Task1-Configuring OIF11GR1 to OUD as DataStore
Task2-Verify Identity Provider
Task3-Export OIF 11gR1 IDP identity metadata
Task4-Configuring OAM and importing the IDP metadata
Task5-Import OAM11gR2 SAML2.0 Metadata(SP) into OIF11gR1
Task6-Configure Default Authentication Engine As LDAPDirectory
Task7-Configuring Federation DataStore (To Store Federated Records)
Task8-Configuring OIF AuthScheme To A Resource
Task9-Test Federation
Task10-Configuring LDAP Authrization in OAM (Part 1)
Task11-Configuring SAML attributes from IDP to back-end application as custom header attributes (Part 2)
Task12-Configuring the Responses to Send SAML Attributes to myBank Application As Headers (Part 3)
Task13-Verify LDAP Authorization And Header Responses
Task1-Configuring OIF11GR1 to OUD as DataStore
Use webgate11g_1 Application Domain
http://oam.example.com:8001/em (EM Console of OIF)
Go to Farm_IDMDomain -> Identity and Access -> OIF (11.1.1.2.0)
Oracle Identity Federation -> Administration -> Data Stores
Edit User Data Store
Repository Type = LDAP Directory
Connection URL(s)
ldap://oam.example.com:1389
Bind DN
cn=Directory Manager
Password
Oracle123
User ID Attribute
uid
User Description Attribute
uid
Person Object Class
inetorgperson
Base DN
ou=people,dc=example,dc=com
Test LDAP Connection
Task2-Verify Identity Provider
Right Side -> Oracle Identity Federation -> Administration -> Identity Provider
Click SAML 2.0 tab
Assertion Subject NameID format is defaulted to email address with the User Attribute mapping in the user store being mail
Send Encrypted Attributes = uncheck
Send Encrypted NameIDs = uncheck
Send Encrypted Assertions = uncheck
Send Signed Assertion = check
Enable SAML 2.0 Protocol = check
Enable Single Sign-On Protocol = check
Enable NameID Management Protocol: Register = check
Enable NameID Management Protocol: Terminate = check
Enable Attribute Query Responder = uncheck
Enable Authentication Query Responder = uncheck
Enable Assertion ID Responder = uncheck
Enable Protocol Bindings = SSO - Artifact;SSO - HTTP POST;SSO - HTTP POST
Default Binding = HTTP Redirect
Default SSO Response Binding = Artifact
Message Section
Request - SOAP = Send Signed = check
Response - HTTP Redirect = Send Signed = check
Response - HTTP POST = Send Signed = check
Response - SOAP = Send Signed = check
Request - HTTP POST = Send Signed = check
Response with Assertion - SOAP = Send Signed = uncheck
Request - HTTP Redirect = Send Signed = uncheck
Response with Assertion - HTTP POST = Send Signed = uncheck
AuthnRequest = n/a
Task3-Export OIF 11gR1 IDP identity metadata
Go to -> Oracle Identity Federation -> Administration -> Security and Trust
Click Provider Metadata
Provider Type : Identity Provider
Protocol : SAML 2.0
Click Generate
Choose Save
Task4-Configuring OAM and importing the IDP metadata
Go to :7001/oamconsole
System Configuration -> Available Services
Enable "Identity Federation"
"Security Token Service"
"Mobile and Social"
Now on the left , Go to Identity Federation -> Identity Providers
New Identity Provider
Browse and Import the OIF IDP Metadata file just generated
Name : OIF_IDP
Protocol : SAML 2.0
Metadata File
Map assertion Name ID to User ID Store attribute = mail
User Mapping : OUD_UserStore
User Search Base DN : ou=people,dc=example,dc=com
Provider ID : http://oam:7499/idp
Signing Certificate Subject : CN=oam Signing Certificate
Enable Identity Partner : check
Default Identity Partner : check
Enable global logout : check
HTTP POST preferred binding : check
Authentication Request NameID Format : Email Address
Now Go to Left hand Side -> Federation Settings -> Export SAML 2.0 Metadata
Provider Id: https://oam:14101/oam/fed
Signing Key: osts_signing
Encryption Key: osts_encryption
Export SAML 2.0 Metadata
Choose Save and Ok
Task5-Import OAM11gR2 SAML2.0 Metadata(SP) into OIF11gR1
Go to OIF Em Console
LEFT => Identity and Access -> OIF (11.1.1.2.0)
RIGHT => Oracle Identity Federation -> Administration Federations
Click Add
check Enable Provider
Load Metadata -> Browse File and upload
Select Record and click Edit
Click "Oracle Identity Federation Settings"
check "Enable Attributes in Single Sign-On (SSO)"
check "Email Address"
Choose Apply
Task6-Configure Default Authentication Engine As LDAPDirectory
Go to Oracle Identity Federation -> Administration -> Authentication Engines
Click LDAP Directory
Connection URL(s)
ldap://oam.example.com:1389
Bind DN
cn=Directory Manager
Password
Oracle123
Confirm Password
Oracle123
User Credential ID Attribute
uid
User Unique ID Attribute
uid
Person Object Class
inetorgperson
Base DN
ou=people,dc=example,dc=com
Enable Authentication Engine
Test LDAP Connection
Click Apply
Task7-Configuring Federation DataStore (To Store Federated Records)
Go to Oracle Identity Federation -> Administration -> Data Stores
Change Federation Data Store -> Change Repository Data Store from "None" to "XML File"
Now go to Administration -> Identities
Go to "Local Users"
Search (click)
Task8-Configuring OIF AuthScheme To A Resource
Go to /oamconsole
Identity Federation -> Identity Providers -> OIF_IDP
Click "Create Authentication Scheme and Module"
A new OIF Plugin and an OIF Scheme is created prefixed with the name of the provider OIF_IDP you had created initially
OIF_IDPFederationPlugin
OIF_IDPFederationScheme
Go to Authentication Modules -> Custom Authentication Modules -> OIF_IDPFederationPlugin
Steps
1. FedAuthnRequestPlugin
2. AssertionProcessing
Steps Orchestration
Initial Step = FedAuthnRequestPlugin
FedAuthnRequestPlugin -> success(on Success), AssertionProcessing (on Failure), failure (on Error)
AssertionProcessing -> success (on Success), failure (on Failure), On Error (failure)
Go to Policy Configuration -> Application Domains -> webgate11g_1 -> Authentication Policies -> Protected Resource Policy -> Change Authentication Scheme from LDAPScheme to OIF_IDPFederationScheme
Task9-Test Federation
edit mod_wl_ohs.conf
proxy /mybank
Try to access http://oam.example.com:7777/mybank
You will be redirected to the OIF login page
Use the OUD User user.0
Once successful authentication , mybank home page is displayed confirming the OIF Authentication
Go to Oracle Identity Federation -> Administration -> Identities
Click Federated Identities
Search
you will see user.0 who just tried
Task10-Configuring LDAP Authrization in OAM (Part 1)
/mybank/testheaders.jsp and set an authorization policies that allow only customers can access this URL
Go to Application Domain -> webgate11g_1 ->
Resources -> New Resource
Type : HTTP
Host Identifier : webgate11g_1
Resource URL : /mybank/testheaders.jsp
Query : Name Value list
Operations : ALL,CONNECT,OPTIONS,PUT,POST,GET
Protection Level : Protected
Click Apply
Go to Authorization Policies
Click "Create Authorization Policy"
Name : CustomersOnly
Resources : /mybank/testheaders.jsp
Conditions click +
Name : myBankCustomers
Type : Identity
On the bottom
Click + and Add Users and Groups
Search Store Name : OUD_UserStore
Entity Type : Group
Entity Name : Customers(Group Name)
Click Save
Now come to Rules tab
Allow Rule
Select the myBankCustomers (Identity) [Condition just created in last step]
Click Apply
Task11-Configuring SAML attributes from IDP to back-end application as custom header attributes (Part 2)
Go to OIF EM Console
Oracle Identity Federation -> Administration -> Federations
Select Provider ID record and click Edit
Click Edit "Attribute Mappings and Filters"
Name Mappings -> Add +
User Attribute Name : mail
Assertion Attribute Name : EmailAddress
Format or Namespace = blank
Send with SSO Assertion = check
Get Value from User Session = uncheck
Require from Infocard = uncheck
Name Mappings -> Add +
User Attribute Name : cn
Assertion Attribute Name : FullName
Format or Namespace = blank
Send with SSO Assertion = check
Get Value from User Session = uncheck
Require from Infocard = uncheck
Click Apply
Task12-Configuring the Responses to Send SAML Attributes to myBank Application As Headers (Part 3)
Go to the Authorization Policy -> CustomersOnly and
go to "Responses" tab
Click + add icon
Add Response
Type = Header
Name = EmailAddress
Value = $session.attr.fed.attr.EmailAddress
Click + add icon
Add Response
Type = Header
Name = FullName
Value = $session.attr.fed.attr.FullName
Click Apply
Task13-Verify LDAP Authorization And Header Responses
Take a user who belongs to the customer group
Any user who does not belong to customer group will be denied access to /mybank/testheaders.jsp
Access "http://oam.example.com:7777/mybank/testheaders.jsp"
Test a user who is not a customer member and see denied access
Now try with a user who is a member of customer group and see the testheaders.jsp page
Request Headers
FullName = FullNameOfTheTestUser
EmailAddress = EmailAddressOfTheTestUser
