Select the STS, click Update, then select Update Manually.

Additional Server Configuration 6-27 To add attributes to be requested for the STS, click Attribute Mappings. 6. Configure attribute mapping to list the attributes that the Oracle Identity Federation server will require when the card selector is invoked. For each attribute marked Require from Infocard, Oracle Identity Federation requires the given attribute be returned in the assertion from the WS-Trust server. The User Attribute Name is used to reference that attribute in Oracle Identity Federation, Assertion Attribute Name is the name of the attribute recognized by the STS, and FormatNamespace is the namespace to which the attribute is bound. The required claim from Oracle Identity Federation to the STS is the concatenation of the Namespace, , and the assertion attribute name. For example: ■ Add an attribute entry with User Attr Name=lastname, Assertion Attr Name=surname, Format or Namespace=http:schemas.xmlsoap.orgws200505identityc laims. Check the Require From Infocard box. ■ Add another attribute entry for User Attr Name=firstname, Assertion Attr Name=givenname, Format or Namespace=http:schemas.xmlsoap.orgws200505identityc laims. Check the Require From Infocard box. 7. Configure Oracle Identity Federation to map the assertion that is provided by the Personal Card Issuer to a local user. For example, in the Oracle Identity Federation Settings tab, in the Assertion Setting tabs, uncheck the Map User via NameID box, check Map User via Attribute Query and enter the following LDAP query: sn=lastnamegivenname=firstname 8. Save the changes.

6.12.2 Client-side Infocard Setup

This section contains these topics: ■ Import the Oracle Identity Federation SSL Certificate ■ Create a Personal Infocard

6.12.2.1 Import the Oracle Identity Federation SSL Certificate

The client machine must trust the Oracle Identity Federation SSL certificate for Windows Cardspace to trust Oracle Identity Federation and allow the user to use Infocards stored on the local computer. If the client does not trust the certificate authority that generated the SSL server, you must import the certificate. Take these steps to import the certificate: 1. Using Internet Explorer, navigate to the URL with format https:host:port. 2. Right-click on the page.

3. Select Properties.

4. Select Certificates.

5. Click the Certification Path tab.

6. Select the CA that issued the certificate and view the certificate.