Click Security Realms, Default Realm Name, Providers. On the Summary page where providers are listed, click the Reorder button

Configuring Single Sign-On with Oracle Access Manager 11g 15-27 13. Proceed with Configuring the Application Authentication Method for the Authenticator .

15.2.4.2 Configuring the Application Authentication Method for the Authenticator

This topic describes how to create the application authentication method for Oracle Access Manager Authenticator. When you use the Oracle Access Manager Authenticator, all web.xml files in the application EAR file must specify BASIC in the element auth-method for the appropriate realm. The auth-method can use BASIC or FORM values. While these look like similar values in Oracle Access Manager, the auth-method specified in web.xml files are used by Oracle WebLogic Server not Oracle Access Manager. To configure the application authentication method for the Authenticator 1. Locate the web.xml file in the application EAR file: WEB-INFweb.xml 2. Locate the auth-method in login-config and enter BASIC. For example: security-constraint web-resource-collection web-resource-nameprotectedweb-resource-name url-patternservleturl-pattern web-resource-collection auth-constraint role-nameauth-usersrole-name auth-constraint security-constraint login-config auth-methodBASICauth-method login-config security-role descriptionAuthenticated Usersdescription role-nameauth-usersrole-name security-role 3. Save the file. 4. Redeploy and restart the application. 5. Repeat for each web.xml file in the application EAR file. 6. Proceed with Mapping the Authenticated User to a Group in LDAP .

15.2.4.3 Mapping the Authenticated User to a Group in LDAP

This topic describes how to map the authenticated user to a group in LDAP. To do this, you must edit the weblogic.xml file. For example, you might need to map your role-name auth-users to a group named managers in LDAP. See Also: Oracle Fusion Middleware Deploying Applications to Oracle WebLogic Server Note: For the Oracle Access Manager Authenticator, Oracle recommends auth-method BASIC in login-config within web.xml. 15-28 Oracle Fusion Middleware Application Security Guide To map the authenticated user to a group in LDAP for the Oracle Access Manager Authenticator 1. Go to the application’s weblogic.xml file. 2. Add the following information for your environment anywhere in the file: weblogic-web-app xmlns:xsi=http:www.w3.org2001XMLSchema-instance xsi:schemaLocation=http:www.bea.comnsweblogicweblogic-web-app http:www.bea.comnsweblogicweblogic-web-app1.0weblogic-web-app.xsd xmlns=http:www.bea.comnsweblogicweblogic-web-app security-role-assignment principal-namemanagersprincipal-name role-nameauth-usersrole-name security-role-assignment weblogic-web-app 3. Save the file. 4. Restart the WebLogic Server. 5. Configure centralized logout as described in Configuring Centralized Log Out for Oracle Access Manager 11g and then return here to perform Testing the Oracle Access Manager Authenticator Implementation .

15.2.4.4 Testing the Oracle Access Manager Authenticator Implementation

After performing all tasks to implement the Authenticator, you can test it by attempting to log in to the application using valid credentials. If the configuration is incorrect, a valid user is denied access. The following procedure describes how to test your Authenticator setup. Alternatively, you can run Access Tester in Oracle Access Manager to test your policy domain, as described in the Oracle Fusion Middleware Administrators Guide for Oracle Access Manager with Oracle Security Token Service. To validate the Oracle Access Manager Authenticator implementation 1. Enter the URL to access the protected resource in your environment. For example: http:yourdomain.com:port 2. Provide appropriate credentials when the login form appears. ■ Successful: The implementation works. ■ Not Successful: See Troubleshooting Tips on page 15-37.

15.2.5 Configuring Identity Assertion for Oracle Web Services Manager and OAM 11g

This section describes how to set up the Oracle Access Manager Identity Asserter to enable validation of the token when you have Oracle Web Services Manager protecting Web services. As discussed earlier, the Oracle Access Manager Identity Asserter works in two modes. The default mode of operation simply asserts the header that is set by WebGate at the perimeter, which handles most SSO situations. The alternate mode uses the custom AccessGate in oamAuthnProvider.jar. In this case, and with the absence of the header, the Identity Asserter contacts the OAM Server to validate the token. For more information about the token, see Installing the Authentication Provider with Oracle Access Manager 11g on page 15-8.