3 Installing Oracle Identity Federation

3.7.1.1 Testing Federated Single Sign-On

Take these steps to test your federated single sign-on setup:

1. Use a web browser to access a protected resource. When prompted by the Identity Provider, log in using credentials in the IdP's domain. When prompted by the Service Provider, log in using credentials in the SP's domain. You should now be redirected to the protected resource.

2. Log out, and then try to access the protected resource again. You should be prompted for login only by the Identity Provider.

3.7.2.1 Install OracleAS Infrastructure

This section explains how to install OracleAS Infrastructure.

1. Launch Oracle Universal Installer, and select the Oracle Application Server Infrastructure 10g installation option.

2. Select Identity Management and Metadata Repository.

3. Use the default configuration options.

4. After installation is completed, establish database connection.

   • Run the coraenv script to set the proper values of the ORACLE_SID and ORACLE_HOME variables.

   • Connect to the database:

     sqlplus '/ as sysdba'

5. Run the following SQL commands:

   create tablespace ts_fd
      logging
      datafile '/scratch/aswu/Oracle/i0120/oradata/i0120/ts_fd01.dbf' 
         size 512m autoextend off,
      '/scratch/aswu/Oracle/i0120/oradata/i0120/ts_fd02.dbf' 
         size 512m autoextend off
      extent management local;
    
   

   create user fd identified by fd default tablespace ts_fd;
   grant connect,resource to fd;
   alter user fd account unlock;
   
   

3.7.2.2 Install Oracle Access Manager

Several Oracle Access Manager components must be installed for use with Oracle Identity Federation:

• Identity Server

• WebPass installed in a Web server

• Access Server

• Oracle Access Manager (administration UI) installed on the same Web server as WebPass

• if the Oracle Identity Federation or Oracle Access Manager site is a service provider (SP), WebGate agents installed on each Web server providing resources or services that are available to federated users

Refer to the Oracle Access Manager Installation Guide for details.

Considerations for Oracle Access Manager Installation

When installing and deploying Oracle Access Manager, pay special attention to issues critical for integration with Oracle Identity Federation:

• When configuring the Access Server entry in the Access Manager console, set Access Management Service to On.

  
  

  Note: By default, Access Management Service is set to Off. Oracle Identity Federation requires that this field be set to On.

  
  

  See the Oracle Access Manager Access Administration Guide for details.

• When enabling default policies, it is highly recommended that you set up the Oracle Access and Identity Basic Over LDAP authentication scheme (previously known as the NetPoint Basic Over LDAP authentication scheme). If this is not done, you will need to configure a basic scheme manually.

  See the Oracle Access Manager Access Administration Guide for details.

• As mentioned earlier, WebGate agents must be installed on each Web server providing resources or services available to federated users if the Oracle Identity Federation or Oracle Access Manager site is a service provider (SP). Note the following when configuring Webgates:

  • The Access Management Service setting must match the setting for the Access Server(s) used by the WebGate. So, if the WebGate uses the same Access Server(s) as Oracle Identity Federation will use, then it must be configured with the Access Management Service set to On. It is also possible for a WebGate to use a different Access Server instance(s) (in the same domain) with the Access Management Service set to Off, in which case the Web setting would be Off as well.

  • It is normal practice to set the Primary HTTP Cookie Domain to enable Oracle Access Manager single sign-on across web servers with installed WebGates. At a minimum, the cookie domain must include the Oracle Identity Federation host and at least one WebGate-protected web server. For example, if Oracle Identity Federation is on the host oif.us.company.com and the Web server is www.us.company.com, the domain setting should be.us.company.com or .company.com. If the Web server is www.company.com, the domain setting should be .company.com. Note: The default AccessGate setting for the cookie domain is empty (no domain), which will only work in a very atypical deployment where Oracle Identity Federation and all protected resources reside on the same host.

3.7.2.3 Install Oracle Identity Federation

This section explains how to install Oracle Identity Federation for use with Oracle Access Manager. This is a brief summary of the necessary steps. For details, see "Advanced Installation Procedure".

1. Launch Oracle Universal Installer, and select the Oracle Identity Federation 10g installation option.

2. Select the Advanced installation method.

3. In Select Configuration Options, select Federation Data in LDAP Server and Federation Transient Data in Database.

4. In Specify Federation Data Store, provide this information:

   • Server Type - Oracle Internet Directory

   • Host/Port - the LDAP server host and port

   • Bind DN - cn=orcladmin

5. In Specify Federation Transient Data Store, provide this information:

   • Username

   • Password

   • Host, Port and Service Name - the database for transient data

3.7.2.4 Integrate Oracle Identity Federation and Oracle Access Manager

This section explains how to integrate Oracle Identity Federation and Oracle Access Manager. This includes certain steps in both environments, such as configuring an AccessGate for Oracle Identity Federation (in Oracle Access Manager) and setting data store and other configuration parameters (in Oracle Identity Federation).

1. Use the Access System Console http://AMhost:AMport/access/oblix (where AMhost:AMport is the web server where you installed WebPass and Access Manager) to configure an AccessGate for Oracle Identity Federation.

   1. Select the Access System Configuration tab.

   2. Select the Add New AccessGate link from the console panel.

   3. Configure the AccessGate as follows, replacing the values in italics with your own values:

      AccessGate Name: OIF
      Password: OIF-PASSWORD
      Hostname: OIF-HOST
      Port: OIF-PORT
      Transport Security: Match the Access Servers to be configured in Step d. 
      Access Management Service: On 
      Primary HTTP Cookie Domain: .company.com (Note: As noted in the WebGate configuration, the Primary HTTP Cookie Domain configured for Oracle Identity Federation must match the Primary HTTP Cookie Domains configured for the WebGates protecting the content to be accessed by federated users.)
      Preferred HTTP Host: OIF-HOST
      
      

      Click Save.

   4. Click List Access Server.

      Click Add.

      Select one or more servers from drop-down menu. Note: All selected Access Servers must have Access Management Service On.

      Number of connections: 1
      

      Click Add.

2. Use the Access System Console to configure the Fed HostID, if required.

   1. Select the Access System Configuration tab.

   2. Select the Host Identifiers link from the console panel.

   3. If no host identifiers are defined, you do not need the Fed HostID. Skip to Step 3.

   4. If host identifiers are defined, click the Add button.

      Name: Fed HostID
      

      Note: Enter the same fixed value for all supported languages.

      Hostname variables: OIF-HOST:OIF-PORT
      

      Note: If OIF-PORT is 80 or 443, also include OIF-HOST.

      Click Save.

3. Install the Access Server SDK:

   1. Run the AccessServerSDK installer (for example, Oracle_Access_Manager10_1_4_0_1_linux_AccessServerSDK) under OIF_HOME/fed/shareid/.

   2. If installing on Linux, set the LD_ASSUME_KERNEL environment variable.

      Open the Enterprise Manager console for the Oracle Identity Federation installation in a web browser. For example:

      http://oif.example.org:1810/emd/console

      Perform these steps:

      - Under System Components, click the link for OC4J_FED.

      - Go to Administration - > Server Properties and, under Environment Variables, click Add Environment Variable.

      - In the new entry, enter LD_ASSUME_KERNEL in the Name field, and enter 2.4.19 in the Value field. Leave the Append checkbox unchecked.

      - Click Apply.

      - Click OK to restart the OC4J_FED container.

4. Go to the Oracle Identity Federation administration console at http://OIF-HOST:OIF-PORT/oifadmin. Click on the IdM Data Stores tab.

   
   

   Note: Substitute parameter values (bind DN, password, DNs, and so on) as required for your directory.

   
   

   For the federation data store:

   Bind DN: cn=orcladmin
   Password: your-password
   User Federation Record Context: cn=fed,dc=us,dc=oracle,dc=com
   
   

   For the user data store:

   Active Repository: Oracle Access Manager
   Connection URL(s):  ldap://LDAP-Server-Host:Port
   Bind DN: cn=orcladmin
   Password: your-password
   User ID Attribute: uid
   User Description Attribute: uid
   Person Object Class: inetOrgPerson
   Base DN: dc=us,dc=oracle,dc=com
   
   

   For Oracle Access Manager configuration parameters:

   Master Admin Login ID: orcladmin
   Master Admin Password: your-password
   Authorization result for unprotected resources: Allow
   Oracle Access Manager Cookie Domain: .company.com 
   Basic Authentication Scheme Name: Oracle Access and Identity authentication scheme
   
   

   
   

   Note: Oracle Access Manager Cookie Domain: As noted in the WebGate configuration, the Primary HTTP Cookie Domain configured for Oracle Identity Federation must match the Primary HTTP Cookie Domains configured for the WebGates protecting content to be accessed by federated users. Basic Authentication Scheme Name: Use the Access System Console (http://AMhost:AMport/access/oblix) to find a suitable basic authentication scheme. If you enabled the default policies when you installed Oracle Access Manager (by selecting Access Manager in the Oracle Access Manager console, checking the two policies and clicking Enable), you can use the basic scheme created for those policies: For Oracle Access Manager 10.1.4: Oracle Access and Identity Basic Over LDAP authentication scheme For COREid 7.0.4: NetPoint Basic Over LDAP If no basic schemes are configured, you must set one up following instructions in the Oracle Access Manager Access Administration Guide. You can cut and paste the display name for the chosen basic scheme from the Access System Console to the Oracle Identity Federation User Data Store page.

   
   

   Click Apply.

   Use these credentials for the Access Server:

   • Access Server Host Name: access-server-host

     
     

     Note: This must be one of the servers configured in step 1d.

     
     

   • Access Server Port: access-server-port

   • Access Gate ID: OIF

   • Access Gate Password: OIF-password

   • Connection Type: must match the access servers

   Restart the Oracle Identity Federation server.

5. To make sure that the integration is complete:

   • Log into the Access System Console http://AMhost:AMport/access/oblix/.

   • Click Access Manager.

   • Check Fed Domain created in My Policy Domains.

6. To create a resource protected by Oracle Identity Federation (as a service provider):

   1. Follow the steps for protecting resources in the Oracle Access Manager Access Administration Guide, in the chapter Protecting Resources with Policy Domains.

   2. Change the authentication scheme to one of:

      Fed SSO - SAML2.0/Liberty 1.x – to use SAML 2 or Liberty 1.1 or 1.2 SSO profiles

      Fed SSO - WS-Federation – to use the WS-Federation Passive Requester SSO profile

      Fed SSO - SAML 1.x – to use SAML 1.0 or 1.1 SSO profiles

      
      

      Note: The choice is determined by the protocols that the partner identity providers support. If the same resource will be accessed by partners requiring different protocols, you must set up separate policies with different resource URLs to map the requests to the appropriate authentication scheme. For example, to provide access to a resource /my-resource using both SAML 2 and WS-Federation, you can set up: a policy for a resource /my-resource-saml2 that uses the Fed SSO – SAML2.0/Liberty 1.x scheme, and a policy for a resource /my-resource-wsfed that uses the Fed SSO – WS-Federation scheme. You must then configure the web server to map these pseudonymous URLs to the actual /my-resource URL.