Creating a root Node

30 Configuring Single Sign-on 30-1 30 Configuring Single Sign-on This chapter describes the available single sign-on SSO solutions for your WebCenter Portal application to use, and how each is configured. This chapter includes the following sections: ■ Section 30.1, Introduction to Single Sign-on ■ Section 30.2, Configuring Oracle Access Manager OAM ■ Section 30.3, Configuring Oracle Single Sign-On OSSO ■ Section 30.4, Configuring SAML-based Single Sign-on ■ Section 30.5, Configuring SSO for Microsoft Clients ■ Section 30.6, Configuring SSO with Virtual Hosts Audience The content of this chapter is intended for Fusion Middleware administrators users granted the Admin role through the Oracle WebLogic Server Administration Console. Users with the Monitor or Operator roles can view security information but cannot make changes. See also, Section 1.8, Understanding Administrative Operations, Roles, and Tools.

30.1 Introduction to Single Sign-on

Single sign-on can be implemented for WebCenter applications using several solutions. This section describes their benefits and recommended application. Oracle Access Manager OAM, part of Oracles enterprise class suite of products for identity management and security, provides a wide range of identity administration and security functions, including several single sign-on options for WebCenter Spaces and WebCenter Portal applications. OAM in particular, OAM 11g is the recommended single sign-on solution for Oracle WebCenter 11g installations. For deployment environments that are already invested in Oracle 10g infrastructure, and where the Oracle Application Server Single Sign-On OSSO server is used as the primary SSO solution, WebCenter 11g can also be configured to use OSSO for single sign-on. For non-production, development environments where you do not have an enterprise-class single sign-on infrastructure like Oracle Access Manager or Oracle SSO, and you only need to provide a single sign-on capability within WebCenter Spaces and its associated Web applications like Discussions, and Worklist, you can configure a SAML-based SSO solution. If you need to provide single sign-on for other enterprise applications as well, this solution is not recommended.