Configure the SAML 1.1 Credential Mapping Provider Configure the Source Site Federation Services

Configuring Single Sign-On with Web Browsers and HTTP Clients 7-3

7.2.2 Configuring a SAML 1.1 Source Site for Single Sign-On

The following topics explain how to configure a WebLogic Server instance as a SAML 1.1 source site: ■ Section 7.2.2.1, Configure the SAML 1.1 Credential Mapping Provider ■ Section 7.2.2.2, Configure the Source Site Federation Services ■ Section 7.2.2.3, Configure Relying Parties ■ Section 7.2.2.4, Replacing the Default Assertion Store

7.2.2.1 Configure the SAML 1.1 Credential Mapping Provider

In your security realm, create a SAML Credential Mapping Provider V2 instance. The SAML Credential Mapping provider is not part of the default security realm. See Section 4.10, Configuring a SAML Credential Mapping Provider for SAML 1.1. Configure the SAML Credential Mapping provider as a SAML authority, using the Issuer URI, Name Qualifier, and other attributes.

7.2.2.2 Configure the Source Site Federation Services

Configuration of a WebLogic Server instance as a SAML 1.1 source site is controlled by the FederationServicesMBean. Access the FederationServicesMBean with the WebLogic Scripting Tool or through the Administration Console, on the Environment Servers ServerName Configuration Federation Services SAML 1.1 Source Site page. See Configure SAML 1.1 source services in the Oracle WebLogic Server Administration Console Help. Configure SAML source site attributes as follows: ■ Enable the SAML Source Site . Allow the WebLogic server instance to serve as a SAML source site by setting Source Site Enabled to true. ■ Set Source Site URL and Service URIs . Set the URL for the SAML source site. This is the URL that hosts the Intersite Transfer Service and the Assertion Retrieval Service. The source site URL is encoded as a source ID in hex and Base64. When you configure a SAML Asserting Party for BrowserArtifact profile, you specify the encoded source ID. Specify the URIs for the Intersite Transfer Service and to support BrowserArtifact profile the Assertion Retrieval Service. You also specify the Intersite Transfer Service URI when you configure a Relying Party. The default URI FederationServicesMBean.IntersiteTransferURIs values are shown in Table 7–1 . Table 7–1 Intersite Transfer URIs Default URI Values Description samlits_baits BASIC authentication, POST or Artifact profile samlits_baitspost BASIC authentication, POST profile samlits_baitsartifact BASIC authentication, Artifact profile samlits_ccits Client cert authentication, POST or Artifact profile samlits_ccitspost Client cert authentication, POST profile samlits_ccitsartifact Client cert authentication, Artifact profile 7-4 Securing Oracle WebLogic Server The Intersite Transfer URI text box allows you to accept the default values as-is, or modify them as you choose. Each URI includes the application context, followed by its, itspost, or itsartifact. The provided application contexts are samlits_ba BASIC authentication or samlits_cc client certificate authentication. You could also specify an application-specific context if needed, for example yourapplicationits, but in most cases the defaults provide the easiest configuration option. If you specify these URIs as samlits_baits, if a redirect occurs and the users session on the source site has timed out, a BASIC authentication dialog is presented. If you instead want to use a FORM dialog, the URI should point to a custom Web application that authenticates users and then forwards to the actual ITS URI. ■ Add signing certificate . The SAML source site requires a trusted certificate with which to sign assertions. Add this certificate to the keystore and enter the credentials alias and passphrase to be used to access the certificate. The servers SSL identity keycertificates will be used by default if a signing alias and passphrase are not supplied. ■ Configure SSL for the Assertion Retrieval Service . You can require all access to the Assertion Retrieval Service to use SSL by setting FederationServicesMBean.arsRequiresSSL to true. You can require two-way SSL authentication for the Assertion Retrieval Service by setting both arsRequiresSSL and ARSRequiresTwoWaySSL to true.

7.2.2.3 Configure Relying Parties