Under the Value Mappings tab, click Add to add an attribute value mapping,

5-64 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation

5.9.2.3 Configuring Attribute Value Filtering

Take these steps:

1. Log in to Fusion Middleware Control and navigate to the Oracle Identity

Federation instance.

2. Navigate to Administration, then Federations.

3. Select the attribute requester with which you want to configure attribute sharing,

and click Edit. 4. Select Update Manually; under Oracle Identity Federation Settings, click Edit Attribute Mappings and Filters .

5. Under the Value Filters tab, click Add to add an attribute value filter, with the

following fields: ■ Attribute Name: The name of the local attribute in the user repository ■ Condition Operator: Select and to indicates that all conditions need to be met for an attribute to be sent. Select or to indicate meeting one condition is enough to send an attribute. ■ A list of filtering rules with the following fields – Condition: The condition that will be used to evaluate the attribute value. – Expression: The value or regular expression that will be used to evaluate the attribute value. – Ignore Case: If checked, indicates that the string comparison should be case-sensitive when matching attribute values.

5.9.2.3.1 Filtering Conditions

Oracle Identity Federation provides several filtering conditions: ■ equals: the filtering rule will return true if the expression value is equal to the outgoing attribute value. ■ does not equal: the filtering rule will return true if the expression value is different from the outgoing attribute value. ■ starts with: the filtering rule will return true if the outgoing attribute value begins with the expression value. ■ ends with: the filtering rule will return true if the outgoing attribute value ends with the expression value. ■ contains: the filtering rule will return true if the outgoing attribute value contains the expression value. ■ does not contain: the filtering rule will return true if the outgoing attribute value does not contain the expression value. ■ equals null: the filtering rule will return true if the outgoing attribute value is null. ■ does not equal null: the filtering rule will return true if the outgoing attribute value is not null. ■ regexp: the filtering rule will return true if the outgoing attribute value matches the regular expression, which is defined in the expression value. Configuring Oracle Identity Federation 5-65 When the filtering condition is set to regexp, the expression value must be a standard Unix regular expression. See http:java.sun.comj2se1.4.2docsapijavautilregexPattern. html for details about regular expression constructs. Table 5–8 contains some examples illustrating the use of the regexp filtering condition:

5.9.2.3.2 Examples of Value Filters

This section provides some examples of value filter configuration. Example 1 This value filters configuration for the attribute title, will yield the following results: ■ Attribute Name: title ■ Condition Operator: and ■ Value Filters: Results: Note: The rules are used to determine the allowed values. Consequently, if a rule evaluates to true, this means that it is permissible to send the value. Note: When the filtering condition is set to regexp, the ignoreCase flag is disregarded during attribute value processing because regular expressions already support case-insensitivity. Table 5–8 Examples of using the regexp Filtering Condition Regular Expression Meaning .rector any string which ends with rector [abc] any character except a, b, or c negation user\d user0, user1, ..., user9 ab any string which begins with 0+ a characters and ends with a letter b for example, aaaaab Condition Expression Ignore Case does not equal Vice-President checked contains President checked Value Send Value? Vice-President no President yes Vice-president no 5-66 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation Example 2 Suppose attribute value mappings are defined as in the example in Section 5.9.2.2, Configuring Attribute Value Mapping . This value filters configuration for attribute title, will yield the following results: ■ Attribute Name: title ■ Condition Operator: and ■ Value Filters: Results: Note that: ■ For a value to be sent, it must not equal mngr, so the value mngr will not be sent. ■ cmts can be sent all filter conditions evaluate to true, and it is mapped to Consulting Member of Technical Staff. ■ The same results would apply for the following value filters:

5.10 Configuring Security and Trust

You use the security and trust pages to configure keystores and certificates for the Oracle Identity Federation server. To access these pages, start from the Oracle Identity Federation drop-down adjacent to the Topology icon, and navigate to Administration, then Security and Trust. This section contains these topics relating to trust configuration: ■ Security and Trust - Wallet ■ Security and Trust - Provider Metadata ■ Security and Trust - Trusted CAs and CRLs Senior Vice-President yes Condition Expression Ignore Case does not equal mngr true ends with mts false Value Send Value? Value Sent mngr no cmts yes Consulting Member of Technical Staff Condition Expression Ignore Case does not equal mngr true regexp mts Value Send Value?