Configuring Oracle Identity Federation for SSL

5-48 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation 2. Oracle Identity Federation processes the incoming AttributeRequest message, and selects the IdP to which to send the SAML AttributeQuery, based either on the IdP specified on the Request, or on the Subject contained in the AttributeRequest. 3. Oracle Identity Federation applies, for the specific remote IdP, the attribute value mapping for the optional attribute values listed in the AttributeRequest. 4. Oracle Identity Federation applies, for the specific remote IdP, the attribute name mapping for the optional attribute listed in the AttributeRequest. 5. Oracle Identity Federation sends the AttributeQuery to the remote IdP. 6. Oracle Identity Federation receives the response containing the assertion, along with the attributes sent by the IdP. 7. Oracle Identity Federation applies, for the specific remote IdP, the attribute name mapping for the attribute names listed in the assertions AttributeStatement. 8. Oracle Identity Federation applies, for the specific remote IdP, the attribute value mapping for the attribute values listed in the assertions AttributeStatement. 9. Oracle Identity Federation builds the AttributeResponse message, and returns it to the web service client in a SOAP response message.

5.8.2 Attribute Request Message

The AttributeRequest message issues a request for attribute data about a user. The AttributeRequest specifies these inputs: ■ The Subject: A string representing the user. This is a required input. ■ The Subject Format: A URI specifying how the Subject string represents the user. If not present, format oracle:security:nameid:format:x509 will be used. Valid formats are: – oracle:security:nameid:format:x509: Indicates that the Name ID is the Subject DN. – oracle:security:nameid:format:entity: Indicates that the Name ID is the identifier of an entity that provides SAML services. This Name ID Format only applies to the SAML 2.0 protocol. – oracle:security:nameid:format:emailaddress: Indicates that the Name ID is in the form of an email address. – oracle:security:nameid:format:windowsdomainqualifiedname: Indicates that the Name ID is a Windows domain qualified name A Windows domain qualified name is a string of the form DomainName\UserName, where the DomainName and \ can be omitted. – oracle:security:nameid:format:kerberos: Indicates that the Name ID is in the form of a Kerberos principal name using the format name[instance]REALM. This Name ID Format only applies to the SAML 2.0 protocol. – oracle:security:nameid:format:persistent: Indicates that the Name ID is a persistent opaque identifier for the user that is specific to an IdP and SP. This Name ID Format only applies to the SAML 2.0 protocol. – oracle:security:nameid:format:transient: Indicates that the Name ID is an opaque and temporary identifier for the user. This Name ID Format only applies to the SAML 2.0 protocol. Configuring Oracle Identity Federation 5-49 – oracle:security:nameid:format:unspecified: Indicates that the interpretation of the Name ID is left up to the implementation. – oracle:security:nameid:format:custom: Indicates that the Name ID is a custom value. – oracle:security:nameid:format:userid: Indicates that the Name ID is the User ID used by Oracle Identity Federation to identify the user. ■ The attribute authority to which the AttributeQuery is to be sent. If no attribute authority is specified, Oracle Identity Federation will determine what attribute authority to send the AttributeQuery as follows: – If the Subject Format is oracle:security:nameid:format:x509, or if it is not present, Oracle Identity Federation will map the Subject value to an identity provider. If no mapping is found for the SubjectDN, the default attribute authority is used. – Otherwise, Oracle Identity Federation will use the default attribute authority. ■ Zero or more attributes to be retrieved for the user. ■ For each attribute, zero or more values. A NULL value can be represented as Value Null=true. The AttributeRequest message is wrapped in a SOAP Envelope and Body and sent in an HTTP POST request. Examples of AttributeRequest messages follow. Example 1 In the following request, the Subject format is not specified and is therefore assumed to be oracle:security:nameid:format:x509. The target IdP is also not specified and so Oracle Identity Federation will determine the attribute authority to use by mapping the SubjectDN to an IdP. SOAP-ENV:Envelope xmlns:SOAP-ENV=http:schemas.xmlsoap.orgsoapenvelope SOAP-ENV:Body orafed-arxs:AttributeRequest Note: To enabledisable Name ID formats and map them to attributes in the user data store, follow these steps: 1. Log in to Fusion Middleware Control and navigate to the Oracle Identity Federation instance 2. Navigate to Administration, then Identity Provider or Service Provider to configure IdP and SP, respectively. 3. In the SAML 2.0SAML 1.X tabs, modify the Assertion Subject NameID Formats by:

a. Clicking the Enabled box next to the

formats you wish to enable. b. Mapping each format to an attribute in the user data store. 4. Click Apply. See Also: Section 5.6.5, Configuring Oracle Identity Federation as an SP Attribute Requester for instructions on how to configure the default attribute authority and the SubjectDN to IdP mappings