Configuring the HTTP Session State SleepRetry Interval

6-10 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation setConfigPropertydatastore, transientrdbmssessioncachetimeout, 300, long

6.5.2 Configuring RDBMS Data Compression

To decrease the amount of data to be stored in an RDBMS, Oracle Identity Federation provides the capability to compress the data before storing it to the database. When Oracle Identity Federation is integrated with an RDBMS to store its user session Data or Message Data, the decision on when to compress data can be important. There are three kinds of data that can be compressed: ■ AuthnRequest for SSO Artifact profile: when Oracle Identity Federation acts as an IdP for Liberty 1.x protocol, the server stores the AuthnRequest message in the RDBMS when the artifact profile is used. If Liberty 1.x is not used, this data should not be compressed. By default compression is disabled. ■ Assertion Response for SSO Artifact profile: when Oracle Identity Federation acts as an IdP for SSO protocols, the server stores the Response message containing the assertion in the RDBMS when the artifact profile is used. This should be enabled if attributes are contained in the assertion. By default compression is enabled. ■ User Session Data: Oracle Identity Federation stores some session data related to the user at runtime. If several attributes are stored in the user session set by a custom Authentication Engine, or because the Attributes assertion storage was enabled when Oracle Identity Federation is an SP, then compression should be used. By default compression is disabled. To configure Oracle Identity Federation to compress data, enter the WLST script environment for Oracle Identity Federation and set the following properties: ■ Set the transientartifactrequestcompression boolean property from the datastore group to true if the AuthnRequest for SSO Artifact profile should be compressed, otherwise set it to false: setConfigPropertydatastore, transientartifactrequestcompression, true, boolean ■ Set the transientartifactresponsecompression boolean property from the datastore group to true if the assertion Response for SSO Artifact profile should be compressed, otherwise set it to false: setConfigPropertydatastore, transientartifactresponsecompression, true, boolean ■ Set the transientcompression boolean property from the datastore group to true if the user session Data should be compressed, otherwise set it to false: setConfigPropertydatastore, transientcompression, true, boolean Note: Liberty 1.x support is deprecated. Note: Liberty 1.x support is deprecated. Additional Server Configuration 6-11

6.6 Session Repository Configuration

This section contains topics related to maintaining the session repository.

6.6.1 Storing Assertion Attributes of User Session

The Oracle Identity Federation server features a session store containing the session information of the currently authenticated users. This session repository is capable of storing attributes that Oracle Identity Federation can use, when acting as identity provider IdP, to populate SSO assertions. The attributes stored in the user session can be added to the store in two ways: ■ by a custom authentication engine, by setting a list of attributes to be saved in the user session ■ with Oracle Identity Federation acting as a service provider SP, when processing an incoming assertion; Oracle Identity Federation can save the attributes contained in the assertion, and the NameID and providerID in the user session By default, for performance reasons, the storage of assertion information in the user session is disabled when Oracle Identity Federation acts as an SP. To configure the Oracle Identity Federation server to store the assertion information, enter the WLST script environment for Oracle Identity Federation instance, and set the following property: ■ Set the sessionstoreassertionattrs boolean property from the spglobal group to true if the attributes contained in the assertion, and the NameID and providerID, should be stored in the user session: setConfigPropertyspglobal, sessionstoreassertionattrs, true, boolean ■ otherwise set it to false: setConfigPropertyspglobal, sessionstoreassertionattrs, false, boolean

6.7 Additional HTTP Configuration

This section contains additional topics for HTTP configuration for Oracle Identity Federation: ■ Configuring HTTP-Only Flag for HTTP Cookies Set by Oracle Identity Federation ■ Precautions when Customizing the Page in HTTP Post Profile ■ Using a 303 Status Code for Redirects

6.7.1 Configuring HTTP-Only Flag for HTTP Cookies Set by Oracle Identity Federation

A non-standard extension to RFC2965 extends the set-cookie header further by specifying an HttpOnly flag. When you set this flag, the client browser should not make the cookie contents available to scripting environments. For example, the JavaScript document.cookie method should not return the cookie contents. This significantly protects against cross-site scripting and similar attacks. By default Oracle Identity Federation does not set the HttpOnly flag.