Send Authentication Queries SAML 1.x

4-20 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation Note the following points: ■ When you upload metadata, there is no validation to check if the related SP or IdP site is using the same protocol. A federated single sign-on may be performed to validate the protocols. ■ After using the Firefox browser to upload provider metadata from the Federations page in Fusion Middleware Control, you cannot modify the provider metadata file that you just uploaded until you restart Firefox. The reason for this is the Live HTTP Header add-on in Firefox. Once you disable this add-on and restart Firefox, you can modify the provider metadate file after you have uploaded the metadata on the Federations page.

4.3.3 Update Trusted Providers

To update or delete a trusted provider:

1. In Fusion Middleware Control, select the server instance in the topology panel at

left.

2. Navigate to Oracle Identity Federation, then Administration, then Federations.

3. Select the provider and click Edit.

4.3.4 Delete Trusted Providers

To update or delete a trusted provider from your server’s trusted providers: 1. In Fusion Middleware Control, select the server instance in the topology panel at left.

2. Navigate to Oracle Identity Federation, then Administration, then Federations.

3. Select the provider and click Delete.

4.3.5 Set Up Single Sign-On for SAML 1.x and WS-Federation

To set up SSO for SAML 1.x and WS-Federation protocols, you first add the peer provider to the list of trusted providers, then fill in the required attributes for the protocol. Add the Peer Provider to the Trusted Providers Take these steps to achieve this task: See Also: Section 4.3.5, Set Up Single Sign-On for SAML 1.x and WS-Federation . Server Administration 4-21 1. In Fusion Middleware Control, select the server instance in the topology panel at the left.

2. Navigate to Oracle Identity Federation, then Administration, then Federations.

3. On the Federations page, click Add.

4. Select the option to Add Provider Manually. Fill in the required attributes, and

click OK to add the trusted provider. Fill in the Required Attributes for SAML 1.x You can choose to upload SAML1.x metadata, which can then be generated by Oracle Identity Federation. The peer providers signing certificate and the artifact resolution SOAP endpoint parameters are automatically filled in. Take these steps to achieve this task: 1. On the Federations page, select the SAML 1.X provider and click Edit.

2. Select the option to Update Manually.

3. Select the Trusted Provider Settings tab.

4. If the peer provider is an identity provider: a. In the Identity Provider Authority Settings section enter the peer provider’s signing certificate, in the New Signature Verification Certificate field.

b. In the Initiate SSO URL field, enter the URL used by the peer provider to

initiate the SSO flow.

c. In the Initiate SSO Target Parameter field, enter the parameter used by the

peer provider to identify the desired resource TARGET in the case of Oracle Identity Federation.

d. In the Initiate SSO Provider ID Parameter field, enter the name of the

parameter that the peer provider uses to identify the provider ID of the service provider. For an Oracle Identity Federation peer identity provider, the parameter name must be providerid.

e. In the Artifact Resolution SOAP Endpoint field, enter the URL used by the

peer provider to receive SOAP requests to resolve artifacts

f. In the Artifact Source ID field, enter a source ID parameter. Oracle Identity

FederationSP uses this value to find the users preferred identity provider from its list of known IdPs. If no source ID is specified, Oracle Identity Federation automatically generates it as the SHA-1 digest of the provider ID. For example, an Oracle Identity Federation peer identity provider might have the following Initiate SSO URL, using the configuration entered in steps b, c, and d above: http:saml.example.comfedidpinitiatesso?TARGET=protected -resource-urlproviderid=sp-provider-id-uri 5. If the peer provider is a service provider: a. In the Service Provider Requester Settings section enter the peer provider’s signing certificate, in the New Signature Verification Certificate field.

b. In the Assertion Consumer Service URL field, enter the URL used by the peer

provider to consume the assertion.