SP Integration Module - Custom

6 Additional Server Configuration 6-1 6 Additional Server Configuration This chapter contains additional topics pertaining to Oracle Identity Federation server configuration and management. These topics include: ■ Setting up Single Sign-On Services ■ Working with Affiliations ■ Additional LDAP Configuration ■ Additional Configuration for High Availability ■ Additional RDBMS Configuration ■ Session Repository Configuration ■ Additional HTTP Configuration ■ Additional Protocol Configuration ■ Protecting the SOAP Endpoint ■ Configuring the SAML 2.0 IdP Discovery Common Domain Cookie Profile ■ Configuring the Identity Provider Discovery Service ■ Setting up Infocard ■ Additional Run-time Configuration ■ Additional Federation Data Store Configuration ■ Setting up Backwards Compatibility for Oracle Identity Federation 10g and ShareID service URLs ■ Mapping Users through Attributes and NameID in SP Mode ■ Automatic Account Linking Based on Attribute Query Mapping ■ User Opt-In and Opt-Out for Single Sign-On ■ Bypassing User Mapping During Assertion Processing ■ Overriding NameID Mapping Per Partner ■ Configuring Audience Restrictions for Assertions ■ Certificate Path Validation 6-2 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation

6.1 Setting up Single Sign-On Services

There are several ways to perform a federated single sign-on SSO operation, depending on the back-end in use and where the flow is initialized. Table 6–1 shows the possible combinations: This section explains how to configure the different combinations: ■ Oracle Single Sign-On ■ Oracle Access Manager ■ SP-initiated SSO ■ IdP-initiated SSO

6.1.1 Oracle Single Sign-On

Oracle Single Sign-On can be configured to trigger an SSO operation when requesting a resource protected by mod_osso. To achieve this, the Oracle Single Sign-On partner application must be defined and must be protected by mod_osso. The partner application must also be configured to use the SSO Security level associated with the SASSO Authentication plug-in. You do this by editing the ORACLE_HOMEssoconfpolicy.properties file of the Oracle Single Sign-On deployment, and setting the partner application defined by its hostname and port to the same security level as the SASSOAuthLevel property. For example: MediumHighSecurity_AuthPlugin = oracle.security.sso.server.auth.SASSOAuth MediumSecurity_AuthPlugin = oracle.security.sso.server.auth.SSOServerAuth ... www.app.com\:7890 = MediumHighSecurity ... SASSOAuthnUrl= http\:oif-hostname\:oif-portfedusersposso SASSOLogoutUrl = http\:oif-hostname\:oif-portfeduserspsloosso SASSOAuthLevel = MediumHighSecurity Save the file and restart the Oracle Single Sign-On server to apply the changes. The next time a user attempts an unauthenticated access to the protected resource, the user is redirected to Oracle Identity Federation where an SSO operation occurs. Table 6–1 Federated Single Sign-On Combinations Combination Flow Oracle Single Sign-On User accesses a resource protected by mod_osso, triggering single sign-on, with Oracle Identity Federation acting as SP. Oracle Access Manager User accesses a resource protected by webgate, triggering single sign-on, with Oracle Identity Federation acting as SP. SP-initiated single sign-on User initiates single sign-on by directly accessing an Oracle Identity Federation URL, with Oracle Identity Federation acting as SP. IdP-initiated single sign-on User initiates a single sign-on by directly accessing an Oracle Identity Federation URL, with Oracle Identity Federation acting as IdP. Additional Server Configuration 6-3 URL Query Parameters When requesting the protected resource, it is possible to specify URL query parameters that Oracle Identity Federation can use to perform the SSO operation. The parameters are: ■ providerid - This is the identifier of the identity provider to use to perform the SSO operation optional. If missing, the default SSO provider, set in Fusion Middleware Control by navigating to Service Provider, then Common, then Default SSO Identity Provider , is used. ■ federationid - This is the identifier of the affiliation to use for the SSO optional. An example of such a URL is: http:protected_app:portpath?providerid=http3A2F2Fidp.com Check that the URL query parameter values are correctly URL-encoded. Refer to the Oracle Single Sign-On documentation for details about SSO configuration.

6.1.2 Oracle Access Manager

Oracle Access policies can be set up to initiate an SSO operation when the user requests a resource protected by the Oracle Access Manager WebGate agent. To do this, use the Oracle Access Policy Manager to set up a policy domain or policy that protects the resource. When creating the authentication rule for the policy domain or policy, select the Fed SSO authentication scheme. Oracle Identity Federation automatically creates this authentication scheme when it is configured to use Oracle Access. The scheme initiates the single sign-on operation when the resource is accessed, resulting in a session for the local user associated with the federated user. Set up the authorization rules and expression for the policy domain or policy to allow access for the resulting local user. URL Query Parameters When requesting the protected resource, it is possible to specify URL query parameters that Oracle Identity Federation can use to perform the SSO operation. The parameters are: ■ providerid - This is the identifier of the identity provider to use to perform the SSO operation optional. If missing, the default SSO provider, set in Fusion Middleware Control by navigating to Service Provider , then Common, then Default SSO identity provider , is used. ■ federationid - This is the identifier of the affiliation to use for the SSO optional. An example of such a URL is: http:protected_app:portpath?providerid=http3A2F2Fidp.com Check that the URL query parameter values are correctly URL-encoded. Refer to the Oracle Access Manager Identity and Common Administration Guide for details about SSO configuration. See Also: Section 6.2, Working with Affiliations for more information See Also: Section 6.2, Working with Affiliations for more information 6-4 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation

6.1.3 SP-initiated SSO

When Oracle Identity Federation server is acting as a service provider, a user can initiate an SSO operation by directly requesting a service at the Oracle Identity FederationSP instance. The URL to be requested on Oracle Identity Federation is: https:OIF_host:OIF_portfedspinitiatesso URL Query Parameters It is possible to specify URL query parameters when requesting the URL: ■ providerid - This is the identifier of the identity provider to use to perform the SSO operation optional. If missing, the default SSO provider, set in Fusion Middleware Control by navigating to Service Provider, then Common, then Default SSO Identity Provider , is used. ■ federationid - This is the identifier of the affiliation to use for SSO optional. ■ returnurl - This is the URL to which the user is sent after a successful SSO operation. It is required if the Unsolicited Relay State property, set in Fusion Middleware Control by navigating to Federations, then Service Providers Common , is empty. An example of such a URL is: http:oif_host:oif_ portfedspinitiatesso?providerid=http3A2F2Fidp.comreturnurl=http3A2FFProt ectedAppHost2FProtectedAppPath Check that the query parameter values are correctly URL-encoded.

6.1.4 IdP-initiated SSO

Oracle Identity Federation provides the ability to initiate an SSO operation by directly requesting a URL at the Oracle Identity Federation instance acting as an IdP; this is called an SSO IdP-initiated operation. The url to be requested on Oracle Identity Federation is of the form: https:oif_host:oif_portfedidpinitiatesso URL Query Parameters It is possible to specify query parameters when requesting that URL: ■ providerid - This is the identifier of the service provider to use to perform the SSO operation optional. ■ federationid - This is the identifier of the affiliation to use for the SSO optional. ■ returnurl - This is the URL to which the user is sent after a successful SSO operation optional. See Also: Section 6.2, Working with Affiliations for more information See Also: Section 6.2, Working with Affiliations for more information