SAML 2.0 Credential Mapping Provider Attributes

Configuring WebLogic Security Providers 4-17 For general information about WebLogic Servers support for SAML 2.0, see Security Assertion Markup Language SAML and Single Sign-On with the WebLogic Security Framework in Understanding Security for Oracle WebLogic Server. For information about how to use the SAML 2.0 Credential Mapping provider in a SAML 2.0 single sign-on configuration, see Chapter 7, Configuring Single Sign-On with Web Browsers and HTTP Clients. For information about specifying the confirmation method for assertions generated for web service Service provider partners, see Using Security Assertion Markup Language SAML Tokens For Identity in Securing WebLogic Web Services for Oracle WebLogic Server.

4.11.1 SAML 2.0 Credential Mapping Provider Attributes

Configuration of the SAML 2.0 Credential Mapping provider is controlled by setting attributes on the SAML2CredentialMapperMBean. You can access the SAML2CredentialMapperMBean using the WebLogic Scripting Tool WLST, or through the Administration Console by selecting the Security Realms RealmName Providers Credential Mapping page and creating or selecting SAML2CredentialMapper. For details about these attributes, see the description of the SAML2CredentialMapperMBean in the Oracle WebLogic Server MBean Reference. To configure the SAML 2.0 Credential Mapping provider, set the following attributes: ■ Issuer URI Name of this security provider. The value that you specify should match the Entity ID specified in the SAML 2.0 General page that configures the per-server SAML 2.0 properties. ■ Name Qualifier Used by the Name Mapper class as the security or administrative domain that qualifies the name of the subject. This provides a means to federate names from disparate user stores while avoiding the possibility of subject name collision. ■ Assertion life time Values that limit the life time of generated assertions during which they may be used. Expired assertions cannot be made available for use. ■ Web service assertion signing key alias and passphrase Used for signing generated assertions. ■ Custom name mapper class The custom Java class that overrides the default SAML 2.0 Credential Mapping provider name mapper class, which maps Subjects to identity information contained in the assertion. ■ Generate attributes Specifies whether group membership information associated with the authenticated Subject is included in generated assertions. holder-of-key The subject represented in the assertion uses an X.509 certificate that may not be trusted by the receiver to protect the integrity of the request messages. Used with the Web Service Security SAML Token Profile 1.1 only. Table 4–7 Cont. Assertion Types Supported by the SAML 2.0 Credential Mapping Assertion Type Description 4-18 Securing Oracle WebLogic Server

4.11.2 Service Provider Partners