From the SSOInfocard Mode drop-down, select either Infocard if the STS only

Additional Server Configuration 6-27 To add attributes to be requested for the STS, click Attribute Mappings. 6. Configure attribute mapping to list the attributes that the Oracle Identity Federation server will require when the card selector is invoked. For each attribute marked Require from Infocard, Oracle Identity Federation requires the given attribute be returned in the assertion from the WS-Trust server. The User Attribute Name is used to reference that attribute in Oracle Identity Federation, Assertion Attribute Name is the name of the attribute recognized by the STS, and FormatNamespace is the namespace to which the attribute is bound. The required claim from Oracle Identity Federation to the STS is the concatenation of the Namespace, , and the assertion attribute name. For example: ■ Add an attribute entry with User Attr Name=lastname, Assertion Attr Name=surname, Format or Namespace=http:schemas.xmlsoap.orgws200505identityc laims. Check the Require From Infocard box. ■ Add another attribute entry for User Attr Name=firstname, Assertion Attr Name=givenname, Format or Namespace=http:schemas.xmlsoap.orgws200505identityc laims. Check the Require From Infocard box. 7. Configure Oracle Identity Federation to map the assertion that is provided by the Personal Card Issuer to a local user. For example, in the Oracle Identity Federation Settings tab, in the Assertion Setting tabs, uncheck the Map User via NameID box, check Map User via Attribute Query and enter the following LDAP query: sn=lastnamegivenname=firstname 8. Save the changes.

6.12.2 Client-side Infocard Setup

This section contains these topics: ■ Import the Oracle Identity Federation SSL Certificate ■ Create a Personal Infocard

6.12.2.1 Import the Oracle Identity Federation SSL Certificate

The client machine must trust the Oracle Identity Federation SSL certificate for Windows Cardspace to trust Oracle Identity Federation and allow the user to use Infocards stored on the local computer. If the client does not trust the certificate authority that generated the SSL server, you must import the certificate. Take these steps to import the certificate: 1. Using Internet Explorer, navigate to the URL with format https:host:port. 2. Right-click on the page.

3. Select Properties.

4. Select Certificates.

5. Click the Certification Path tab.

6. Select the CA that issued the certificate and view the certificate. 6-28 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation

7. Click Install Certificates, and import the certificate in the trusted root

Certification Authorities.

6.12.2.2 Create a Personal Infocard

Take these steps to create a personal Infocard with Windows Cardspace:

1. Go to the Windows control panel.

2. Double-click Windows Cardspace if it is not present, install .NET from the

Microsoft download site at http:www.microsoft.comdownloads .

3. Click Add a Card.

4. Select Create a Personal Card and fill in the fields.

5. Save the changes.

6.13 Additional Run-time Configuration

This section describes additional features you can configure to manage run-time behavior. ■ Validating Target URLs for SSO and Logout Operations ■ Providing XML Message to SP Engine after SSO Completes ■ Customizing Error Pages ■ Configuring Schema Validation for SSO Protocol Messages

6.13.1 Validating Target URLs for SSO and Logout Operations

When performing the SSO and Logout protocols, Oracle Identity Federation executes the SAMLWS-Fed protocol exchanges and then redirects the user to a final target URL, such as: ■ a protected resource in case of SSO, or ■ a returnurl when performing logout These URLs can be specified as query parameters at runtime; for example, the returnurl query parameter for IdP-initiated SSO, logout flows, and so on. Here are some examples of flows where URLs can be specified: ■ a user can start an IdP-initiated SSO flow by accessing: fedidpinitiatesso?providerid=SP_PROVIDER_IDreturnurl=http3A2F2Furl.com ■ a user can start the logout flow by accessing: feduserlogout?returnurl=http3A2F2Furl.com Oracle Identity Federation lets you validate URLs that can be specified at runtime. You configure validation specifying a list of approved hostnames, or approved domains. Note: The returnurl query parameter value must be correctly URL Encoded