Setting up Backwards Compatibility for Oracle Identity Federation 10g and ShareID service URLs

Additional Server Configuration 6-33 DOMAIN_HOMEserversSERVER_NAMEtmp_WL_usershareidupdate ■ Add the properties IsSecure, ServerName, andor ServerPort to the servlets being used. Note: IsSecure is set to true if desired protocol is HTTPS, false if the desired protocol is HTTP. ■ Save changes and restart the application. For example, the servlet element may now contains elements such as: init-param param-nameIsSecureparam-name param-valuetrueparam-value init-param init-param param-nameServerPortparam-name param-value7777param-value init-value

6.16 Mapping Users through Attributes and NameID in SP Mode

Oracle Identity Federation acting as an SP can locate a user based on the attributes and name identifier value stored in an assertion without using any federation records. When configured not to use the federated identity to map the assertion to a user record, Oracle Identity FederationSP uses the NameID and the attributes contained in the incoming assertion to map the user in the repository. Once the user record is located, Oracle Identity FederationSP creates an authenticated session for that user in the identity and access management framework and redirects the user to the final target URL. This flow does not use any federation records, so it is not necessary to have a federation data store configured to use Oracle Identity Federation as the service provider. If Oracle Identity Federation cannot locate the user during the flow, the default behavior is to return a 401 Unauthorized error to the user. You can configure Oracle Identity Federation to redirect the user to the authentication engine instead, so that custom corrective measures such as user account provisioning can be initiated. This behavior is implemented with the Error when User Mapping fails property; see Section 6.16.2, Configuring Oracle Identity Federation , under the procedure titled If the Mapping Fails. On returning to Oracle Identity Federation from the authentication engine, if the user still cannot be mapped, a final result of 401 is returned. Limitations Note these limitations: ■ Since Oracle Identity FederationSP does not store any federation records when configured to map the assertion without using federated identities, no account linking information is available in the Identity Federation section of Fusion Middleware Control. ■ Additionally, the Name Identifier Update and Federation Termination profiles will not complete; if the peer IdP sends a message for one of these profiles, Oracle Identity FederationSP will return an error message indicating that the federation record could not be found. 6-34 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation This section contains these topics: ■ Locating a User ■ Configuring Oracle Identity Federation ■ Example 1: Assertion Mapping without federated identities using NameID for SAML 2.0 ■ Example 2: Simple Assertion Mapping without Federated Identities with an LDAPSQL Query ■ Example 3: Complex Assertion Mapping without Federated Identities with an LDAPSQL Query ■ Example 4: Assertion Mapping without Federated Identities using LDAPSQL Query and NameID Mapping ■ Example 5: Assertion Mapping without Federated Identities for a Specific IdP

6.16.1 Locating a User

You have two options for locating a user record in the repository: ■ Using the Name ID Format mapping, where the NameID is linked to a user attribute. ■ Using an LDAPSQL query that involves the NameID and the attributes stored in the assertion. If both options are enabled, Oracle Identity FederationSP first uses the NameID mapping search, and if no results are returned, it uses the LDAPSQL query flow. The query contains placeholders that are replaced by the attribute and NameID values contained in the assertion. The placeholders use a NAME format in which Oracle Identity FederationSP replaces NAME with: ■ An attribute name, referencing an attribute contained in the assertion. When creating the query, Oracle Identity FederationSP replaces the AttributeName with the value of the attribute referenced by AttributeName. ■ orafed-nameid-value - indicates that this placeholder should be replaced by the Name ID value ■ orafed-nameid-qualifier - indicates that this placeholder should be replaced by the Name ID qualifier ■ orafed-nameid-format - indicates that this placeholder should be replaced by the Name ID format ■ orafed-providerid - indicates that this placeholder should be replaced by the Peer ProviderID

6.16.2 Configuring Oracle Identity Federation

The SAML 2.0 module supports the use of federated identities, but not the SAML 1.x modules. Note: The attribute mapping module will have mapped the attributes, contained in the assertion, to the attribute namevalues configured for the remote provider. The attribute name needs to reference an attribute from this list. Additional Server Configuration 6-35 To configure Oracle Identity Federation to use federated identities for assertion to user mapping operations: 1. Log in to Fusion Middleware Control. 2. Navigate to Administration, then Service Provider, then SAML 2.0, then Assertion Settings .

3. Check or uncheck Map User via Federated Identity.

To map a user using the NameID: 1. Log in to Fusion Middleware Control. 2. Navigate to Administration, then Service Provider, then SAML 2.0, then Assertion Settings .

3. Check Map User via NameID.

4. Configure the NameID format and the attribute in the user record to be used during the lookup procedure. To map a user using an LDAPRDBMS query: 1. Log in to Fusion Middleware Control. 2. Navigate to Administration, then Service Provider, then SAML 2.0, then Assertion Settings .

3. Check Map User via Attribute Query.

4. Enter the LDAP or SQL query to be used during the lookup procedure. If the Mapping Fails If the mapping fails, you can configure Oracle Identity Federation to invoke the authentication engine instead of returning a 401-error code. To configure the server, perform the following steps: 1. Log in to Fusion Middleware Control. 2. Navigate to Administration, then Service Provider, then SAML 2.0, then Assertion Settings .

3. Uncheck Error when User Mapping fails to invoke the authentication engine that

will then have access to the content of the assertion and its attributes.

6.16.3 Example 1: Assertion Mapping without federated identities using NameID for SAML 2.0

In this example, Oracle Identity FederationSP uses the NameID contained in the assertion to look up a local user in the LDAP user data store. The format of the NameID is emailAddress, and the search uses the mail attribute of the LDAP user record. The server is configured to use the NameID mapping functionality to locate the user. Perform the following steps to configure Oracle Identity FederationSP: 1. Log in to Fusion Middleware Control. Note: The attribute mapping module will have mapped the attributes, contained in the assertion, to the attribute namevalues configured for the remote provider. The attribute name needs to reference an attribute from this list.