Example 2: Simple Automatic Account Linking through LDAPSQL Query

6-42 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation

6.17.7 Example 5: Automatic Account Linking via Attribute Query for a Specific IdP

If Oracle Identity FederationSP needs an attribute-based authentication configuration specific to a peer identity provider, then the setup information needs to be stored in the IdPs entry in the Federations list. In this example, Oracle Identity FederationSP is using federated identities and is set up for automatic account linking through attribute query for an IdP referenced by http:idp.com. Perform the following steps to configure Oracle Identity FederationSP:

1. Log in to Fusion Middleware Control.

2. Navigate to Administration, then Federations.

3. Select the identity provider and click Update.

4. Click the Oracle Identity Federation Settings tab.

5. Expand the service providerRequester Settings section, and go to assertion

settings.

6. Check Map User via Federated Identity.

7. Check Map Enable Auto Account Linking.

8. Check Map User via Attribute Query.

9. Enter the following LDAP query in the Attribute Query field:

mail=emailsn=lastname.

10. Uncheck Map User via NameID.

11. Check Error when User Mapping fails; this forces Oracle Identity Federation to

return a 401 error to the browser if the user cannot be located.

12. Apply the changes.

6.18 User Opt-In and Opt-Out for Single Sign-On

You can configure Oracle Identity Federation IdP to determine if a user has given or denied permission to perform federated single sign-on for the user, based on the value of an attribute in the user’s directory record. If consent has been given, SSO operations can be performed automatically if the user is authenticated at Oracle Identity FederationIdP, or within the identity and access management IAM framework integrated with Oracle Identity Federation. If consent has not been obtained, Oracle Identity FederationIdP must challenge the user for credentials every time a Federation SSO operation occurs, even if the user is already authenticated at Oracle Identity Federation in the IAM domain. Topics in this section include: ■ Modes of Operation ■ Configuring Oracle Identity Federation ■ Example 1: Off Mode ■ Example 2: Opt-In Mode Note: In this section, Oracle Identity FederationIdP refers to Oracle Identity Federation acting as identity provider. Additional Server Configuration 6-43 ■ Example 3: Opt-Out Mode ■ Example 4: Opt-In Mode for a Specific IdP

6.18.1 Modes of Operation

Oracle Identity FederationIdP can implement this feature in three modes: 1. Off - The Opt-inOpt-out functionality is not exercised 2. Opt-In - If the user attribute for opt-inopt-out equals the value set by the administrator, Oracle Identity FederationIdP does not force the user to re-authenticate for Federation SSO operations; otherwise it forces re-authentication. 3. Opt-Out - If the user attribute for opt-inopt-out equals the value set by the administrator, then Oracle Identity FederationIdP forces the user to re-authenticate for Federation SSO operations; otherwise it does not force re-authentication.

6.18.2 Configuring Oracle Identity Federation

To configure Oracle Identity Federation to use Opt-InOpt-Out: 1. Log in to Fusion Middleware Control.

2. Navigate to Administration, then Identity Provider.

3. Select the Opt-InOpt-Out mode:

■ Off: indicates that the Opt-inOpt-out feature is not exercised ■ Opt-In: indicates that the Opt-in mode is active ■ Opt-Out: indicates that the Opt-out mode is active 4. If the mode is set to Opt-In or Opt-Out, then enter the Opt-InOut user attribute that references the attribute to retrieve from the user record. Its value is compared against the value set by the administrator. 5. If the mode is set to Opt-In or Opt-Out, then enter the Opt-InOut attribute value holding the value set by the administrator and used to compare against the user attribute.

6.18.3 Example 1: Off Mode

In this example, the opt-inopt-out feature is turned off so that the user is never re-challenged for credentials when a federation record is created on Oracle Identity FederationIdP. Perform the following steps to configure Oracle Identity FederationSP: 1. Log in to Fusion Middleware Control.

2. Navigate to Administration, then Identity Provider.

3. Select Off as the Opt-InOpt-Out mode. 4. Apply the changes.