Implementation of cookieextract.jsp

12-14 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation Use the WLST commands to set these properties in the Oracle Identity Federation configuration. For example, the following commands, in the WLST script environment for the Oracle Identity Federation instance, configure a pre-processing plug-in to be invoked prior to the SSO flow: setConfigPropertyserverconfig, spcontext, rootcontext, string setConfigPropertyserverconfig, sppath, relativepath, string

12.4.3 Example of a Pre-processing Plug-in

This example shows a simple pre-processing plug-in, invoked by the out-of-the-box SP engines before the user is forwarded to Oracle Identity Federation to start the Federation SSO operation, to determine the IdP to be used for the Federation SSO operation. In this example, the local domain has two resources protected by Oracle Access Manager: ■ http:www.domain.comresource1, and the IdP to use must be idp1.com ■ http:www.domain.comresource2, and the IdP to use must be idp2.com

12.4.3.1 Setup

The Oracle Identity FederationSP server is integrated with Oracle Access Manager.

12.4.3.2 Packaging

The pre-processing plug-in consists of a Web application with a root context set to plugin, and contains one JSP page, fedidpeval.jsp, which evaluates the URL of the protected resource and determines which IdP to use.

12.4.3.3 Configuring Oracle Identity Federation

To configure the Oracle Access Manager SP engine to invoke the pre-processing plug-in before Oracle Identity Federation processing at the beginning of the federation SSO flow, take these steps: 1. Enter the WLST script environment for the Oracle Identity Federation instance. 2. Set the spcontext property containing the root context of the pre-processing plug-in page: setConfigPropertyserverconfig, spcontext, plugin, string 3. Set the sppath property containing the relative path of the pre-processing plug-in page: setConfigPropertyserverconfig, sppath, fedusercheck.jsp, string 4. Exit the WLST script environment. Implementation of fedusercheck.jsp Implementation of fedusercheck.jsp page buffer=5 autoFlush=true session=false page language=java import=java.util., javax.naming., javax.naming.directory., java.net. Custom Actions 12-15 response.setHeaderCache-Control, no-cache; response.setHeaderPragma, no-cache; response.setHeaderExpires, Thu, 29 Oct 1969 17:04:19 GMT; String returnURL = String request.getAttributeoracle.security.fed.sp.returnurl; String providerid = null; if returnURL = null returnURL.startsWithhttp:www.domain.comresource1 { providerid = idp1.com; } else if returnURL = null returnURL.startsWithhttp:www.domain.comresource2 { providerid = idp2.com; } if providerid = null request.setAttributeoracle.security.fed.sp.providerid, providerid; forward to OIF request.getSession.getServletContext.getContextfed.getRequestDispatcher spstartsso.forwardrequest, response;

12.5 Post-processing Custom Action for SP Engine

The post-processing plug-in is a module to which the user is directed, as part of a federated SSO operation. The plug-in enables custom actions to be taken after the operation is complete. When the plug-in is in use, Oracle Identity Federation does not redirect the user to the SP engine; rather, it forwards the user internally to the plug-in, passing it the data resulting from the SSO operation. After performing its custom actions, the plug-in forwards the user to the correct SP engine, along with the data originally provided by the federation server, to resume the authentication flow.

12.5.1 Implementing the Post-processing Plug-in

When Oracle Identity Federation redirects the user to the SP engine at the end of the federated SSO flow, it passes certain data to the engine as attributes on the HttpServletRequest object. The same data is made available to the post-processing plug-in. Here is the data passed to the plug-in: ■ Whether the SSO operation was successful Boolean, identified by oracle.security.fed.sp.authnresult ■ The identifier of the user String, identified by oracle.security.fed.sp.userid ■ Authentication time Date, identified by oracle.security.fed.sp.authntime ■ Expiration time of the authenticated session Date, identified by oracle.security.fed.sp.expirationtime ■ The authentication mechanism used to identify the user String, identified by oracle.security.fed.sp.authnmech