Sample Authentication Module for Oracle Single Sign-On Integration

10-16 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation ■ Set loginpage.jsp as the Login Relative Path of the authentication engine 5. Save the changes. Implementation of loginpage.jsp page buffer=5 autoFlush=true session=false page language=java import=java.net. response.setHeaderCache-Control, no-cache; response.setHeaderPragma, no-cache; response.setHeaderExpires, Thu, 29 Oct 1969 17:04:19 GMT; String refid = request. getAttributeoracle.security.fed.authn.refid; String postURL = engineldapforward.jsp?refid= + refid = null ? URLEncoder.encoderefid : ; String msg = request.getParametermessage; HTML BODY FORM action==postURL method=POST ifmsg = null msg.length 0 { =msgBR } Username: INPUT type=text name=usernameBR Password: INPUT type=password name=passwordBR INPUT type=submit value=Submit FORM BODY HTML Implementation of forward.jsp page buffer=5 autoFlush=true session=false page language=java import=java.util., javax.naming., javax.naming.directory., java.net. response.setHeaderCache-Control, no-cache; response.setHeaderPragma, no-cache; response.setHeaderExpires, Thu, 29 Oct 1969 17:04:19 GMT; String refid = request.getParameterrefid; String authnMethod = oracle:fed:authentication:password-protected; String userID = request.getParameterusername; String password = request.getParameterpassword; Date now = new Date; Hashtable env = new Hashtable; env.putContext.INITIAL_CONTEXT_FACTORY, com.sun.jndi.ldap.LdapCtxFactory; env.putContext.PROVIDER_URL, ldap:mynode.us.mycorp.com:389; env.putContext.SECURITY_AUTHENTICATION, simple; env.putContext.SECURITY_PRINCIPAL, cn= + userID + ,cn=users,dc=us,dc=oracle,dc=com; env.putContext.SECURITY_CREDENTIALS, password; try { See Also: Section 5.15, Configuring Authentication Engines Integrating with Third-Party Identity and Access Management Modules 10-17 DirContext ctx = new InitialDirContextenv; } catch NamingException ex { String redirectURL = engineloginpage.jsp?refid= + refid = null ? URLEncoder.encoderefid : + message= + URLEncoder.encodeex.toString + for + userID; response.sendRedirectredirectURL; return; } request.setAttributeoracle.security.fed.authn.engineid, TEST_ENGINE_ID; request.setAttributeoracle.security.fed.authn.userid, userID; request.setAttributeoracle.security.fed.authn.refid, refid; request.setAttributeoracle.security.fed.authn.authnmech, authnMethod; request.setAttributeoracle.security.fed.authn.authntime, now; request.getSession.getServletContext.getContextfed.getRequestDispatcher“ userloginsso”.forwardrequest, response; Logout Since no cookies are set in this flow, the authentication engine is not required to integrate with the logout flow described in Section 10.5, Logout .

10.4 Creating a Custom SP Integration Engine

This section explains how to plan, develop, and implement a custom SP integration engine.

10.4.1 Planning a Custom SP Integration Engine

The steps for developing a custom SP integration engine involve: ■ creating a service to process requests from Oracle Identity Federation in SP mode ■ implementing a module to create an authenticated session for a user at the IAM server ■ redirecting the user to the final target URL ■ deciding whether the SP integration engine will set a cookie after it creates an authenticated session at the IAM server. If so, the engine needs to be integrated into the logout process Section 10.5, Logout . ■ packaging these services and module into a web application, and deploying it to Oracle WebLogic Managed Server where the federation server is running ■ configuring Oracle Identity Federation to reference the new SP integration module. ■ if the SP integration engine accesses a user repository, ensuring that it is the same user data store configured in Fusion Middleware Control for use by Oracle Identity Federation See Also: ■ Section 10.2.1, Architecture for a description of the SP integration engine and how it fits into Oracle Identity Federation architecture. 10-18 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation

10.4.2 Developing and Implementing the Integration Module

This section describes how to develop the integration module and how to implement it in the federation environment. ■ Path URLs ■ Adding or Modifying an SP Integration Engine ■ Implementing the Service

10.4.2.1 Path URLs

Communication between the Oracle Identity Federation engine and the SP integration engine requires internal servlet forwards that are equivalent to API calls. These forwards are achieved with the following JavaEE API: ServletContext.getContextString contextPath .getRequestDispatcherString relativePath .forwardHttpServletRequest request, HttpServletResponse response where ■ contextPath is the root context path of the web application. For example, the contextPath of Oracle Identity Federation is fed. ■ relativePath is the service URL to which the uses is forwarded, and is relative to the contextPath. For example, when starting a Federation SSO flow, the SP integration engine uses spstartsso as the relativePath when forwarding the user. Oracle Identity Federation needs to be aware of the ID and the contextPath and the relativePath of the new SP integration engine; This is the URL that will process the result of the Federation SSO operation after the federation server has processed the incoming assertion.

10.4.2.2 Adding or Modifying an SP Integration Engine

To add or modify the SP integration engine take these steps: 1. Go to Fusion Middleware Control and navigate to the Oracle Identity Federation instance.

2. Navigate to Administration then SP Integration Modules. Click the Custom SP

Engine tab.

3. To add an SP integration engine, click Add and enter a name for that SP

integration engine. Oracle Identity Federation will generate an ID for that new engine

4. To modify an SP integration engine, select it and:

■ Enable or disable the engine ■ Specify the contextPath of the SP integration engine in the Web Context field Note: the name will only be used in Fusion Middleware Control for display purposes while the ID is used during communication between Oracle Identity Federation and the authentication engine