Preliminary Steps to Set Up the CDC

6-20 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation https:mycorp.commondomain.com:4443fedspintrosso

6.10.4 Configuring Oracle Identity Federation to Display List of Trusted Providers in CDC

Follow these steps to configure Oracle Identity Federation to prompt the user with the list of trusted IdPs in the common domain cookie when an SSO flow is initiated without the provider ID of the target IdP 1. Configure the CDC profile as described in Section 6.10.3, Configuring the CDC Profile as a Service Provider 2. Use the Oracle Identity Federation WLST commands or MBeans to set the commondomainidpdiscenabled property in Config spglobal to true. Using the WLST Commands Use the command: setConfigPropertyspglobal, commondomainidpdiscenabled, true, BOOLEAN See Chapter 9, Oracle Identity Federation Command-Line Tools for more information. Using MBeans In the ConfigMXBean named spglobal, invoke the putProperty operation with the following arguments: ■ Name: commondomainidpdiscenabled ■ Value: true ■ Type: BOOLEAN See Appendix A, Oracle Identity Federation MBeans for more information.

6.11 Configuring the Identity Provider Discovery Service

Identity provider discovery is a service that selects an identity provider possibly through interaction with the user to use during SSO. While Oracle Identity Federation does not provide an identity provider discovery service, it provides support for using such a service to select an IdP, if one is not passed in the authentication request to the SP during SP-initiated SSO. For more information refer to the specifications at: http:docs.oasis-open.orgsecuritysamlPost2.0sstc-saml-idp-d iscovery-cs-01.pdf If acting as a service provider, Oracle Identity Federation can be configured so that if an SSO operation is initiated without the provider ID of the target IdP, the user is redirected to a custom page to select the identity provider with which to perform SSO. After the user selects an identity provider, the custom page resubmits the SSO request with the chosen IdP to Oracle Identity Federation. Follow these steps to configure IdP discovery: Note: This URL must use HTTPS and the SSL port you configured earlier. Additional Server Configuration 6-21 1. Log in to Fusion Middleware Control and navigate to the Oracle Identity Federation instance.

2. Navigate to Administration, then Service Provider.

3. In the Common tab, check Enable Identity Provider Discovery Service, and enter the following property: ■ Service URL: The location of the custom page displaying the IdP choices.

6.11.1 Create the IdP Discovery Service Page

Oracle Identity Federation redirects to the IdP Discovery Service page with the following parameters: ■ return: This is the URL to which the page should send the new request containing the chosen IdP provider ID to Oracle Identity Federation. ■ returnIDParam: This is the name of the parameter to use to specify the chosen IdP provider ID in the request sent to Oracle Identity Federation. The page gets the value of these parameters, display a list of IdPs, and send a new request to Oracle Identity Federation specifying the chosen IdP Provider ID. Example The following is an example of an IdP discovery service page. This page allows the user to select an identity provider from the list of provider IDs: http:idp1.com, http:idp2.com, http:idp3.com, and submit the chosen provider ID to Oracle Identity Federation to continue the SSO flow. page buffer=5kb autoFlush=true session=false page language=java import=java.util., java.net. Set the Expires and Cache Control Headers response.setHeaderCache-Control, no-cache; response.setHeaderPragma, no-cache; response.setHeaderExpires, Thu, 29 Oct 1969 17:04:19 GMT; Set request and response type request.setCharacterEncodingUTF-8; response.setContentTypetexthtml; charset=UTF-8; String submitURL = request.getParameterreturn; String returnIDParam = request.getParameterreturnIDParam; List idps = new ArrayList; idps.addhttp:idp1.com; idps.addhttp:idp2.com; idps.addhttp:idp3.com; html See Also: Section 5.5, Configuring Service Providers Note: Check that the URL query parameter values are correctly URL-encoded.