Migrating with the Script migrateSecurityStore

Configuring the OPSS Security Store 8-23

4. Select the Provider Type from the pull-down list, and enter the corresponding

data for the selected provider the data required changes with the type selected.

5. Select the Authentication Level from the pull-down list.

6. Optionally, manage the provider Custom Properties using the buttons Add, Edit,

and Delete, at the bottom of the page. 7. When finished, click OK to save the entered data.

8.7.3.3 OAM Configuration Example

The SSO service configuration entered with the procedure described in Configuring an SSO Solution with Fusion Middleware Control is written to the file jps-config.xml. The data specified includes: ■ A particular SSO service ■ The auto-login and auto-logout URIs ■ The authentication level ■ The query parameters contained in the URLs returned by the selected SSO service ■ The appropriate settings for token generation The following fragment of a jps-config.xml file illustrates the configuration of an OAM SSO provider: propertySets propertySet name = props.auth.url property name = login.url.BASIC value = http:host:portoam_login.cgi?level=BASIC property name = login.url.FORM value = http:host:portoam_login.cgi?level=FORM property name = login.url.DIGEST value = http:host:portoam_login.cgi?level= DIGEST property name = autologin.url value = http:host:portobrar.cgi property name = logout.url value = http:host:portlogout.cgi property name = param.login.successurl value = successurl property name = param.login.cancelurl value = cancelurl property name = param.autologin.targeturl value = redirectto property name = param.autologin.token value = cookie property name = param.logout.targeturl value = targeturl propertySet propertySet name=props.auth.uri property name=login.url.BASIC value={app.context}adfauthentication?level=BASIC property name=login.url.FORM value={app.context}adfauthentication?level=FORM property name=login.url.DIGEST value={app.context}adfauthentication?level=DIGEST property name=autologin.url value=obrar.cgi property name=logout.url value={app.context}adfauthentication?logout=true propertySet propertySet name = props.auth.level property name = level.anonymous value = 0 property name = level.BASIC value = 1 property name = level.FORM value = 2 property name = level.DIGEST value = 3 propertySet 8-24 Oracle Fusion Middleware Application Security Guide propertySets serviceProviders serviceProvider name = sso.provider class = oracle.security.jps.internal.sso.SsoServiceProvider type = SSO descriptionSSO service providerdescription serviceProvider serviceProviders serviceInstances serviceInstance name = sso provider = sso.provider propertySetRef ref = props.auth.url propertySetRef ref = props.auth.level property name = default.auth.level value = 2 property name = token.type value = OAMSSOToken property name = token.provider.class value = oracle.security.jps.wls.internal.sso.WlsTokenProvider property name=sso.provider.class value=oracle.security.wls.oam.providers.sso.OAMSSOServiceProviderImpl serviceInstance serviceInstances jpsContexts default = default jpsContext name = default serviceInstanceRef ref = sso jpsContext jpsContexts Table 8–1 describes the meaning of the properties involved in the configuration of an SSO provider. Regarding the configuration of an SSO provider, note the following important remarks: ■ Any SSO provider must define the URI for at least the FORM login with the property login.url.FORM. The value need not be a URL. Table 8–1 SSO Provider Properties Property Name Description logout.url The SSO provider logout URL. login.url.BASIC The SSO provider BASIC logout URL. login.url.FORM The SSO provider FORM logout URL. login.url.DIGEST The SSO provider DIGEST logout URL. autologin.url The self-registration URL for auto-login. logout.url The SSO provider logout URL. param.login.successurl The URL redirect after a succesful login. param.login.cancelurl The URL redirect after a query cancelation. param.autologin.targeturl The URL redirect after auto-login. param.autologin.token The token for auto-login. param.logout.targeturl The URL redirect after loggin out. Configuring the OPSS Security Store 8-25 ■ If the application supports a self-registration page URI or URL, it must be specified with the property autologin.url. ■ If the SSO solution supports a global logout URI or URL, it must be specified with the property logout.url. The OAM solution supports global logout. ■ The following properties, illustrated in the preceding example, are optional: – param.login.successurl – param.login.cancelurl – param.autologin.targeturl – param.login.token – param.logout.targeturl ■ The use of the variable app.context in URI specifications, illustrated in values within the property set props.auth.uri in the preceding example, is allowed for only ADF applications when integrating with the OAM solution. ■ The property set props.auth.level is required. ■ The reference to props.auth.url is required. ■ The property sso.provider.class within a service instance of the SSO provider is the fully qualified name of the class implementing a specific SSO solution. In the case of the OAM solution, the provided class name is oracle.security.wls.oam.providers.sso.OAMSSOServiceProviderIm pl. ■ The property name default.auth.level within a service instance of the SSO provider must be set to 2, as illustrated in the preceding example. ■ The property token.type within a service instance of the SSO provider is required. This token type identifies the token set on the HTTP request by the SSO provider upon a successful authentication; the SSO provider uses this token, after the first time, to ensure that the user does not need to be reauthenticated and that his sign-on is still valid. In the case of the OAM solution, the token type must be OAMSSOToken, as illustrated in the preceding example. ■ The property token.provider.class within a service instance of the SSO provider is the fully qualified name of the token class, and it is provider-specific. ■ If an application implements a self-registration logic and wants to auto login a user after successful self-registration, it must call the OPSS autoLogin API; in turn, to allow this call, it must grant that application a code source permission named CredentialMapping with class JpsPermission. The following fragment of the file system-jazn-data.xml illustrates the specification of this permission to the application MyApp: grant grantee codesource urlfile:{oracle.deployed.app.dir}MyApp{oracle.deployed.app.ext} url codesource grantee permissions