11g Server Signing Certificate

Deploying Oracle Identity Federation 3-33 ■ Keep the SAML 2.0 signing keycertificate as the signing keycertificate of the Oracle Identity Federation 11g server. To implement this, you will need to provide the new signing certificate to all SAML 1.xWS-Fed partners. 3-34 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation Part II Part II Administering Oracle Identity Federation This part contains administration topics for Oracle Identity Federation. Part II contains the following chapters: ■ Chapter 4, Server Administration ■ Chapter 5, Configuring Oracle Identity Federation ■ Chapter 6, Additional Server Configuration ■ Chapter 7, Diagnostics and Auditing ■ Chapter 8, Security ■ Chapter 9, Oracle Identity Federation Command-Line Tools 4 Server Administration 4-1 4 Server Administration This chapter describes tasks related to day-to-day administration of Oracle Identity Federation, and additional tasks that the administrator may need to perform on occasion. It contains these topics: ■ Basic Administration ■ Common Tasks ■ Managing Identity Federations ■ Configuring Identities ■ Managing Credentials for Oracle Identity Federation

4.1 Basic Administration

This section describes basic administration of Oracle Identity Federation. It contains these topics: ■ About the Oracle Identity Federation Server Administrator ■ Administering Oracle Identity Federation ■ Oracle Identity Federation Log Files ■ Backups

4.1.1 About the Oracle Identity Federation Server Administrator

The Oracle Identity Federation administrator performs two major tasks, which can be characterized as: ■ Basic runtime administration of the server, including starting, stopping, and monitoring the server ■ Federated identity administration, which involves user administration user creation, deletion, and federation, and maintaining information about trusted providers and the users affiliated with those providers This section contains these topics: ■ About Roles ■ Deployment Planning ■ Other Planning Tasks Note: Liberty 1.x support is deprecated. 4-2 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation

4.1.1.1 About Roles

Oracle WebLogic Server defines certain global roles in the security realm that it installs, including: ■ Admin includes the Administrators group by default ■ Operator includes the Operators group by default ■ Monitor includes the Monitors group by default The domain administrator can create the FederationAdmin role to grant Oracle Identity Federation administrator access to non-AdminOperatorMonitor users.

4.1.1.2 Deployment Planning

When deploying Oracle Identity Federation in a network of trusted sources and destinations, you will need to exchange information with other site administrators, and configure identity providers and service providers accordingly. Exchange User Identities In a federated environment, at the simplest level the service provider acts as a consumer of identity information, while the identity provider where the user request originated acts as the supplier of identity information. The identity provider may, in turn, adopt a consumer role as it communicates with an authentication and authorization mechanism an AAA system to obtain the necessary credentials. Service providers may also want to map users to identities at the destination, although this is not a requirement. Identity suppliers and consumers must be able to achieve a runtime exchange of data, which results in the source asserting some identity information about the principal which the destination can trust as a means of uniquely identifying the principal. As an identity provider, you may wish to work with partner site administrators to provide the relevant lists of users from your domain. This is an optional information exchange. Establish Cross-Domain Trust Oracle Identity Federation can produce and consume provider metadata that conforms to the Liberty metadata specifications and to the SAML 2.0 metadata See Also: Users, Groups, And Security Roles in Oracle Fusion Middleware Securing Resources Using Roles and Policies for Oracle WebLogic Server. Note: The FederationAdmin role is recognized only by WLST commands and other JMX MBean clients, not by Fusion Middleware Control. This means that users with the FederationAdmin role will only be able to configure Oracle Identity Federation through WLST or other JMX clients, not through Fusion Middleware Control. See Also: ■ Chapter 5, Configuring Oracle Identity Federation for details about server properties ■ Section 4.3, Managing Identity Federations for details about trusted provider information Server Administration 4-3 specifications. Additionally, Oracle Identity Federation supports the ability to import provider metadata that uses the metadata extensions for SAML 2.0 query requesters. You will need to establish cross-domain trust by setting up authentication and exchanging keys or certificates among the network of trusted sources and destinations. For initial setup and testing, identity providers and service providers can both use default self-signed certificates. When going into production, however, consider the usage type when deciding whether self-signed certificates are sufficient: CA-issued certificates are most useful when there is no prior trust relation between entities, for example, when you use SSL to access a Web site over the Internet. But given that the trust relationship between federation peers requires the exchange of metadata or the equivalent, which can and usually does include the peer certificates, self-signed certificates should be sufficient for production deployment so long as you can trust how you obtained the peer certificates. Note that CA-issued certificates might be used in the metadata exchange, for example signed e-mail or a download from a web server over SSL. The process of setting up cross-domain trust can be simplified by the use of metadata. Oracle Identity Federation enables you to store provider-specific metadata which overrides global IdP and SP settings with data specific to communication with each peer provider. PKI and SSL Encryption Oracle Identity Federation provides secure communication using X.509 certificate authentication. Oracle Identity Federation provides encryption for data integrity using public key cryptography, a technique that uses a public and private key pair. Data is signed with a sending party’s private key and the signature is verified by the recipient using the sender’s public key. Oracle Identity Federation uses documents known as certificate s to enable peer providers to establish trust. A Certificate Authority CA issues a certificate to vouch for a user’s identity, including the party’s public key in the certificate for use by the receiving party. You configure key pairs and certificates using a local keystore. The identity provider configures a public and private key pair and a certificate - providing validation of the public key from a Certificate Authority CA - when using the POST profile. The presentation of the public key by the IdP, and certificate import by the SP, are critical aspects in managing the trust relationship between partners. You can also implement SSL connections. For details on how to configure SSL connections and client certificates, see Section 8.1, Configuring SSL for Oracle Identity Federation .

4.1.1.3 Other Planning Tasks

Besides exchanging identities and securing communications involving those identities, parties that plan to engage in a federated network must agree on a range of additional topics, such as: ■ federation protocols ■ services Note: SSL functionality is external to Oracle Identity Federation.