Additional Federation Data Store Configuration

6-32 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation Procedure Take these steps to set up a ShareID proxy:

1. At the Oracle WebLogic Server Administration Console, navigate to the

Deployments page.

2. Click Lock Edit.

3. Click Install.

4. Navigate to the location of the shareidupdate.ear file located in ORACLE_

HOMEfedinstall.

5. Click Next.

6. Select Install this deployment as an application and click Next.

7. Select the name of the managed server and click Next.

8. Select Advanced in the Security section.

9. Click Finish.

10. Click Apply Changes.

11. Returning to the Deployments page, find the new application called

shareidupdate Note: you may have to click Next if the application does not appear in the first 10 entries.

12. If the state of the shareidupdate application is not listed as Active select the

application and click Start, servicing all requests, and click yes. Now locate the shareidupdate application in the Deployments page; its state should be listed as Active. By default, the shareidupdate proxy uses the incoming protocol HTTP or HTTPS, server name, and server port as the protocol, server name, and server port to which messages should be redirected. Consider using non-default values when using a proxy server, for example. To set these values: ■ Find the shareidupdate web.xml file; it should be in a subfolder of: Note: For the SAML1x protocol, in release 10g it was possible to set the authentication response profile binding by setting the METHOD query parameter to the desired profile while sending the authentication request. This feature is not supported in 11g, and you must configure the IdP to send the authentication response using the desired profile binding. Note: If a proxy is configured as in Appendix B, Using Oracle HTTP Server as a Proxy for Oracle Identity Federation , you need to modify the oif.conf file to also divert shareid URLs to Oracle WebLogic Server. See Also: Getting Started with Oracle WebLogic Server Administration Console in the Oracle Fusion Middleware Administrators Guide. Additional Server Configuration 6-33 DOMAIN_HOMEserversSERVER_NAMEtmp_WL_usershareidupdate ■ Add the properties IsSecure, ServerName, andor ServerPort to the servlets being used. Note: IsSecure is set to true if desired protocol is HTTPS, false if the desired protocol is HTTP. ■ Save changes and restart the application. For example, the servlet element may now contains elements such as: init-param param-nameIsSecureparam-name param-valuetrueparam-value init-param init-param param-nameServerPortparam-name param-value7777param-value init-value

6.16 Mapping Users through Attributes and NameID in SP Mode

Oracle Identity Federation acting as an SP can locate a user based on the attributes and name identifier value stored in an assertion without using any federation records. When configured not to use the federated identity to map the assertion to a user record, Oracle Identity FederationSP uses the NameID and the attributes contained in the incoming assertion to map the user in the repository. Once the user record is located, Oracle Identity FederationSP creates an authenticated session for that user in the identity and access management framework and redirects the user to the final target URL. This flow does not use any federation records, so it is not necessary to have a federation data store configured to use Oracle Identity Federation as the service provider. If Oracle Identity Federation cannot locate the user during the flow, the default behavior is to return a 401 Unauthorized error to the user. You can configure Oracle Identity Federation to redirect the user to the authentication engine instead, so that custom corrective measures such as user account provisioning can be initiated. This behavior is implemented with the Error when User Mapping fails property; see Section 6.16.2, Configuring Oracle Identity Federation , under the procedure titled If the Mapping Fails. On returning to Oracle Identity Federation from the authentication engine, if the user still cannot be mapped, a final result of 401 is returned. Limitations Note these limitations: ■ Since Oracle Identity FederationSP does not store any federation records when configured to map the assertion without using federated identities, no account linking information is available in the Identity Federation section of Fusion Middleware Control. ■ Additionally, the Name Identifier Update and Federation Termination profiles will not complete; if the peer IdP sends a message for one of these profiles, Oracle Identity FederationSP will return an error message indicating that the federation record could not be found.