Storing Assertion Attributes of User Session

Additional Server Configuration 6-13

6.7.3 Using a 303 Status Code for Redirects

Oracle Identity Federation implements the SAMLWS-FedLiberty protocols that provide single sign-on SSO capabilities to HTTP clients, such as browsers. The protocols and profiles exercised at runtime during SSO operations can involve some HTTP redirects, where the Oracle Identity Federation server issues an HTTP redirect command to the browser. By default, Oracle Identity Federation uses the 302 HTTP status code when issuing a redirect. It is possible to configure the Oracle Identity Federation server to instead use a 303 HTTP status code when issuing a redirect provided the client supports HTTP 1.1. To configure Oracle Identity Federation to use the 303 HTTP status code when possible, enter the WLST script environment for the Oracle Identity Federation instance, and set the following property: ■ Set the redirectuse302 boolean property from the serverconfig group to false if the Oracle Identity Federation server should use 303 HTTP status code when possible: setConfigPropertyserverconfig, redirectuse302, false, boolean ■ otherwise set the property to true.

6.8 Additional Protocol Configuration

This section contains these topics: ■ Configuring for eAuth Mode ■ Configuring the SAML 2.0 LDAP Attribute Profile ■ Configuring On-Demand Global Logout

6.8.1 Configuring for eAuth Mode

You can configure the Oracle Identity Federation server to comply with the eAuth specifications. Most of the configuration is performed through Fusion Middleware Control, but the specifications require the presence of two attributes in the SSO assertion that can only be configured through the MBeansWLST scripts: ■ the us:gov:e-authentication:basic:specVer attribute containing the version of the eAuth specifications supported by this server ■ the us:gov:e-authentication:basic:Sid attribute containing the session identifier of the user performing the single sign-on To configure Oracle Identity Federation to set those two attributes for a specific provider and to set the value of the eAuth version, enter the WLST script environment for Oracle Identity Federation instance, and set the following properties if needed: ■ Set the eauthmodeenabled boolean property for the remote provider to true to enable the eAuth mode: setFederationPropertyREMOTE_PROVIDER_ID, eauthmodeenabled, true, boolean Note: Liberty 1.x support is deprecated.