Configuring the SAML 2.0 LDAP Attribute Profile Configuring On-Demand Global Logout

6-16 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation ■ SSL Client Authentication ■ HTTP Basic Authentication

6.9.1 SSL Client Authentication

Refer to Section 8.1, Configuring SSL for Oracle Identity Federation for details on how to: ■ configure SSL to protect the SOAP URL ■ configure Oracle Identity Federation to connect to SOAP endpoints protected by SSL

6.9.2 HTTP Basic Authentication

This section describes: ■ how to configure HTTP Basic Authentication on the server to protect SOAP URLs ■ how to configure the credentials that are used when connecting to a remote server protected by HTTP basic authentication using the SOAP protocol

6.9.2.1 Configuring HTTP Basic Authentication to protect the SOAP URLs

This section lists the steps needed to protect the SOAP endpoints. The configuration changes are made on the Oracle WebLogic administration server. The steps are as follows: Configure Oracle WebLogic Server to check created policies 1. Log in to the Oracle WebLogic Server Administration Console.

2. On the left-hand pane, select Security Realm, and navigate to myrealm, then

Configuration , then Advanced.

3. Select the following settings:

■ Check roles and Policies: All Web applications and EJBs ■ When Deploying Web Applications or EJBs: Initialize roles and policies from DD Click Save. 4. Stop the Administration server by navigating to Environment, then Servers, then Control , selecting AdminServer and clicking Shutdown - Force Shutdown Now. 5. From a terminal window, start the Administration server by invoking the script: DOMAIN_HOMEbinstartWebLogic.sh. Create a Group and a User 1. Log in to the Oracle WebLogic Server Administration Console.

2. On the left-hand pane, select Security Realms and navigate to myrealm, then

Users and Groups , then Groups.

3. Click New and select a name for example, soapusers. Click OK.

Note: When it is integrated with Oracle Single Sign-On with mod_ osso, Oracle Identity Federation cannot be protected using HTTP Basic Authentication. Additional Server Configuration 6-17

4. Navigate to Users and Groups, then Users.

5. Click New and select a name and password. Click OK.

6. Click on the user you just created and select the Groups tab.

7. Select the group you created and move it to the Chosen column. Click Save.

To enter additional users, repeat steps 4-7. Create a Role and a Policy 1. Log in to the Oracle WebLogic Server’s Administration Server console. 2. On the left-hand pane, select Deployments, expand the Oracle Identity Federation application, and click on fed.

3. Navigate to Security, then Roles.

4. Click New and select a name for example, soapusers. In the URL Pattern, enter

. Click OK. 5. Click on the role you just created and click Add Conditions. 6. Select Group and click Next. 7. Enter the name of the group you created and click Add, then Finish. 8. Click Save. 9. On the left-hand pane, select Deployments, expand the Oracle Identity Federation application and click on fed.

10. Navigate to Security, then Policies.

11. To protect the SOAP endpoint, you need to create a set of policies one policy per URL you need to protect. The list of URLs that need to be protected is displayed in Table 6–2 . To create a policy, follow these steps.:

a. Click New and enter the URL from Table 1 that needs to be protected. Click

OK .

b. Click on the policy you just created and click Add Conditions.

c. Select Role and click Next.

d. Enter the name of the role you created and click Add, then Finish.

e. Click Save. 12. After creating the group, users, role and policies, restart the administration and managed servers for the changes to take effect. Table 6–2 URLs which Need Policies Created Liberty 1.xSAML 2.0 SOAP Endpoint SAML 1.x SOAP Endpoint idpsoap idpsoapv11 spsoap spsoapv11 aasoap aasoapv11 arsoap authnauthsoapv11 authnauthsoap