Implementing the Pre-processing Plug-in

Custom Actions 12-15 response.setHeaderCache-Control, no-cache; response.setHeaderPragma, no-cache; response.setHeaderExpires, Thu, 29 Oct 1969 17:04:19 GMT; String returnURL = String request.getAttributeoracle.security.fed.sp.returnurl; String providerid = null; if returnURL = null returnURL.startsWithhttp:www.domain.comresource1 { providerid = idp1.com; } else if returnURL = null returnURL.startsWithhttp:www.domain.comresource2 { providerid = idp2.com; } if providerid = null request.setAttributeoracle.security.fed.sp.providerid, providerid; forward to OIF request.getSession.getServletContext.getContextfed.getRequestDispatcher spstartsso.forwardrequest, response;

12.5 Post-processing Custom Action for SP Engine

The post-processing plug-in is a module to which the user is directed, as part of a federated SSO operation. The plug-in enables custom actions to be taken after the operation is complete. When the plug-in is in use, Oracle Identity Federation does not redirect the user to the SP engine; rather, it forwards the user internally to the plug-in, passing it the data resulting from the SSO operation. After performing its custom actions, the plug-in forwards the user to the correct SP engine, along with the data originally provided by the federation server, to resume the authentication flow.

12.5.1 Implementing the Post-processing Plug-in

When Oracle Identity Federation redirects the user to the SP engine at the end of the federated SSO flow, it passes certain data to the engine as attributes on the HttpServletRequest object. The same data is made available to the post-processing plug-in. Here is the data passed to the plug-in: ■ Whether the SSO operation was successful Boolean, identified by oracle.security.fed.sp.authnresult ■ The identifier of the user String, identified by oracle.security.fed.sp.userid ■ Authentication time Date, identified by oracle.security.fed.sp.authntime ■ Expiration time of the authenticated session Date, identified by oracle.security.fed.sp.expirationtime ■ The authentication mechanism used to identify the user String, identified by oracle.security.fed.sp.authnmech 12-16 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation ■ The relay state String, identified by oracle.security.fed.sp.relaystate ■ The protected resource the user was trying to access, when the SP engine is an out-of-the-box SP engine Oracle Access Manager, Oracle Single Sign-On, or test SP engine; identified by oracle.security.fed.sp.returnurl. ■ The contents of the assertion consisting of the NameID the assertion issuer and the optional attributes. The assertion content is not passed as XML data, that is, the original assertion is not passed back to the module; rather, the data is passed as a map with strings as keys and a set of objects as values identified by oracle.security.fed.sp.attributes. The extra data is referenced as: – orafed-nameid-value – the Name ID value – orafed-nameid-qualifier – the Name ID qualifier – orafed-nameid-format – the Name ID format – orafed-providerid – the ProviderID – orafed-assertionid - the ID of the assertion – orafed-xmlmessage - the optional XML message containing the assertion ■ The top status of the SAML response String, identified by oracle.security.fed.sp.topstatus ■ The low status of the SAML response if any, String, identified by oracle.security.fed.sp.lowstatus ■ The status message if any String, identified by oracle.security.fed.sp.statusmessage ■ The ProviderID that created the SSO assertion String, identified by oracle.security.fed.sp.providerid ■ The identifier of the SP engine to process this information identified by oracle.security.fed.sp.engineid ■ The Oracle Identity Federation identifier of the user session. String, identified by oracle.security.fed.sessionid Oracle Identity Federation passes the sessionID of the user session to the SP engine so it can persist the state linked to the user, and can reference the data using the sessionID value. Later, when the logout flow is executed, Oracle Identity Federation passes the sessionID being logged out to the engine, so that the engine can delete the data used for this user session. See Also : Section 6.13.2, Providing XML Message to SP Engine after SSO Completes for details. Notes: ■ The plug-in must provide the SP engine with the data that was passed to it as part of the SP federated SSO flow; this consists of attributes that were set on the HttpServletRequest object. ■ The plug-in can modify all attributes that were set on the HttpServletRequest object except the oracle.security.fed.sp.engineid attribute.