Flow for Oracle Identity Federation as SP

Custom Actions 12-7

12.2.2 Configuring Oracle Identity Federation for the Custom Action

Configure Oracle Identity Federation to forward the user to a pre-processing plug-in by performing these tasks: ■ identify the authentication engine whose flow will be modified. Choices are: Oracle SSO, OAM, LDAP, RDBMS Security, RDBMS Table, Proxy, JAAS and Infocard engines ■ Create or set the following two properties: – the web context property, referencing the web context where the custom JSP Page or servlet of the pre-processing plug-in resides. This property is located in the authnengines group of the Oracle Identity Federation configuration. – the relative path property referencing the path in the web context where the custom plug-in resides. Table 12–2 shows how to set the properties for each authentication engine: rdbmssec Invoke the RDBMS security engine by performing a forward to the endpoint referenced by fed as the root context and userauthnrdbmssec as the relative path rdbmstable Invoke the RDBMS table engine by performing a forward to the endpoint referenced by fed as the root context and userauthnrdbmstb as the relative path jaas Invoke the JAAS engine by performing a forward to the endpoint referenced by fed as the root context and userauthnjaas as the relative path infocard Invoke the Infocard engine by performing a forward to the endpoint referenced by fed as the root context and userauthnic as the relative path proxy Invoke the Fed SSO Proxy engine by performing a forward to the endpoint referenced by fed as the root context and userauthnproxy as the relative path httpheader Invoke the HTTP Header engine by performing a forward to the endpoint referenced by fed as the root context and userauthnhttp as the relative path Notes: ■ The plug-in must provide the authentication engine with the data that was passed to the plug-in as part of the authentication flow namely, the attributes that were set on the HttpServletRequest object. ■ The plug-in can modify all attributes that were set on the HttpServletRequest object except for the oracle.security.fed.authn.authnmech, oracle.security.fed.authn.refid and oracle.security.fed.authn.engineid attributes. Table 12–1 Cont. Engine IDs for Authentication Engines Engine ID Meaning 12-8 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation Use the WLST commands to set these properties in the Oracle Identity Federation configuration. For example, the following commands, in the WLST script environment for the Oracle Identity Federation instance, configure a pre-processing plug-in to be invoked before the Oracle SSO engine: setConfigPropertyauthnengines, osso-login-context, rootcontext, string setConfigPropertyauthnengines, osso-login, relativepath, string

12.3 Post-processing Custom Action for Authentication Engine

The user is directed to the post-processing plug-in module, as part of an authentication operation, after the authentication engine has completed processing and before the user is directed to Oracle Identity Federation. The plug-in enables custom actions to be taken after authentication. When the plug-in is in use, the authentication engine forwards the user internally to the plug-in, passing it the authentication data. After performing its custom actions, the plug-in forwards the user to Oracle Identity Federation, supplying the authentication data.

12.3.1 Implementing the Post-processing Plug-in

Custom Action Interaction with Oracle Identity Federation When the authentication engine redirects the user to Oracle Identity Federation during the authentication flow, it provides the following data to the plug-in as attributes on the HttpServletRequest object: Table 12–2 Authentication Engine Configuration for Pre-processing Plug-in Authentication Engine web context property relative path property Oracle Single Sign-On osso-login-context default missing osso-login default userauthnosso Oracle Access Manager oam-login-context default missing oam-login default userauthnoam LDAP ldap-login-context default missing ldap-login default userauthnldap RDBMS Security rdbmssec-login-context default missing rdbmssec-login default userauthnrdbmssec RDBMS Table rdbmstable-login-context default missing rdbmstable-login default userauthnrdbmstb JAAS jaas-login-context default missing jaas-login default userauthnjaas Infocard infocard-login-context default missing infocard-login default userauthnic Fed SSO Proxy proxy-login-context default missing proxy-login default userauthnproxy HTTP Header httpheader-login-context default missing httpheader-login default userauthnhttp Note: The available authentication engines are: Oracle SSO, OAM, LDAP, RDBMS Security, RDBMS Table, Proxy, JAAS Infocard, and HTTP Header.