OAM 11g R2 Federation Lab

-
Task1-Configuring OIF11GR1 to OUD as DataStore
Task2-Verify Identity Provider
Task3-Export OIF 11gR1 IDP identity metadata
Task4-Configuring OAM and importing the IDP metadata
Task5-Import OAM11gR2 SAML2.0 Metadata(SP) into OIF11gR1 
Task6-Configure Default Authentication Engine As LDAPDirectory
Task7-Configuring Federation DataStore (To Store Federated Records)
Task8-Configuring OIF AuthScheme To A Resource
Task9-Test Federation
Task10-Configuring LDAP Authrization in OAM (Part 1)
Task11-Configuring SAML attributes from IDP to back-end application as custom header attributes (Part 2)
Task12-Configuring the Responses to Send SAML Attributes to myBank Application As Headers (Part 3)
Task13-Verify LDAP Authorization And Header Responses

Task1-Configuring OIF11GR1 to OUD as DataStore

Use webgate11g_1 Application Domain

http://oam.example.com:8001/em (EM Console of OIF)

Go to Farm_IDMDomain -> Identity and Access -> OIF (11.1.1.2.0)

Oracle Identity Federation -> Administration -> Data Stores

Edit User Data Store

Repository Type = LDAP Directory
    Connection URL(s)
    ldap://oam.example.com:1389
    Bind DN
    cn=Directory Manager
    Password
    Oracle123
    User ID Attribute
    uid
    User Description Attribute
    uid
    Person Object Class
    inetorgperson
    Base DN
    ou=people,dc=example,dc=com 
    
Test LDAP Connection

Task2-Verify Identity Provider

Right Side -> Oracle Identity Federation -> Administration -> Identity Provider

Click SAML 2.0 tab
Assertion Subject NameID format is defaulted to email address with the User Attribute mapping in the user store being mail
Send Encrypted Attributes = uncheck
Send Encrypted NameIDs = uncheck
Send Encrypted Assertions = uncheck
Send Signed Assertion = check
Enable SAML 2.0 Protocol = check
Enable Single Sign-On Protocol = check
Enable NameID Management Protocol: Register = check
Enable NameID Management Protocol: Terminate = check
Enable Attribute Query Responder = uncheck
Enable Authentication Query Responder = uncheck
Enable Assertion ID Responder = uncheck
Enable Protocol Bindings = SSO - Artifact;SSO - HTTP POST;SSO - HTTP POST 
Default Binding = HTTP Redirect
Default SSO Response Binding = Artifact

Message Section
Request - SOAP = Send Signed = check
Response - HTTP Redirect = Send Signed = check
Response - HTTP POST = Send Signed = check
Response - SOAP = Send Signed = check
Request - HTTP POST = Send Signed = check
Response with Assertion - SOAP = Send Signed = uncheck
Request - HTTP Redirect = Send Signed = uncheck
Response with Assertion - HTTP POST = Send Signed = uncheck
AuthnRequest = n/a 

Task3-Export OIF 11gR1 IDP identity metadata

Go to -> Oracle Identity Federation -> Administration -> Security and Trust

Click Provider Metadata
Provider Type : Identity Provider
Protocol : SAML 2.0

Click Generate

Choose Save

Task4-Configuring OAM and importing the IDP metadata

Go to :7001/oamconsole

System Configuration -> Available Services
Enable "Identity Federation"
"Security Token Service"
"Mobile and Social"

Now on the left , Go to Identity Federation -> Identity Providers 
New Identity Provider
Browse and Import the OIF IDP Metadata file just generated

Name : OIF_IDP 
Protocol : SAML 2.0
Metadata File
Map assertion Name ID to User ID Store attribute = mail 

User Mapping : OUD_UserStore
User Search Base DN : ou=people,dc=example,dc=com
Provider ID : http://oam:7499/idp
Signing Certificate Subject : CN=oam Signing Certificate

Enable Identity Partner : check
Default Identity Partner : check

Enable global logout : check
HTTP POST preferred binding : check
Authentication Request NameID Format : Email Address

Now Go to Left hand Side -> Federation Settings -> Export SAML 2.0 Metadata

Provider Id: https://oam:14101/oam/fed
Signing Key: osts_signing 
Encryption Key: osts_encryption

Export SAML 2.0 Metadata

Choose Save and Ok

Task5-Import OAM11gR2 SAML2.0 Metadata(SP) into OIF11gR1 

Go to OIF Em Console
LEFT => Identity and Access -> OIF (11.1.1.2.0) 
RIGHT => Oracle Identity Federation -> Administration Federations
Click Add
check Enable Provider 
Load Metadata -> Browse File and upload

Select Record and click Edit
Click "Oracle Identity Federation Settings"
check "Enable Attributes in Single Sign-On (SSO)"
check "Email Address"

Choose Apply

Task6-Configure Default Authentication Engine As LDAPDirectory

Go to Oracle Identity Federation -> Administration -> Authentication Engines

Click LDAP Directory 

Connection URL(s)
ldap://oam.example.com:1389
    Bind DN
    cn=Directory Manager
    Password
    Oracle123
    Confirm Password
    Oracle123
    User Credential ID Attribute
    uid
    User Unique ID Attribute
    uid
    Person Object Class
    inetorgperson
    Base DN
    ou=people,dc=example,dc=com 
Enable Authentication Engine
Test LDAP Connection
Click Apply

Task7-Configuring Federation DataStore (To Store Federated Records)

Go to Oracle Identity Federation -> Administration -> Data Stores

Change Federation Data Store -> Change Repository Data Store from "None" to "XML File"

Now go to Administration -> Identities
Go to "Local Users"
Search (click)

Task8-Configuring OIF AuthScheme To A Resource

Go to /oamconsole
Identity Federation -> Identity Providers -> OIF_IDP
Click "Create Authentication Scheme and Module"

A new OIF Plugin and an OIF Scheme is created prefixed with the name of the provider OIF_IDP you had created initially

OIF_IDPFederationPlugin
OIF_IDPFederationScheme

Go to Authentication Modules -> Custom Authentication Modules -> OIF_IDPFederationPlugin

Steps 
1. FedAuthnRequestPlugin 
2. AssertionProcessing 

Steps Orchestration 
Initial Step = FedAuthnRequestPlugin
FedAuthnRequestPlugin -> success(on Success), AssertionProcessing (on Failure), failure (on Error)
AssertionProcessing -> success (on Success), failure (on Failure), On Error (failure)

Go to Policy Configuration -> Application Domains -> webgate11g_1 -> Authentication Policies -> Protected Resource Policy -> Change Authentication Scheme from LDAPScheme to OIF_IDPFederationScheme

Task9-Test Federation
edit mod_wl_ohs.conf
proxy /mybank 

Try to access http://oam.example.com:7777/mybank 

You will be redirected to the OIF login page
Use the OUD User user.0 
Once successful authentication , mybank home page is displayed confirming the OIF Authentication

Go to Oracle Identity Federation -> Administration -> Identities
Click Federated Identities
Search 
you will see user.0 who just tried

Task10-Configuring LDAP Authrization in OAM (Part 1)

/mybank/testheaders.jsp  and set an authorization policies that allow only customers can access this URL 

Go to Application Domain -> webgate11g_1 ->
Resources -> New Resource
Type : HTTP 
Host Identifier : webgate11g_1
Resource URL : /mybank/testheaders.jsp
Query : Name Value list 
Operations : ALL,CONNECT,OPTIONS,PUT,POST,GET
Protection Level : Protected
Click Apply

Go to Authorization Policies
Click "Create Authorization Policy"
Name : CustomersOnly 
Resources : /mybank/testheaders.jsp 
Conditions click +
Name : myBankCustomers
Type : Identity
On the bottom 
Click + and Add Users and Groups 

Search Store Name : OUD_UserStore
Entity Type : Group 
Entity Name : Customers(Group Name)
Click Save

Now come to Rules tab 
Allow Rule 
Select the myBankCustomers (Identity) [Condition just created in last step]

Click Apply 

Task11-Configuring SAML attributes from IDP to back-end application as custom header attributes (Part 2)

Go to OIF EM Console 
Oracle Identity Federation -> Administration -> Federations
Select Provider ID record and click Edit
Click Edit "Attribute Mappings and Filters"

Name Mappings -> Add + 

User Attribute Name : mail 
Assertion Attribute Name : EmailAddress
Format or Namespace = blank
Send with SSO Assertion = check 
Get Value from User Session = uncheck 
Require from Infocard = uncheck 

Name Mappings -> Add + 

User Attribute Name : cn 
Assertion Attribute Name : FullName
Format or Namespace = blank
Send with SSO Assertion = check 
Get Value from User Session = uncheck 
Require from Infocard = uncheck 

Click Apply 

Task12-Configuring the Responses to Send SAML Attributes to myBank Application As Headers (Part 3)

Go to the Authorization Policy -> CustomersOnly and 
go to "Responses" tab 
Click + add icon 
Add Response 

Type = Header
Name = EmailAddress
Value = $session.attr.fed.attr.EmailAddress

Click + add icon 
Add Response 

Type = Header
Name = FullName
Value = $session.attr.fed.attr.FullName

Click Apply 

Task13-Verify LDAP Authorization And Header Responses

Take a user who belongs to the customer group 
Any user who does not belong to customer group will be denied access to /mybank/testheaders.jsp 

Access "http://oam.example.com:7777/mybank/testheaders.jsp"

Test a user who is not a customer member and see denied access

Now try with a user who is a member of customer group and see the testheaders.jsp page 

Request Headers
FullName = FullNameOfTheTestUser
EmailAddress = EmailAddressOfTheTestUser

Comments

Post a Comment

Popular posts from this blog

OIM 11g Custom ADF Application Development

-
Image
In this post , I will cover the steps required to create a custom ADF web application. What this application does is facilitate Account Claim Process. Users has been migrated from some other IAM product to OIM and exist in disabled state and hence cannot login to perform Self Service operations. User needs to identify themselves by providing their personal details like personal identification number, zip code and dob etc. After successfully Identifying themselves they will be able to set a new password and set their challenge questions and answers. During this process the application will activate their account and set the new password and QnA. At the end of the process, they will be able to login OIM with their new password set. The application has been developed using JDeveloper using ADF technology to render user interfaces and MVC design pattern to keep the concerns separate. Application Structure                                                                                  
Read more

Oracle Identity Manager (OIM) Interview Questions

-
This is my 100th post on my blog and in this post, I will list down interview questions on OIM. This post will always be work in progress as I keep appending this list with more and more questions. Please find the list of questions below :-) What are the new features in PS3 ? What are the differences between PS2 and PS3 ? How do you identify rogue account creation in target system ? What is the high level architecture of OIM 11g ? List out difference between OIM 9.1 and 11g and possibly 11gR2 What are the new features in 11gR2 PS2 , PS3 How do you save multi-valued attribute in process form and how the linking happens between process form & child form ,   1 child form per multi valued attribute Can we still use entity adapters in OIM 11g What is pluginservice in oim 11g/  What is the orchestration service in oim 11g. what is the difference between entity match found  and process match found ? what are service accounts in oim ? why remote manager is used ? What is a c
Read more

OIM 11g R2 PS2 : SOA Approval Workflow Sample

-
Image
In this post I am posting the sample code for a sample SOA approval workflow. Some of the features that this workflow addresses are Approval to Manager or Role Owners is dynamic based on the custom OIM system property "approval-condition". Value is set either "AND" or "OR". Manager or Role Owner can be set to be notified only with no approval required. In this case only email is sent to notify them but no approval is required from them. Custom OIM system property are created to address this.   manager-notify-only = TRUE or FALSE  TRUE = only notify the manager no approval request sent. FALSE = notify the manager and send an approval request.   roleowner-notify-only = TRUE or FALSE  TRUE = only notify the role owner no approval request sent. FALSE = notify the role owner and send an approval request. Third Level System Notification was required but it should be dynamic.  Custom OIM system property are created to address this sysadmin-noti
Read more