Overview of the Service Interface

Configuring Oracle Identity Federation 5-49 – oracle:security:nameid:format:unspecified: Indicates that the interpretation of the Name ID is left up to the implementation. – oracle:security:nameid:format:custom: Indicates that the Name ID is a custom value. – oracle:security:nameid:format:userid: Indicates that the Name ID is the User ID used by Oracle Identity Federation to identify the user. ■ The attribute authority to which the AttributeQuery is to be sent. If no attribute authority is specified, Oracle Identity Federation will determine what attribute authority to send the AttributeQuery as follows: – If the Subject Format is oracle:security:nameid:format:x509, or if it is not present, Oracle Identity Federation will map the Subject value to an identity provider. If no mapping is found for the SubjectDN, the default attribute authority is used. – Otherwise, Oracle Identity Federation will use the default attribute authority. ■ Zero or more attributes to be retrieved for the user. ■ For each attribute, zero or more values. A NULL value can be represented as Value Null=true. The AttributeRequest message is wrapped in a SOAP Envelope and Body and sent in an HTTP POST request. Examples of AttributeRequest messages follow. Example 1 In the following request, the Subject format is not specified and is therefore assumed to be oracle:security:nameid:format:x509. The target IdP is also not specified and so Oracle Identity Federation will determine the attribute authority to use by mapping the SubjectDN to an IdP. SOAP-ENV:Envelope xmlns:SOAP-ENV=http:schemas.xmlsoap.orgsoapenvelope SOAP-ENV:Body orafed-arxs:AttributeRequest Note: To enabledisable Name ID formats and map them to attributes in the user data store, follow these steps: 1. Log in to Fusion Middleware Control and navigate to the Oracle Identity Federation instance 2. Navigate to Administration, then Identity Provider or Service Provider to configure IdP and SP, respectively. 3. In the SAML 2.0SAML 1.X tabs, modify the Assertion Subject NameID Formats by:

a. Clicking the Enabled box next to the

formats you wish to enable. b. Mapping each format to an attribute in the user data store. 4. Click Apply. See Also: Section 5.6.5, Configuring Oracle Identity Federation as an SP Attribute Requester for instructions on how to configure the default attribute authority and the SubjectDN to IdP mappings 5-50 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation xmlns:orafed-arxs=http:www.oracle.comfedar10gR3 orafed-arxs:Subjectcn=alice,cn=users,dc=us,dc=oracle,dc=com orafed-arxs:Subject orafed-arxs:Attribute Name=mail orafed-arxs:Valuealiceoracle.comorafed-arxs:Value orafed-arxs:Valueboboracle.comorafed-arxs:Value orafed-arxs:Attribute orafed-arxs:Attribute Name=firstname orafed-arxs:ValueBobbyorafed-arxs:Value orafed-arxs:ValueCharlesorafed-arxs:Value orafed-arxs:Attribute orafed-arxs:Attribute Name=lastname orafed-arxs:Attribute orafed-arxs:AttributeRequest SOAP-ENV:Body SOAP-ENV:Envelope Example 2 In the following request, the target IdP is specified to be http:my-corp.comfedidp, so Oracle Identity Federation will send the AttributeQuery to this attribute authority. Also, the Subject Format is oracle:security:nameid:format:userid, so the Subject value alice is taken to be the User ID of the user of which attributes are requested. SOAP-ENV:Envelope xmlns:SOAP-ENV=http:schemas.xmlsoap.orgsoapenvelope SOAP-ENV:Body orafed-arxs:AttributeRequest xmlns:orafed-arxs=http:www.oracle.comfedar10gR3 TargetIDP=http:my-corp.comfedidp orafed-arxs:Subject Format=oracle:security:nameid:format:useridalice orafed-arxs:Subject orafed-arxs:Attribute Name=mail orafed-arxs:Valuealiceoracle.comorafed-arxs:Value orafed-arxs:Valueboboracle.comorafed-arxs:Value orafed-arxs:Attribute orafed-arxs:Attribute Name=firstname orafed-arxs:ValueBobbyorafed-arxs:Value orafed-arxs:ValueCharlesorafed-arxs:Value orafed-arxs:Attribute orafed-arxs:Attribute Name=lastname orafed-arxs:Attribute orafed-arxs:AttributeRequest SOAP-ENV:Body SOAP-ENV:Envelope The output rules are as follows: ■ Following the SAML AttributeQuery convention, if no attributes are named, all of the users attributes are returned. ■ If one or more attributes are named in the request, only these are returned. ■ If values are specified in the request, the attribute authority will only return a local attribute value if the value is present in the request. ■ Attributes are returned subject to the responders local policy.