Attribute Name Mapping Introduction to Attribute Mapping and Filtering

Configuring Oracle Identity Federation 5-57 For example: addFederationMapEntryInMaphttp:myhost.domain.com:7499fedsp, attributelist, cncommonName, datastore-attr, cn, string addFederationMapEntryInMaphttp:myhost.domain.com:7499fedsp, attributelist, cncommonName, assertion-attr, commonName, string addFederationMapEntryInMaphttp:myhost.domain.com:7499fedsp, attributelist, cncommonName, format-attr, , string addFederationMapEntryInMaphttp:myhost.domain.com:7499fedsp, attributelist, cncommonName, send-with-sso, true, boolean addFederationMapEntryInMaphttp:myhost.domain.com:7499fedsp, attributelist, cncommonName, from-session, false, boolean addFederationMapEntryInMaphttp:myhost.domain.com:7499fedsp, attributelist, cncommonName, from-config, true, boolean addFederationMapEntryInMaphttp:myhost.domain.com:7499fedsp, attributelist, cncommonName, attribute-value-fromconfig, cn=users,dc=oracle,dc=com, string Here is another example that includes the require-from-infocard property: addFederationMapEntryInMaphttp:myhost.domain.com:7499fedsp, attributelist, cncommonName, require-from-infocard, true, boolean ■ To remove a property and the corresponding map for the attribute: removeFederationMapEntryInMaphttp:myhost.domain.com:7499fedsp, attributelist,cncommonName,attribute-value-fromconfig removeFederationMapEntryInMaphttp:myhost.domain.com:7499fedsp, attributelist,cncommonName,from-config removeFederationMapInMaphttp:myhost.domain.com:7499fedsp, attributelist,cncommonName

5.9.1.2 Attribute Value Mapping

Attribute value mapping allows the administrator to specify the value that a local attribute should be assigned in a SAML message when sending or receiving messages. Attribute value mapping has these characteristics: ■ A value mapping consists of a combination, or duet, of a local value and the corresponding external value. ■ Value mappings can be defined for any local attributes. Multiple value mappings can be defined for each local attribute. ■ Different external values can be mapped to the same local value using value mappings. A default attribute is used to determine which external value will be used in outgoing mode. ■ Different local values can be mapped to the same external value by means of value mappings. A default attribute is used to determine which local value to use in incoming mode when mapping external values into local values. Oracle Identity Federation exercises attribute value mapping when acting as a: 5-58 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation ■ Attribute Authority ■ Attribute Requester ■ Identity Provider, when sending attributes in SSO assertions Attribute value mapping is configured through the Fusion Middleware Control Console. See Section 5.9.2.2, Configuring Attribute Value Mapping for details.

5.9.1.3 Attribute Value Filtering

Attribute value filtering allows the administrator to specify which local values are allowed when sending a SAML message. Attribute value filtering has these characteristics: ■ Filter rules can be defined for any local attributes. A filter rule evaluates each attribute value to determine if it can be sent. If the evaluation is positive, the value is sent; otherwise, it is removed from the list of attribute values to be sent. ■ Multiple filter rules can be defined for each local attribute. When sending a value, Oracle Identity Federation can be set up to either: – send only after all filters evaluate successfully – send if at least one filter evaluates successfully ■ The administrator defines a filtering rule by specifying the type of comparison, and the string value to compare see Section 5.9.2.3, Configuring Attribute Value Filtering . ■ Oracle Identity Federation supports these comparison types when comparing the attribute value to a string: – equals – not equals – starts with – ends with – contains – does not contain – equals null – not equals null ■ In addition to these comparison types, filtering supports regular expressions, allowing the user to match the attribute value against a regular expression. See Section 5.9.2.3.1, Filtering Conditions in Section 5.9.2.3, Configuring Attribute Value Filtering for details. ■ The filtering rules allow you to specify whether the comparison will be case-sensitive. Oracle Identity Federation exercises attribute value filtering when acting as a: ■ Attribute Authority ■ Identity Provider, when sending attributes in SSO assertions You configure this feature through the Fusion Middleware Control Console. See Section 5.9.2.3, Configuring Attribute Value Filtering for details. Configuring Oracle Identity Federation 5-59

5.9.2 Mapping and Filtering Configuration

This section explains how to configure mapping and filtering: ■ Configuring Attribute Name Mapping ■ Configuring Attribute Value Mapping