Configuring High Availability LDAP Servers

Additional Server Configuration 6-9 To enable and set the wait time for the User HTTP Session State replication setting for Oracle Identity Federation, enter the WLST script environment for Oracle Identity Federation and set the following properties: ■ To configure Oracle Identity Federation to wait for the session state to be replicated, set the sessionreplicationenabled boolean property from the serverconfig group to true, otherwise set it to false: setConfigPropertyserverconfig, sessionreplicationenabled, true, boolean ■ Set the sessionreplicationtimeout long property from the serverconfig group to the wait time in milliseconds, for example: setConfigPropertyserverconfig, sessionreplicationtimeout, 2000, long

6.5 Additional RDBMS Configuration

This section contains additional topics for RDBMS configuration for Oracle Identity Federation: ■ Configuring RDBMS Session Cache ■ Configuring RDBMS Data Compression

6.5.1 Configuring RDBMS Session Cache

When Oracle Identity Federation is using an RDBMS to store the user session objects, the server uses a caching mechanism to improve performance at runtime: the server keeps a reference to recently used session objects in memory to avoid read access to the database. You can configure the maximum number of session entries in the cache, and the maximum time the session is present in the cache before it is cleared. By default, Oracle Identity Federation server caches a maximum of 25,000 session entries, for a maximum time of 300 seconds It is important to set an optimal timeout, especially in cluster mode where the session can be destroyed by another Oracle Identity Federation server if: ■ a load balancer is used without sticky sessions ■ SOAP Logout is enabled To set maximum number of entries and the timeout settings for Oracle Identity Federation, enter the WLST script environment for Oracle Identity Federation and set the properties as in the following examples: ■ Set the transientrdbmssessioncachesize long property from the datastore group to the maximum entries: setConfigPropertydatastore, transientrdbmssessioncachesize, 25000, long ■ Set the transientrdbmssessioncachetimeout long property from the datastore group to the cache timeout in seconds: Note: This is a critical feature, since a given users session is accessed multiple times when performing an SSO operation. 6-10 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation setConfigPropertydatastore, transientrdbmssessioncachetimeout, 300, long

6.5.2 Configuring RDBMS Data Compression

To decrease the amount of data to be stored in an RDBMS, Oracle Identity Federation provides the capability to compress the data before storing it to the database. When Oracle Identity Federation is integrated with an RDBMS to store its user session Data or Message Data, the decision on when to compress data can be important. There are three kinds of data that can be compressed: ■ AuthnRequest for SSO Artifact profile: when Oracle Identity Federation acts as an IdP for Liberty 1.x protocol, the server stores the AuthnRequest message in the RDBMS when the artifact profile is used. If Liberty 1.x is not used, this data should not be compressed. By default compression is disabled. ■ Assertion Response for SSO Artifact profile: when Oracle Identity Federation acts as an IdP for SSO protocols, the server stores the Response message containing the assertion in the RDBMS when the artifact profile is used. This should be enabled if attributes are contained in the assertion. By default compression is enabled. ■ User Session Data: Oracle Identity Federation stores some session data related to the user at runtime. If several attributes are stored in the user session set by a custom Authentication Engine, or because the Attributes assertion storage was enabled when Oracle Identity Federation is an SP, then compression should be used. By default compression is disabled. To configure Oracle Identity Federation to compress data, enter the WLST script environment for Oracle Identity Federation and set the following properties: ■ Set the transientartifactrequestcompression boolean property from the datastore group to true if the AuthnRequest for SSO Artifact profile should be compressed, otherwise set it to false: setConfigPropertydatastore, transientartifactrequestcompression, true, boolean ■ Set the transientartifactresponsecompression boolean property from the datastore group to true if the assertion Response for SSO Artifact profile should be compressed, otherwise set it to false: setConfigPropertydatastore, transientartifactresponsecompression, true, boolean ■ Set the transientcompression boolean property from the datastore group to true if the user session Data should be compressed, otherwise set it to false: setConfigPropertydatastore, transientcompression, true, boolean Note: Liberty 1.x support is deprecated. Note: Liberty 1.x support is deprecated.