Implementing the Post-processing Plug-in

Custom Actions 12-11 3. Set the authnpath property containing the relative path of the post-processing plug-in page: setConfigPropertyserverconfig, authnpath, cookieextract.jsp, string 4. Exit the WLST script environment.

12.3.3.4 Implementation of cookieextract.jsp

The JSP looks like this: page buffer=5 autoFlush=true session=false page language=java import=java.util., javax.naming., javax.naming.directory., java.net. response.setHeaderCache-Control, no-cache; response.setHeaderPragma, no-cache; response.setHeaderExpires, Thu, 29 Oct 1969 17:04:19 GMT; check if authentication was successful if request.getAttributeoracle.security.fed.authn.authntime = null { authentication was successful. Attributes will be added Map attributes = Maprequest.getAttributeoracle.security.fed.authn.attributes; if attributes == null { attributes = new HashMap; request.setAttributeoracle.security.fed.authn.attributes, attributes; } get the cookie Cookie[] cookies = request.getCookies; String cookieValue = null; forint i = 0; i cookies.length; i++ { Cookie cookie = cookies[i]; if cookie.getName.equalscustomcookie cookieValue = cookie.getValue; } if cookieValue = null cookieValue.length 0 { StringTokenizer st = new StringTokenizercookieValue, +; String language = st.nextToken; String homepage = st.nextToken; Set languageValues = new HashSet; languageValues.addlanguage; attributes.putcookie-language, languageValues; Set homepageValues = new HashSet; homepageValues.addhomepage; attributes.putcookie-homepage, homepageValues; } } forward to the OIF server to resume the flow request.getSession.getServletContext.getContextfed.getRequestDispatcher userloginsso.forwardrequest, response; 12-12 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation

12.4 Pre-processing Custom Action for SP Integration Engine

The pre-processing plug-in is a module to which the user is directed, as part of an SP SSO flow from an SP integration module, instead of being redirected to the Oracle Identity Federation server to start the Federation SSO operation. The plug-in enables custom actions to be taken before the SSO flow. When the pre-processing plug-in is in use, the SP integration module internally forwards the user to the plug-in, supplying the runtime data to be used for the federated SSO operation. The plug-in performs custom operations, and forwards the user to Oracle Identity Federation - with the runtime data - to resume the Federation SP SSO flow.

12.4.1 Implementing the Pre-processing Plug-in

When the SP engine redirects a user to Oracle Identity Federation, it passes certain data to the server as attributes on the HttpServletRequest object. The same data is made available to the pre-processing plug-in. Here is the data passed to the plug-in: ■ An optional Provider ID referencing the IdP to use for the federated SSO. If missing, Oracle Identity Federation uses the IdP mapped for the specified authentication mechanism. If no IdP could be found, Oracle Identity Federation uses the IdP configured as the default SSO IdP String, identified by oracle.security.fed.sp.providerid ■ An optional federation ID referencing the affiliation to use to trigger the federated SSO String, identified by oracle.security.fed.sp.federationid ■ The relay state containing a small string, for example a reference to some data saved in a repository or a small URL pointing to the protected resource to which the user is redirected after completion of the SSO operation. String, identified by oracle.security.fed.sp.relaystate ■ The protected resource the user was trying to access, when the SP Engine is an out-of-the-box SP engine either Oracle Access Manager, Oracle Single Sign-On, or test SP engine. identified by oracle.security.fed.sp.returnurl ■ The identifier of the SP engine that started the SSO flow String, identified by oracle.security.fed.sp.engineid ■ An optional flag indicating if Oracle Identity Federation should authenticate the user locally using the authentication engines or if a federated SSO should be started by redirecting the user to an IdP for authentication Boolean, identified by oracle.security.fed.sp.localauthn; default is false ■ Whether to use the configuration stored in Oracle Identity Federation or to only start the SSO based on the information being passed by the SP engine, except the IdP Boolean, identified by oracle.security.fed.sp.usedefault. If missing, true is assumed. ■ Whether the SP should ask the IdP to challenge the user even if heshe is already authenticated Boolean, identified by oracle.security.fed.sp.forceauthn. This parameter is ignored if usedefault is true or missing. ■ Whether the SP should allow the IdP to create a federation record, if one does not yet exist, during the SSO operation Boolean, identified by oracle.security.fed.sp.allowfedcreation. This parameter is ignored if usedefault is true or missing.