Management of Partner Certificates The SAML 2.0 Identity Assertion provider Java Interface for Configuring Identity Provider Partner Attributes Operations on

Configuring Authentication Providers 5-35 Specifying Default Partners To support the need for a default Identity Provider partner entry, one or more of the default partners Audience URI entries may contain a wildcard match that works for all targets. For example, target::.

5.9.5.1.2 Management of Partner Certificates The SAML 2.0 Identity Assertion provider

manages the trusted certificates for configured partners. Whenever a certificate is received during an exchange of partner messages, the certificate is checked against the certificates maintained for the partner. Partner certificates are used for the following purposes: ■ To validate trust when the Service Provider site receives a signed assertion or a signed SAML artifact request. ■ To validate trust in an Identity Provider partner that is retrieving a SAML artifact from the Artifact Resolution Service ARS via an SSL connection. The following certificates, which are obtained from each configured Identity Provider partner, are required: ■ The certificate used to verify signed SAML documents received from the partner, such as assertions and artifact requests The certificate used to verify signed SAML documents in web single sign-on is included in the metadata file received from the Identity Provider partner. When configuring web service Identity Provider partners, you obtain this certificate from your partner and import it into this partners configuration via the Assertion Signing Certificate tab of the partner management page in the Administration Console. ■ The Transport Layer Security TLS client certificate that is used to verify the connection made by the partner to the local sites SSL binding for retrieving SAML artifacts used in web single sign-on only When configuring a web single sign-on Identity Provider partner, you must obtain the TLS client certificate directly from the partner. It is not automatically included in the metadata file. You can import this certificate into the configuration data for this partner via the Transport Layer Client Certificate tab of the partner management page in the Administration Console.

5.9.5.1.3 Java Interface for Configuring Identity Provider Partner Attributes Operations on

web service partners are available in the com.bea.security.saml2.providers.registry.Partner Java interface. Notes: Configuring one or more partner lookup strings for an Identity Provider partner is required in order for that partner to be discovered at run time. If this partner cannot be discovered, no assertions for this partner can be validated. If you configure an endpoint URL without using the target lookup prefix, it will be handled as a conventional Audience URI that must be contained in assertions received from this Identity Provider partner. This also enables backwards-compatibility with existing Audience URIs that may be configured for this partner. 5-36 Securing Oracle WebLogic Server

5.9.6 Ordering of Identity Assertion for Servlets