Example 1: Automatic Account Linking through NameID mapping for SAML 2.0

6-42 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation

6.17.7 Example 5: Automatic Account Linking via Attribute Query for a Specific IdP

If Oracle Identity FederationSP needs an attribute-based authentication configuration specific to a peer identity provider, then the setup information needs to be stored in the IdPs entry in the Federations list. In this example, Oracle Identity FederationSP is using federated identities and is set up for automatic account linking through attribute query for an IdP referenced by http:idp.com. Perform the following steps to configure Oracle Identity FederationSP:

1. Log in to Fusion Middleware Control.

2. Navigate to Administration, then Federations.

3. Select the identity provider and click Update.

4. Click the Oracle Identity Federation Settings tab.

5. Expand the service providerRequester Settings section, and go to assertion

settings.

6. Check Map User via Federated Identity.

7. Check Map Enable Auto Account Linking.

8. Check Map User via Attribute Query.

9. Enter the following LDAP query in the Attribute Query field:

mail=emailsn=lastname.

10. Uncheck Map User via NameID.

11. Check Error when User Mapping fails; this forces Oracle Identity Federation to

return a 401 error to the browser if the user cannot be located.

12. Apply the changes.

6.18 User Opt-In and Opt-Out for Single Sign-On

You can configure Oracle Identity Federation IdP to determine if a user has given or denied permission to perform federated single sign-on for the user, based on the value of an attribute in the user’s directory record. If consent has been given, SSO operations can be performed automatically if the user is authenticated at Oracle Identity FederationIdP, or within the identity and access management IAM framework integrated with Oracle Identity Federation. If consent has not been obtained, Oracle Identity FederationIdP must challenge the user for credentials every time a Federation SSO operation occurs, even if the user is already authenticated at Oracle Identity Federation in the IAM domain. Topics in this section include: ■ Modes of Operation ■ Configuring Oracle Identity Federation ■ Example 1: Off Mode ■ Example 2: Opt-In Mode Note: In this section, Oracle Identity FederationIdP refers to Oracle Identity Federation acting as identity provider.