Go to the SSL tab, then Advanced.

8-4 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation Configuring Oracle WebLogic Server and Section 8.1.2.2, Configuring Keystore Passwords in Oracle Identity Federation . ■ Set up Oracle Identity Federation to use its own identity and trust keystores. This approach is described in Section 8.1.2.3, Alternative Way to Configure Oracle Identity Federation as SSL Client . Topics in this section include: ■ Configuring Oracle WebLogic Server ■ Configuring Keystore Passwords in Oracle Identity Federation ■ Alternative Way to Configure Oracle Identity Federation as SSL Client ■ Connecting to an LDAP Server over SSL ■ Ensuring that Fusion Middleware Control can Manage an Oracle Identity Federation Target

8.1.2.1 Configuring Oracle WebLogic Server

Some SSL servers might require authentication of the client performed during the SSL handshake. This operation is typically done by having the SSL client present an SSL Client certificate to the SSL server. This section describes how to configure Oracle WebLogic Server and Oracle Identity Federation to present a Client SSL certificate when it is requested by an SSL server. This requires: ■ setting up trust for the CA that issued the SSL server certificates ■ obtaining a certificate for the Oracle Identity Federation SSL client. Take these steps to achieve this:

1. Log in to the Oracle WebLogic Server administration console and navigate to

Environment , then Servers.

2. Select the server for which you want to set up SSL.

3. Go to the Keystores tab, and click Lock Edit.

4. In Keystores, select an option that includes Custom Identity and the Trust

Keystore type you wish to configure. 5. In the Identity section, fill in properties as follows: ■ Custom Identity Keystore: location of keystore with SSL private key and certificate ■ Custom Identity Keystore type: identity keystore type ■ Custom Identity Keystore Passphrase: storepassword

6. In the Trust section, fill in the properties with the Trust Keystore information.

7. Click Save, then click Activate Changes.

8. Restart the server.

8.1.2.2 Configuring Keystore Passwords in Oracle Identity Federation

If Oracle Identity Federation needs to connect to a remote provider and provide an SSL client certificate, you must configure the identity and trust keystore passwords in Oracle Identity Federation setup, not in Oracle WebLogic Server. Follow these steps: Security 8-5 1. Log in to Fusion Middleware Control and navigate to the Oracle Identity Federation instance.

2. Navigate to Administration, then Server Properties.

3. In the Outbound Connections section under SSL Settings, enter the values of these two properties: ■ WebLogic Server Identity Keystore Password - the password of the identity keystore you entered in the Oracle WebLogic Server configuration. ■ WebLogic Server Trust Keystore Password - the password of the trust keystore you entered in the Oracle WebLogic Server configuration. If this property is left empty, the trust keystore will be opened without a password.

8.1.2.3 Alternative Way to Configure Oracle Identity Federation as SSL Client

If you do not wish to enter identity and trust keystore information in the Oracle WebLogic Server configuration, there is an alternate way to configure Oracle Identity Federation as an SSL Client when connecting to remote SSL servers. With this approach, you will need to use the Oracle Identity Federation WLST commands or MBeans to set certain configuration properties. You will also need to enter the keystore passwords in the credential store.

8.1.2.3.1 Setting properties in Oracle Identity Federation configuration

You will need to set these five serverconfig properties to the following values: ■ usewlssslconfig - false ■ clientsslkeystoreloc - the path and filename of the identity keystore. The path can be absolute or relative to the domain home. ■ clientsslkeystoretype – the identity keystore type. If no type is specified, the type is assumed to be JKS. ■ clientssltruststoreloc – the path and filename of the trust keystore. The path can be absolute or relative to the domain home. ■ clientssltruststoretype – the trust keystore type. If no type is specified, the type is assumed to be JKS. Example: Using the WLST commands setConfigPropertyserverconfig, usewlssslconfig, false, BOOLEAN setConfigPropertyserverconfig, clientsslkeystoreloc, usrlocalsslkeystore, STRING setConfigPropertyserverconfig, clientsslkeystoretype, JKS, STRING setConfigPropertyserverconfig, clientssltruststoreloc, usrlocalssltruststore, STRING setConfigPropertyserverconfig, clientssltruststoretype, JKS, STRING See Chapter 9, Oracle Identity Federation Command-Line Tools for details about WLST command usage. Example: Using the MBeans In the ConfigMXBean with name serverconfig, invoke the putProperty operation five times with the following arguments: Property Name Property Value Property Type usewlssslconfig false BOOLEAN