Executing the Commands Introduction to Command-Line Tools for Oracle Identity Federation
9.2.1 addConfigListEntryInMap
Online command that adds a property value to a nested list inside a map. getFederationPropertyMapEntry Retrieve a property map entry for a specific remote providers configuration. Online listCustomAuthnEngines Display the list of custom authentication engines. Online listCustomSPEngines Display the list of custom SP engines. Online loadMetadata Load metadata from a file. Online oifStatus Display the status of an Oracle Identity Federation server. Online removeConfigListInMap Delete a configuration list in a map. Online removeConfigMapEntryInMap Delete a configuration map entry in a map. Online removeConfigMapInMap Delete a nested configuration map. Online removeConfigProperty Delete a configuration property. Online removeConfigPropertyList Delete a property list. Online removeConfigPropertyMap Delete a property map. Online removeConfigPropertyMapEntry Delete an entry in the property map. Online removeFederationListInMap Delete a list from a map for a specific remote providers configuration. Online removeFederationMapInMap Delete a nested map from a map for a specific remote providers configuration. Online removeFederationMapEntryInMap Delete a nested map property entry from a map for a specific remote providers configuration. Online removeFederationProperty Delete a property for a specific remote providers configuration. Online removeFederationPropertyList Delete a property list for a specific remote providers configuration. Online removeFederationPropertyMap Delete a property map. Online removeFederationPropertyMapEntry Delete a property from a map for a specific remote providers configuration. Online removePeerProviderEntry Delete a peer provider entry. Online setConfigProperty Set a configuration property. Online setCustomAuthnEngine Define a custom authentication engine. Online setCustomSPEngine Define a custom SP engine. Online setFederationProperty Set a property for a specific remote providers configuration. Online Table 9–1 Cont. WLST Commands for Oracle Identity FederationParts
» Oracle Fusion Middleware Online Documentation Library
» Challenges of Identity Federation
» Federation Use Cases Federated Identity Management
» Concepts Federated Identity Management
» SAML Basics Federation Protocols
» Evolution of the Federated Identity Standards SAML 1.x
» Features and Benefits of Oracle Identity Federation
» Architecture About Oracle Identity Federation
» High-Level Processing Flow About Oracle Identity Federation
» Browser POST Profile Federation Protocol Profiles
» Browser Artifact Profile Federation Protocol Profiles
» SOAP Binding Federation Protocol Profiles
» Browser HTTP Redirect Profile
» Name Identifier Management Profiles
» SAML Attribute Sharing Profile
» OpenID Profiles and Extensions
» Affiliations About Oracle Identity Federation
» Cryptographic Provider Example of Federation Event Flow Supported Standards and Applications
» Role in Federation Architecture Options
» Proxy Server Architecture Options
» SAML 2.0 Protocol SAML 1.x and WS-Federation Protocol
» OpenID 2.0 Protocol Supported Protocols
» Secure HTTP HTTPS is required to transmit a user request from a browser to the
» The identity provider must use an XML signature to sign responses it sends to a
» The service provider must verify the XML signature on the response.
» Using the SAML Attribute Sharing Profile
» Using the WS-Federation Logout Profile Using OpenID Profiles and Extensions
» Engines in Oracle Identity Federation Authenticating with a Repository
» Propagating Authentication State to Oracle Single Sign-On in SP Mode
» HTTP Basic Authentication Authentication Engines
» Federation Data Store Data Repositories
» User Data Store Data Repositories
» Session and Message Data Stores Configuration Data Store
» Required Components Installation Requirements
» Profiles Deployment and Architecture Considerations
» Repositories Deployment and Architecture Considerations
» Transient Session and Message Storage
» Security for Assertions Deployment and Architecture Considerations
» Connection Tuning Deployment and Architecture Considerations
» High Availability Deployment and Architecture Considerations
» Typical Deployment Scenario Reference Server Footprint Topology
» Implementation Checklist Oracle Fusion Middleware Online Documentation Library
» Introduction Oracle Fusion Middleware Online Documentation Library
» Install Oracle HTTP Server Manage the Oracle HTTP Server Instance
» Associate Oracle HTTP Server with Managed Server
» Log in to Fusion Middleware Control and navigate to the Oracle Identity
» Navigate to Administration, then Server Properties.
» Change the hostname to reflect the hostname configured in OHS, if they are
» Change the PortSSL Enabled and SOAP PortSSL Enabled information to reflect
» Save the changes. Update Oracle Identity Federation Configuration
» Since the Oracle Identity Federation metadata has changed, redistribute the
» Navigate to Administration, then Service Provider Integration Modules, then
» Click Regenerate OSSO Secret to create an encryption key that will be saved in a
» Navigate to Administration, then Authentication Engines, then Oracle SSO.
» Create and Manage the Oracle HTTP Server Instance Configure Oracle Single Sign-On
» Go to the Oracle Access Manager console and navigate to the Policy Manager.
» In the Authorization Rule, go to the Actions tab, click Modify and in the
» Navigate to Administration, then Authentication Engines, then Oracle Access
» Check the Logout Enabled box if logout needs to be enabled recommended.
» Check the Clear Cookie box if resetting the Oracle Access Manager cookie is
» Check Redirect to Logout URL and fill in the URL if Oracle Identity Federation
» Expand the Oracle Access Manager Properties section.
» Enter the default authorization rule that will be used when creating the policy
» The available Oracle Identity Federation authentication mechanisms are listed in
» Click Configure Oracle Access Manager.
» Deploying Oracle Identity Federation with Oracle Access Manager 11g
» Authentication Overview Oracle Identity FederationSP Authenticating to Oracle Access Manager
» Select and click Update for all the federation schemes that were created in Oracle
» Click Add to add a new step.
» Select the second credential_mapping plugin and click add.
» Select the validate_password plugin and click add.
» Requirements Deploying Oracle Identity Federation with Oracle Directory Server Enterprise Edition
» Configuring Oracle Identity Federation Without a Web Proxy Server
» Configuring Oracle Identity Federation Behind a Web Proxy Server
» Navigate to Administration, then Service Provider Integration Modules.
» In the Test SP tab, selectunselect Enable Engine.
» Select Default SP Integration Module to be Test SP Note: The test SP engine
» Use the Test SP Engine for SP-Initiated SSO
» Use the Test SP Engine with IdP-Initiated SSO
» 11g Server Signing Certificate
» About Roles Deployment Planning
» Other Planning Tasks About the Oracle Identity Federation Server Administrator
» Administering Oracle Identity Federation
» Oracle Identity Federation Log Files
» Versions Provider-specific Metadata Obtain Server Metadata
» Specifying Certificate Usage Obtain Server Certificates
» Perform SP-initiated Single Sign-On
» Perform IdP-initiated Single Sign-On
» Send Authentication Queries SAML 1.x
» Add Trusted Providers Managing Identity Federations
» Update Trusted Providers Delete Trusted Providers
» Set Up Single Sign-On for SAML 1.x and WS-Federation
» In the Initiate SSO URL field, enter the URL used by the peer provider to
» In the Initiate SSO Target Parameter field, enter the parameter used by the
» In the Initiate SSO Provider ID Parameter field, enter the name of the
» In the Artifact Resolution SOAP Endpoint field, enter the URL used by the
» In the Artifact Source ID field, enter a source ID parameter. Oracle Identity
» In the Assertion Consumer Service URL field, enter the URL used by the peer
» About Federated Identities Identities - Federations
» Identities - Users Identities - Search Options
» Managing Credentials for Oracle Identity Federation
» Server Configuration Data Data Maintained by Oracle Identity Federation
» User Federation Data Data Maintained by Oracle Identity Federation
» Host Connection Properties Configuring Server Properties
» Outbound Connection Properties Configuring Server Properties
» Configuring Identity Providers - Common Properties
» Configure SAML 2.0 IdP Properties
» Configure SAML 1.x IdP Properties
» Configure WS-Federation IdP Properties Configure OpenID IdP Properties
» Configure Service Provider - Common Properties
» Configure SAML 2.0 SP Properties
» Configure SAML 1.x SP Properties
» Configure WS-Federation 1.1 SP Properties
» Configure OpenID SP Properties
» Components Used for Attribute Sharing
» Click Add and fill out the Define a new Authorization Scheme form:
» Log in to Oracle Access Manager as a Master or Delegated Access Administrator.
» Fill out the General panel form:
» Select the Authorization Rules panel and add an authorization rule for each set of
» Configuring Oracle Identity Federation as an IdP Attribute Responder
» Configuring Oracle Identity Federation for SSL
» Configuring Identity Provider to send attributes in SSO Assertions
» Overview of the Service Interface
» Attribute Request Message Web Services Interface for Attribute Sharing
» Attribute Response Message Clicking the Enabled box next to the
» Interface WSDL Clicking the Enabled box next to the
» Attribute Name Mapping Introduction to Attribute Mapping and Filtering
» Attribute Value Mapping Introduction to Attribute Mapping and Filtering
» Attribute Value Filtering Introduction to Attribute Mapping and Filtering
» Under the Name Mappings tab, click Add to add an attribute name mapping, with
» Under the Value Mappings tab, click Add to add an attribute value mapping,
» Security and Trust - Wallet Security and Trust - Provider Metadata
» Security and Trust - Trusted CAs and CRLs
» Navigate to Services, then JDBC, then Data Sources.
» Click New. Configuring Oracle Identity Federation for RDBMS User Data Store
» Navigate to Administration, then Data Stores.
» In the User Data Store section, click Edit.
» Select Database from the Repository Type dropdown list.
» Enter the following properties:
» Click OK. Configuring Oracle Identity Federation for RDBMS User Data Store
» Navigate to Administration, then Data Stores. In the User Data Store section, click Edit.
» Select LDAP Directory from the Repository Type dropdown list.
» Configuring Oracle Virtual Directory as User Data Store
» In the user data store configuration, in the Server URL field, enter a list of
» Click OK. Configuring No User Data Store
» Click New. Configuring Oracle Identity Federation for an RDMBS Federation Data Store
» In the Federation Data Store section, click Edit.
» Configuring Oracle Identity Federation for an LDAP Federation Data Store
» Manage the Session Data Store and the Message Data Store
» In the Configuration Data Store section, click Edit.
» Select File System from the Repository Type dropdown list.
» Click New. Using an RDBMS Configuration Data Store
» Click OK. Using an RDBMS Configuration Data Store
» When the RDBMS Configuration Data Store is Down
» Create the Oracle Identity Federation Schema Using RCU
» Configure Authentication Mechanisms - Local
» Configure Authentication Mechanisms - SAML 2.0
» Configure Authentication Mechanisms - SAML 1.x
» Configure Authentication Mechanisms - WS-Federation 1.1
» Configuring the HTTP Header Authentication Engine
» In the Authentication Engines section, click Configure to manage the HTTP
» To add an HTTP header to be collected and saved as a session attribute:
» Authentication Engines - Oracle Single Sign-On
» Authentication Engines - Oracle Access Manager
» Authentication Engines - Database Security
» User ID: The unique identifier with which the user will be identified in Oracle
» Click Apply. Configuring Oracle Identity Federation for RDBMS Authentication Engine
» Authentication Engines - Infocard
» About the Federated SSO Proxy Authentication Engine
» Navigate to Administration, then Service Provider.
» In Protocol Settings, click on Configure SSO Authentication Mechanism to
» Click Add, and select the authentication mechanism and the identity provider to
» When you are done adding mappings, click OK. Then click Apply.
» Select the Default SSO Identity Provider and click Apply.
» Setting the default authentication mechanism
» Mapping protocol-specific methods to local mechanisms and local mechanisms to
» Mapping local authentication mechanisms to identity providers
» Navigate to Administration, then Authentication Engines.
» In the Federated SSO Proxy tab, select Enable Authentication Engine and choose
» Authentication Engines - JAAS
» Authentication Engines - Custom
» SP Integration module - Oracle Single Sign-On
» SP Integration module - Oracle Access Manager
» SP Integration module - Test SP Engine
» SP Integration Module - Custom
» Oracle Single Sign-On Setting up Single Sign-On Services
» Oracle Access Manager Setting up Single Sign-On Services
» SP-initiated SSO Setting up Single Sign-On Services
» IdP-initiated SSO Setting up Single Sign-On Services
» Working with Affiliations Oracle Fusion Middleware Online Documentation Library
» Configuring the LDAP Inactivity Setting
» Configuring the LDAP Read Timeout Setting
» ECID Support for LDAP Connections
» Configuring High Availability LDAP Servers
» Configuring the HTTP Session State SleepRetry Interval
» Configuring RDBMS Session Cache
» Configuring RDBMS Data Compression
» Storing Assertion Attributes of User Session
» Configuring HTTP-Only Flag for HTTP Cookies Set by Oracle Identity Federation
» Precautions when Customizing the Page in HTTP Post Profile
» Using a 303 Status Code for Redirects
» Configuring the SAML 2.0 LDAP Attribute Profile Configuring On-Demand Global Logout
» On the left-hand pane, select Security Realm, and navigate to myrealm, then
» Select the following settings:
» On the left-hand pane, select Security Realms and navigate to myrealm, then
» Click New and select a name for example, soapusers. Click OK.
» Click Sav Oracle Fusion Middleware Online Documentation Library
» Preliminary Steps to Set Up the CDC
» Create the IdP Discovery Service Page
» Set up JCE Policy Files for Oracle WebLogic Server
» Infocard Authentication requires SSL. Configure SSL on Oracle WebLogic Server
» For the Oracle Identity Federation encryption wallet, use the SSL keystore used for
» Load the SSL Java keystore as the Oracle Identity Federation encryption wallet.
» Navigate to IdM Data Stores, then Authentication Engines, and enable the
» Navigate to Administration, then Federations, and add a WS-Fed 1 IdP
» Select the STS, click Update, then select Update Manually.
» From the SSOInfocard Mode drop-down, select either Infocard if the STS only
» Click the Certification Path tab.
» Click Install Certificates, and import the certificate in the trusted root
» Go to the Windows control panel.
» Double-click Windows Cardspace if it is not present, install .NET from the
» Select Create a Personal Card and fill in the fields.
» Save the changes. Create a Personal Infocard
» Validating Target URLs for SSO and Logout Operations
» Providing XML Message to SP Engine after SSO Completes
» Customizing Error Pages Additional Run-time Configuration
» Configuring Schema Validation for SSO Protocol Messages
» Additional Federation Data Store Configuration
» Setting up Backwards Compatibility for Oracle Identity Federation 10g and ShareID service URLs
» Locating a User Mapping Users through Attributes and NameID in SP Mode
» Configuring Oracle Identity Federation
» Example 1: Assertion Mapping without federated identities using NameID for SAML 2.0
» Example 2: Simple Assertion Mapping without Federated Identities with an LDAPSQL Query
» Example 3: Complex Assertion Mapping without Federated Identities with an LDAPSQL Query
» Example 5: Assertion Mapping without Federated Identities for a Specific IdP
» Locating the User Automatic Account Linking Based on Attribute Query Mapping
» Example 1: Automatic Account Linking through NameID mapping for SAML 2.0
» Example 2: Simple Automatic Account Linking through LDAPSQL Query
» Example 5: Automatic Account Linking via Attribute Query for a Specific IdP
» Modes of Operation Configuring Oracle Identity Federation
» Example 1: Off Mode User Opt-In and Opt-Out for Single Sign-On
» Example 2: Opt-In Mode Example 3: Opt-Out Mode
» Example 4: Opt-In Mode for a Specific IdP
» Overriding NameID Mapping Per Partner
» Configuring Audience Restrictions for Assertions
» Certificate Path Validation Oracle Fusion Middleware Online Documentation Library
» Oracle Identity Federation Home Page
» About Sensor Weights Performance Summary
» Event Metrics Performance Summary
» State Events Performance Summary
» Phase Events Performance Summary
» Availability Oracle Fusion Middleware Online Documentation Library
» Types of Logs About Oracle Identity Federation Logging
» Log Levels About Oracle Identity Federation Logging
» Message IDs About Oracle Identity Federation Logging
» thread interrupt Messages Common Log Messages
» Audit Levels About Auditing in Oracle Identity Federation
» In the Audit Level menu, select Custom as the audit level.
» Click Save. Go to the Keystores tab, and click Lock Edit.
» Click Save. Setting up SSL on Oracle WebLogic Server
» Go to the SSL tab. In the Identity section, fill in properties as follows:
» Go to the SSL tab, then Advanced.
» Click Save, and click Activate Changes.
» Update the port and SOAP port, if necessary to reflect the SSL port configured in
» Check the SSL Enabled checkbox.
» To force the use of SSL if a request is received at a non-SSL port, check the Force
» To force client authentication, check the Require Client Certificate box. Leave
» Click Apply. Configuring Oracle Identity Federation
» Log in to the Oracle WebLogic Server administration console and navigate to
» Select the server for which you want to set up SSL.
» Go to the Keystores tab, and click Lock Edit.
» In Keystores, select an option that includes Custom Identity and the Trust
» In the Trust section, fill in the properties with the Trust Keystore information.
» Click Save, then click Activate Changes.
» Alternative Way to Configure Oracle Identity Federation as SSL Client
» Connecting to an LDAP Server over SSL
» Setting up JCE Policy Files for Oracle WebLogic Server
» Setting up the WLST Environment
» Executing the Commands Introduction to Command-Line Tools for Oracle Identity Federation
» Description Syntax Example addConfigMapEntryInMap
» Description Syntax Example addConfigPropertyMapEntry
» Description Syntax Example addCustomSPEngine
» Description Syntax Example addFederationMapEntryInMap
» Description Syntax Example addFederationPropertyMapEntry
» Description Syntax Example changeMessageStore
» Description Syntax Example createConfigPropertyList
» Description Syntax Example createConfigPropertyMap
» Description Syntax Example createFederationPropertyMapInMap
» Description Syntax Example getConfigListValueInMap
» Description Syntax Example getConfigProperty
» Description Syntax Example getFederationProperty
» Description Syntax Example getFederationPropertyMapEntry
» Description Syntax Example loadMetadata
» Description Syntax Example removeConfigMapInMap
» Description Syntax Example removeConfigPropertyList
» Description Syntax Example removeFederationMapEntryInMap
» Description Syntax Example removeFederationPropertyList
» Description Syntax Example removePeerProviderEntry
» Background for Custom Implementations
» Architecture Architecture and Flows
» Authentication Engine Framework Architecture and Flows
» SP Integration Engine Framework
» Logout Architecture and Flows
» Requirements Architecture and Flows
» Planning a Custom Authentication Engine
» Developing and Implementing the Authentication Module
» Sample Authentication Module for Oracle Single Sign-On Integration
» Sample Authentication Module for LDAP Integration
» Planning a Custom SP Integration Engine
» Path URLs Developing and Implementing the Integration Module
» Navigate to Administration then SP Integration Modules. Click the Custom SP
» To add an SP integration engine, click Add and enter a name for that SP
» To modify an SP integration engine, select it and:
» Implementing the Service Developing and Implementing the Integration Module
» Sample Integration Modules Creating a Custom SP Integration Engine
» Sample Integration Module 1: Oracle WebLogic Server JavaEE Container Integration
» Sample Integration Module 2: Customized Single Sign-On Integration
» Changing Logout Flow Sample Logout Services Logout Service Example 1
» Logout Service Example 2 Logout
» Basic Flow of Business Processing Plug-in
» Configuring the Business Processing Plug-in Packaging the Plug-in
» Configuring JavaEE Security Example of Plug-in and Redirect Page
» Business Processing Plug-in API
» Pre- and Post-Processing Custom Actions for Authentication Engines
» Pre- and Post-Processing Custom Actions for SP Integration Engines
» Flow for Oracle Identity Federation as SP
» Oracle Identity Federation, as part of a runtime flow, determines that it needs to
» The pre-processing plug-in invokes the authentication engine.
» The authentication engine uses the IAM domain to challenge and identify the user.
» The authentication engine bundles the authentication data and invokes the
» The post-processing plug-in for authentication engine invokes Oracle Identity
» Oracle Identity Federation resumes operations.
» Implementing the Pre-processing Custom Action
» Configuring Oracle Identity Federation for the Custom Action
» Implementing the Post-processing Plug-in
» Configuring Oracle Identity Federation for the Plug-in
» Set-up Example of a Post-processing Custom Action
» Packaging Example of a Post-processing Custom Action
» Oracle Identity Federation Configuration
» Implementation of cookieextract.jsp
» Implementing the Pre-processing Plug-in
» Setup Example of a Pre-processing Plug-in
Show more