JAAS Control Flag Click Access System Configuration, and then click AccessGate

17-2 Oracle Fusion Middleware Application Security Guide ■ OSSO Identity Asserter Processing ■ Consumption of Headers with OSSO Identity Asserter

17.1.1.1 Oracle WebLogic Security Framework

Figure 17–1 illustrates the location of components in the Oracle WebLogic Security Framework, including the OSSO Identity Asserter. Additional details follow. Figure 17–1 Location of OSSO Components in the Oracle WebLogic Security Framework At the top of the figure, Oracle HTTP Server is installed. This installation includes mod_weblogic and mod_osso, which are required to pass the identity token to the Providers and Oracle WebLogic Server. The Oracle WebLogic Server includes the partner application and the Identity Asserter also known as the Identity Assertion Provider. The 10g OracleAS Single Sign-On server OSSO Server, on the right side of the figure, communicates directly with the directory server and Oracle HTTP Server.

17.1.1.2 OSSO Identity Asserter Processing

Figure 17–2 illustrates the processing that occurs when you have OSSO implemented with the Identity Asserter. Additional details follow the figure. Note: For simplicity in text, this chapter uses the generic name of the WebLogic Server plug-in for Apache: mod_weblogic. For Oracle HTTP Server, the name of this plug-in differs from release 10g to 11g: ■ Oracle HTTP Server 10g: mod_wl actual binary name is mod_wl_ 20.so ■ Oracle HTTP Server 11g: mod_wl_ohs actual binary name is mod_wl_ohs.so Configuring Single Sign-On using OracleAS SSO 10g 17-3 Figure 17–2 OSSO Identity Asserter Processing The first time a request for a protected resource arrives at the mid-tier Web server, the request is redirected to the 10g OracleAS Single Sign-On server, which requires user credentials For a certificate-based authentication, no login page is displayed. After the user has been successfully authenticated, all further requests from that user require only that the user identity be asserted by the OSSO Identity Asserter before the population of a JAAS Subject takes place. The Subject is consumed by the downstream applications. For example, suppose you have an application residing on an Oracle WebLogic Server that is front-ended with the Oracle HTTP Server. The application is protected using resource mappings in the mod_osso configuration. This case is described in the following process overview. Process overview: OSSO Identity Asserter 1. The user requests a protected application.

2. The Oracle HTTP Server intercepts the request and processes it using mod_osso to

check for an existing, valid Oracle HTTP Server cookie.

3. If there is no valid Oracle HTTP Server cookie, mod_osso redirects to the OracleAS

SSO Server, which contacts the directory during authentication.

4. After successful authentication mod_osso decrypts the encrypted user identity

populated by the OSSO server and sets the headers with user attributes.

5. mod_weblogic completes further processing and redirects the request to the

Oracle WebLogic Server.

6. The WebLogic security layer invokes providers depending on their settings and

the order specified. For example: the security layer invokes the: ■ Identity Asserter, which makes the identity assertion based on retrieved tokens ■ Oracle Internet Directory Authenticator OID Authenticator, which populates the Subject with necessary Principals See Also: Consumption of Headers with OSSO Identity Asserter