Configuring HTTP-Only Flag for HTTP Cookies Set by Oracle Identity Federation

Additional Server Configuration 6-13

6.7.3 Using a 303 Status Code for Redirects

Oracle Identity Federation implements the SAMLWS-FedLiberty protocols that provide single sign-on SSO capabilities to HTTP clients, such as browsers. The protocols and profiles exercised at runtime during SSO operations can involve some HTTP redirects, where the Oracle Identity Federation server issues an HTTP redirect command to the browser. By default, Oracle Identity Federation uses the 302 HTTP status code when issuing a redirect. It is possible to configure the Oracle Identity Federation server to instead use a 303 HTTP status code when issuing a redirect provided the client supports HTTP 1.1. To configure Oracle Identity Federation to use the 303 HTTP status code when possible, enter the WLST script environment for the Oracle Identity Federation instance, and set the following property: ■ Set the redirectuse302 boolean property from the serverconfig group to false if the Oracle Identity Federation server should use 303 HTTP status code when possible: setConfigPropertyserverconfig, redirectuse302, false, boolean ■ otherwise set the property to true.

6.8 Additional Protocol Configuration

This section contains these topics: ■ Configuring for eAuth Mode ■ Configuring the SAML 2.0 LDAP Attribute Profile ■ Configuring On-Demand Global Logout

6.8.1 Configuring for eAuth Mode

You can configure the Oracle Identity Federation server to comply with the eAuth specifications. Most of the configuration is performed through Fusion Middleware Control, but the specifications require the presence of two attributes in the SSO assertion that can only be configured through the MBeansWLST scripts: ■ the us:gov:e-authentication:basic:specVer attribute containing the version of the eAuth specifications supported by this server ■ the us:gov:e-authentication:basic:Sid attribute containing the session identifier of the user performing the single sign-on To configure Oracle Identity Federation to set those two attributes for a specific provider and to set the value of the eAuth version, enter the WLST script environment for Oracle Identity Federation instance, and set the following properties if needed: ■ Set the eauthmodeenabled boolean property for the remote provider to true to enable the eAuth mode: setFederationPropertyREMOTE_PROVIDER_ID, eauthmodeenabled, true, boolean Note: Liberty 1.x support is deprecated. 6-14 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation replace REMOTE_PROVIDER_ID with the identifier of the remote provider ■ Set the eauthversion string property from the idpglobal group to the value the Oracle Identity Federation server should use 2.0 for example: setConfigPropertyidpglobal, eauthversion, 2.0, string

6.8.2 Configuring the SAML 2.0 LDAP Attribute Profile

The SAML 2.0 specifications define the X.500 LDAP attribute profile, listing the attributes that an assertion must contain to be compliant with that profile. The requirements are as follows: ■ The format must be urn:oasis:names:tc:SAML:2.0:attrname-format:uri. ■ The name must be a URI. ■ The SAML Attribute element must specify an XML Encoding attribute and its value must be set to LDAP. The first two requirements are met by configuring the attribute for the Oracle Identity Federation server instance in Fusion Middleware Control. The last requirement is met by configuring Oracle Identity Federation with WLST scripts; a property is set for a specific provider to which Oracle Identity FederationIDPAttributeAuthority will send the attributes contained in an assertion. How to Use WLST for the X.500 LDAP Attribute Profile Enter the WLST script environment for the Oracle Identity Federation server instance, then set the attrx500ldapenabled property for the remote provider to which Oracle Identity Federation will provide the assertion. Set the attrx500ldapenabled boolean property to true to make the server compliant with the X.500 LDAP attribute profile. Otherwise set it to false: setFederationPropertyREMOTE_PROVIDER_ID, attrx500ldapenabled, true, boolean replace REMOTE_PROVIDER_ID with the identifier of the remote provider

6.8.3 Configuring On-Demand Global Logout

You can specify whether WS-FedSAML Global Logout should be executed when a logout operation is invoked at the Oracle Identity Federation server. In a typical federation deployment, when the user invokes logout at the federation server, the flow is as follows: ■ The user invokes the Oracle Identity Federation logout service at the feduserlogout URL. See Section 4.2.5, Launch the Logout Process for details about the logout service. ■ Oracle Identity Federation: – logs the user out of the various authentication engines and SP integration modules Oracle Access Manager, Oracle Single Sign-On, and others