Role in Federation Architecture Options

2-2 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation Service Provider Role A user tries to access a resource protected by an authentication engine such as Oracle Single Sign-On, which redirects the user to Oracle Identity Federation. In a service provider role, Oracle Identity Federation redirects the user to an identity provider such as a portal for global authentication. The IdP portal can now obtain credentials, authenticate the user, and redirect back to Oracle Identity Federation, which then retrieves the asserted identity from the IdP. Oracle Identity Federation redirects the authenticated user to the authentication engine, which grants access to the protected resource. Federation Topology A federation can comprise any number of identity providers and service providers. One common federation topology is referred to as the hub-and-spoke model. In this topology, there is either a single service provider accepting authentication from multiple identity providers, or a single identity provider authenticating to multiple service providers. Figure 2–1 A Hub-and-Spoke Federation Network

2.1.2 Proxy Server

You must decide what components you will put in the DMZ and whether to use a proxy server. If you put Oracle Identity Federation behind the fire wall, the proxy must forward requests and responses to the federation server, enabling transparent access to the server from an external network such as the internet. Oracle Identity Federation configuration varies depending on the type of profile being implemented. POST Profile with Proxy in SP DMZ The POST profile sends the full assertion to the SP over HTTPS. Both IdP and SP are configured to communicate through their SSL ports. When using the POST profile in production, the SP uses a proxy server in the DMZ. Artifact Profile with Proxy in IdP and SP DMZ When using the browser artifact profile, the IdP sends an artifact an identifier rather than an actual assertion. The SP receives the artifact and requests the full assertion thereafter. If you elect to use a proxy, note that proxies must be used for both IdP and SP in order to implement this profile. The proxies serve as receiver and responder services, handling the exchange of artifacts, assertion requests and assertions, and forwarding those objects to their respective providers. See Also: For more information about setting up a proxy server for Oracle Identity Federation, see Appendix B, Using Oracle HTTP Server as a Proxy for Oracle Identity Federation . Planning Oracle Identity Federation Deployment 2-3

2.1.3 Server Security

Oracle Identity Federation provides secure communication using: ■ SSL Encryption ■ Certificate-based Authentication ■ Certificate Repository and Validation

2.1.3.1 SSL Encryption

Oracle Identity Federation provides secure SSL communication between partner domains. SSL encryption is an option you can enable or disable for the server instance at installation time.

2.1.3.2 Certificate-based Authentication

For initial setup and testing, identity providers and service providers can use default self-signed certificates. Before going into production, however, you will want to ensure that your installation is set up to use third-party CA certificates.

2.1.3.3 Certificate Repository and Validation

Oracle Identity Federation provides a repository where you can store a list of trusted CAs and certificate revocation lists CRLs. If certificate validation is enabled for the server, Oracle Identity Federation will validate every certificate used to verify incoming signatures for the SAML and WS-Federation protocols. To validate a certificate, the server tries to locate the certificate or its issuer as a trusted certificate, and checks that the certificate is not in a CRL.

2.1.4 Protocol

When installing Oracle Identity Federation, you must decide the federation protocols that your server will support. Oracle Identity Federation works with these protocols: ■ SAML 1.0 ■ SAML 1.1 ■ SAML 2.0 ■ WS-Federation ■ OpenID As the Oracle Identity Federation administrator, you must determine which federation protocols you will utilize for your server. Note: For more information about SSL configuration, see Section 8.1.1.1, Setting up SSL on Oracle WebLogic Server See Also: ■ Section 5.10.2, Security and Trust - Provider Metadata for information about enabling certificate validation ■ Section 5.10.1, Security and Trust - Wallet for details about the certificate repository