Configuring the HTTP Header Authentication Engine

Configuring Oracle Identity Federation 5-91 1. Oracle Identity Federation determines that the user needs to be authenticated, and invokes an authentication engine to challenge and identify the user. 2. The user provides some credentials or information by submitting data to the authentication engine URL for example, username and password POST to the LDAP authentication engine credential processing URL. 3. After the user data is validated, the engine internally forwards the user back to Oracle Identity Federation. 4. The HTTP Header Attributes module analyzes the HTTP request submitted to the authentication engine the module has access to it because of the internal forward operation. It extracts the required HTTP headers andor cookie values from this request. 5. Oracle Identity Federation saves the extracted data as session attributes. 6. If configured to do so, during assertion creation Oracle Identity FederationIdP uses the session attributes to populate the NameID or attribute elements.

5.15.2 Authentication Engines - Oracle Single Sign-On

The tab contains these fields: ■ Default Authentication Engine - This is the engine used for authentications. The list-box contains all the currently enabled engines; selecting an engine from the list makes it the default engine. ■ Enable Authentication Engine - Check this box to enable the engine, and uncheck the box to disable the engine. If enabled, this engine appears on the list of available engines in the list-box associated with Default Authentication Engine. ■ User Unique ID Attribute - This is the attribute Oracle Identity Federation uses to identify the user. ■ Logout URL - This is the Oracle Single Sign-On server URL to present at logout. Notes: ■ For every user, this attribute value must equal the attribute value specified for Unique ID Attribute in the User Data Store configuration. For example, if the attribute configured here is mail, and the attribute configured as Unique ID Attribute in the user data store configuration is EmailAddress, then the value of mail in the authentication engine back-end must equal the value of EmailAddress in the user data store. ■ The attribute value you configure here must be unique across all users. 5-92 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation ■ Logout Enabled - Check this box to indicate that Oracle Identity Federation will redirect the user to the Oracle SSO Logout URL when the Oracle Identity Federation logout flow is performed. The logout URL needs to be the Oracle SSO Logout URL: https:sso-host:sso-portssologout Updates you make on this tab are saved if you move to tabs for other authentication engines. When you are done, click Apply to save the changes, or Revert to reset the data to its previous state.

5.15.3 Authentication Engines - Oracle Access Manager

The tab contains these fields: ■ Default Authentication Engine - This is the engine used for authentications. The list-box contains all the currently enabled engines; selecting an engine from the list makes it the default engine. ■ Enable Authentication Engine - Check this box to enable the engine, and uncheck the box to disable the engine. If enabled, this engine appears on the list of available engines in the list-box associated with Default Authentication Engine. ■ User Unique ID Header - When Oracle Identity Federation uses Oracle Access Manager as an authentication engine, WebGate is integrated with Oracle HTTP ServerOracle Identity Federation and protects an Oracle Identity Federation URL. The policy domain for the Oracle Identity Federation URL is configured so that it will provide the user identifier as an HTTP header. Use this field to specify the name of the HTTP header containing the user identifier provided by WebGate. ■ Logout Enabled - Check this box to enable logouts with this engine. When enabling logouts, related fields include: – Clear Cookie - If checked, resetting the Oracle Access Manager cookie is sufficient for Oracle Identity Federation to log the user out of the Oracle Access Manager domain. – Cookie Domain - Cookie domain that Oracle Identity Federation will set when creating the Oracle Access Manager cookie. – Redirect to Logout URL - Check this box and fill in the URL if Oracle Identity Federation needs to redirect the user to a specific URL for Oracle Access Manager logout. – Logout URL - This is the URL to present at logout.