In the Audit Level menu, select Custom as the audit level.

8 Security 8-1 8 Security This chapter describes Oracle Identity Federation security topics, including: ■ Configuring SSL for Oracle Identity Federation ■ Managing Signing and Encryption Wallets ■ Setting up JCE Policy Files for Oracle WebLogic Server

8.1 Configuring SSL for Oracle Identity Federation

Oracle Identity Federation only supports configuring one password for signing and encryption keystores, and uses that password to open both the keystore and the private key. This means that if a keystore is configured with different store password and key password, an error will occur when Oracle Identity Federation tries to access the private key. To avoid this error, ensure that the private key password for the configured key alias is the same as the keystore password. This section contains these topics: ■ Configuring Oracle Identity Federation as an SSL Server ■ Configuring Oracle Identity Federation as an SSL Client

8.1.1 Configuring Oracle Identity Federation as an SSL Server

This section explains how to configure the SSL port for Oracle WebLogic Server, and how to configure Oracle Identity Federation to use SSL. Note: In Oracle Identity Federation 11g Release 1 11.1.1, if you change the key password to match the keystore password, you must remove the old keystorewallet from the configuration. Note: Keystores, trusted certificates and certificates for Oracle Identity Federation are managed the same way as they are for any other Oracle Fusion Middleware component. For details, see the Oracle Fusion Middleware Administrators Guide. 8-2 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation

8.1.1.1 Setting up SSL on Oracle WebLogic Server

Take these steps to configure the SSL port and keystore for the Oracle WebLogic Server for which you are setting up SSL:

1. Log in to the Oracle WebLogic Server administration console and navigate to

Environment , then Servers.

2. Select the server for which you want to set up SSL.

3. Check SSL Listen Port Enabled and enter an SSL listening port number for

example. 443. We will subsequently refer to this port as SSL_PORT.

4. Click Save.

5. Go to the Keystores tab, and click Lock Edit.

6. In Keystores, select an option that includes Custom Identity.

7. In the Identity section, fill in properties as follows:

■ Custom Identity Keystore: location of keystore containing the SSL private key and certificate ■ Custom Identity Keystore type: jks ■ Custom Identity Keystore Passphrase: storepassword

8. Click Save.

9. Go to the SSL tab.

10. In the Identity section, fill in properties as follows:

■ Private Key Alias: keyalias ■ Private Key Passphrase: keypassword

11. Click Save, then click Activate Changes.

12. Restart the server.

13. To verify that SSL was set up correctly, go to https:HOSTNAME:SSL_PORT;

a certificate should be presented. View the certificate; the subject should match the cn entered when creating the certificate. If you wish to configure Oracle WebLogic Server to require a client SSL certificate, take the following steps:

1. Log in to the Oracle WebLogic Server administration console and navigate to

Environment, then Servers.

2. Select the server for which you want to set up SSL.

3. Go to the SSL tab, then Advanced.

Notes: ■ The CN of the SSL server certificate must be the fully qualified hostname, for example eaevma1302.de.mycorp.com, not eaevma1302. ■ For complete information on how to set up SSL on Oracle Weblogic Server, refer to Configuring SSL in Oracle Fusion Middleware Securing Oracle WebLogic Server.