Example 1: Off Mode User Opt-In and Opt-Out for Single Sign-On

Additional Server Configuration 6-45

3. Select the service provider and click Update.

4. Click the Oracle Identity Federation Settings tab.

5. Expand the Identity ProviderAuthority Settings section.

6. Select Opt-In as the Opt-InOpt-Out mode.

7. Set the Opt-InOut User Attribute to fedrecordcreation.

8. Set the Opt-InOut Attribute Value to agreed.

9. Apply the changes.

6.19 Bypassing User Mapping During Assertion Processing

With this feature Oracle Identity Federation, when acting as a service provider, does not attempt to locate a user based on the information contained in the assertion; instead the content of the assertion is passed directly back to the SP Integration module, which implements the user mapping flow. If Oracle Identity FederationSP is configured to bypass mapping that is, to not map the principal identified in the assertion to a local user, Oracle Identity Federation does the following: ■ creates an Oracle Identity Federation session for the anonymous user, specified in the Oracle Identity Federation administration console in the service provider section. This is required as the server needs to be aware of the user being authenticated at the server and at peer providers for example, at the logout operations. Thus, setting the Anonymous User ID in the Oracle Identity Federation pages for Fusion Middleware Control is mandatory. ■ passes the NameID, attributes, and other information back to the SP Integration module, as specified in Section 10.4.2.3, Implementing the Service , under the heading Oracle Identity Federation Assertion Processing.

6.19.1 Configuring Oracle Identity Federation

To configure Oracle Identity Federation to map or not map the incoming assertion to a user record: 1. Log in to Fusion Middleware Control.

2. Navigate to Administration, then Service Provider, then Common.

3. Check Map assertion to User Account to configure Oracle Identity Federation to

map incoming assertions to user records; uncheck it to not map the assertion. 4. Apply the changes.

6.20 Overriding NameID Mapping Per Partner

On a per-partner basis, an Oracle Identity Federation administrator can override the mapping of NameID formats to local user directory attributes. To configure this feature at the command line take these steps: 1. Set up the script environment as described in Chapter 9, Oracle Identity Federation Command-Line Tools. 2. Invoke the WLST shell using java weblogic.WLST. 6-46 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation 3. Enter one of these commands based on the name format used: setFederationPropertySPproviderID,nameformatemail,attribute-name,st ring if name format is Email Address setFederationPropertySPproviderID,nameformatx500,attribute-name,str ing if name format is X509 Subject Name setFederationPropertySPproviderID,nameformatunspecified,attribute-nam e,string if name format is Unspecified setFederationPropertySPproviderID,nameformatkerberos,attribute-name, string if name format is Kerberos setFederationPropertyproviderID,nameformatwindows,attribute-name,st ring if name format is Windows Domain Qualified Name setFederationPropertyproviderID,nameformatcustom,attribute-name,str ing if name format is Custom

6.21 Configuring Audience Restrictions for Assertions

When using assertions to exchange information, SAML authorities such as an identity provider or attribute authority can set the conditions under which an assertion is valid. Typical conditions might be: ■ Time before which the assertion is not valid ■ Time after which the assertion is not considered valid any more ■ List of providers that can process the assertion. Only a provider listed in the AudienceRestictionCondition element of the assertion is able to use the assertion. The SAML specifications define the AudienceRestictionCondition as a list of Audience elements, each one referencing a provider that can process the assertion. By default, Oracle Identity Federation creates an AudienceRestrictionCondition element when generating an assertion, and includes the recipient of the assertion using these rules: ■ For SAML 1.x protocol exchanges, set the Audience as the Assertion Consumer Service URL of the service provider. ■ For SAML 2.0 protocol exchanges, set the Audience as the ProviderID of the service provider Attribute Requestor. Note: If federation store was set and a federation record exists for the user, the nameid in the federation record is used.