML 2.0 protocol.