Example 5: Assertion Mapping without Federated Identities for a Specific IdP

Additional Server Configuration 6-39 If both options are enabled, Oracle Identity FederationSP first uses the NameID mapping search, and if no results are returned, it uses the LDAPSQL query flow. If Oracle Identity FederationSP cannot locate the user record during this flow, the server challenges the user for credentials. The administrator specifies in Oracle Identity Federation configuration the LDAPSQL query to be used when trying to look up a user. The query contains placeholders that are replaced by the attribute and NameID values contained in the assertion. The placeholders use a NAME format in which Oracle Identity FederationSP replaces NAME with: ■ An attribute name, referencing an attribute contained in the assertion. When creating the query, Oracle Identity FederationSP replaces AttributeName with the value of the attribute referenced by AttributeName. ■ orafed-nameid-value - Oracle Identity Federation replaces this placeholder with the Name ID value ■ orafed-nameid-qualifier - Oracle Identity Federation replaces this placeholder with the Name ID qualifier ■ orafed-nameid-format - Oracle Identity Federation replaces this placeholder with the Name ID format ■ orafed-providerid - Oracle Identity Federation replaces this placeholder with the Peer ProviderID

6.17.2 Configuring Oracle Identity Federation

Only the SAML 2.0 module supports the use of federated identities, not the SAML 1.x modules. To configure Oracle Identity Federation to use federated identities for assertion to user mapping, and to enable automatic account linking operations:

1. Log in to Fusion Middleware Control.

2. Navigate to Administration, then Service Provider, then SAML 2.0, then Assertion Settings .

3. Check Map User via Federated Identity.

4. Check Enable Auto Account Linking.

To map a user using the NameID:

1. Log in to Fusion Middleware Control.

2. Navigate to Administration, then Service Provider, then SAML 2.0, then Assertion Settings .

3. Check Map User via NameID.

4. Configure the NameID Format enabled and the attribute in the user record to be

used during the lookup procedure of the automatic account linking operation. To map a user using an LDAPRDBMS query: Note: The attribute mapping module maps the attributes contained in the assertion to the attribute namevalues configured for the remote provider. The attribute name needs to reference an attribute from the list. 6-40 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation 1. Log in to Fusion Middleware Control. 2. Navigate to Administration, then Service Provider, then SAML 2.0, then Assertion Settings .

3. Check Map User via Attribute Query.

4. Enter the LDAP or SQL query to be used during the lookup procedure of the automatic account linking operation.

6.17.3 Example 1: Automatic Account Linking through NameID mapping for SAML 2.0

In this example, Oracle Identity FederationSP uses the NameID contained in the assertion to look up a local user in the LDAP user data store. The format of the NameID is emailAddress, and the search uses the mail attribute of the LDAP user record. The server is configured to use the NameID mapping functionality to locate the user during automatic account linking. Perform the following steps to configure Oracle Identity FederationSP: 1. Log in to Fusion Middleware Control. 2. Navigate to Administration, then Service Provider, then SAML 2.0, then Assertion Settings .

3. Check Map User via Federated Identity.

4. Check Map Enable Auto Account Linking.

5. Uncheck Map User via Attribute Query.

6. Check Map User via NameID.

7. Enable Email Address NameID Format, and enter the attribute of the user record

holding the email address mail typically for LDAP server. 8. Apply the changes.

6.17.4 Example 2: Simple Automatic Account Linking through LDAPSQL Query

In this example, Oracle Identity FederationSP uses the NameID contained in the assertion to look up a local user in the LDAP user data store and automatically create the federation record. The format of the NameID is emailAddress, and the search uses the mail attribute of the LDAP user record. The server is configured to use the LDAPSQL query functionality to locate the user. Perform the following steps to configure Oracle Identity FederationSP: 1. Log in to Fusion Middleware Control. 2. Navigate to Administration, then Service Provider, then SAML 2.0, then Assertion Settings .

3. Check Map User via Federated Identity.

4. Check Map Enable Auto Account Linking.

5. Check Map User via Attribute Query.

6. Set the attribute query to mail=orafed-nameid-value

7. Uncheck Map User via NameID.

8. Apply the changes.