HTTP Basic Authentication Authentication Engines

2-20 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation

2.4 Data Repositories

This section describes installation requirements to enable Oracle Identity Federation to work with data stores. It contains these topics: ■ Federation Data Store ■ User Data Store ■ Session and Message Data Stores ■ Configuration Data Store

2.4.1 Federation Data Store

You must select a data repository for the persistent federation data store. Oracle Identity Federation works with industry-standard LDAP repositories including: ■ Oracle Internet Directory ■ Sun Java System Directory Server ■ Microsoft Active Directory ■ IBM Tivoli It also supports XML stores, databases, and a None option no repository for SAML and WS-Federation using non-opaque name identifiers such as e-mail address, X.509 DN, Kerberos, or Windows Name Identifier. Connection Information Collect the following information about the repository prior to installing Oracle Identity Federation: ■ The Connection URL space-delimited list of LDAP server URLs - hostname and port ■ The Bind DN This is the DN used by the Oracle Identity Federation server to connect to the LDAP server. For example: cn=fedid,dc=mycompany,dc=com ■ Password ■ The User Federation Record Context This is the node under which all federation records for this Oracle Identity Federation server will be stored. ■ The LDAP Container Object Class This is the type of User Federation Record Context that Oracle Identity Federation should use when creating the LDAP container, if it does not exist already. If that field is empty, its value will be set to applicationprocess. For Microsoft Active Directory this field has to be set, to container for example. The appropriate setting for this field depends on the User Federation Record Context being used. User Federation Record Context is described later in this section. Here are examples of the LDAP Container Object Class for different types of directory servers: – Oracle Internet Directory: empty Planning Oracle Identity Federation Deployment 2-21 – Oracle Directory Server Enterprise Edition: empty – Microsoft Active Directory: container ■ Unique Federation ID Attribute This is the LDAP attribute to be used to uniquely identify a federation record. This attribute should be defined in the LDAP Object Class of the Federation Record type, or in its top parent. If it is empty, the default Federation ID attribute will be used as the DN of the Federation Record. Here are examples of the Unique Federation ID attribute for different types of directory servers: – Oracle Internet Directory: empty – Oracle Directory Server Enterprise Edition: empty – Microsoft Active Directory: empty ■ Maximum Connections. This is the maximum number of concurrent connections made by Oracle Identity Federation to the LDAP server. ■ Connection Wait Timeout. This is the maximum number in seconds to wait until a connection is available, when the maximum number of connections opened by Oracle Identity Federation to the LDAP server has been reached. Relationship of User Federation Record Context and LDAP Container Object Class The User Federation Record Context and LDAP Container Object Class must be compatible. In the User Federation Record Context, the administrator specifies the DN of the container where the federation records will be stored. That DN will contain the parent of the container that must already exist for example dc=us,dc=oracle,dc=com, and an attribute of the Federation Record Context that is part of its object class for example, cn=orclfed. An example of such DN would be cn=orclfed,dc=us,dc=oracle,dc=com. The requirement for that example is that cn must be an attribute of the Object Class set in the LDAP Container Object Class field or the applicationprocess object class if not set. If the administrator chooses to have the DN of the Federation Record Context like ou=fed,dc=us,dc=oracle,dc=com, she must set the LDAP Container Object Class field to an object class that has ou as an attribute, like organizationalUnit. To summarize, the User Federation Record Context references the LDAP container entry under which federation records are stored, and the LDAP Containers attribute used in the DN must be defined in the LDAP Container Object Class used. For example, if DN is ou=fed,dc=us,dc=oracle,dc=com, then the LDAP Container Object Class must define the ou attribute; if DN is cn=fed,dc=us,dc=oracle,dc=com, then the LDAP Container Object Class must define the cn attribute. A Note About the LDAP Schema The LDAP schema needs to be upgraded to include the attributes and object classes defined by Oracle Identity Federation, in order for the federation server to create records in the LDAP server. Upgrade the LDAP schema either at installation time with the Advanced Installation mode, or after installation. Upgrade Schema at Installation