14 Managing Security

14.7.1.3.1 Configure mod_weblogic (mod_wl_ohs.conf)

Configure the module mod_wl in the WebTier OHS so that it forwards requests to the Oracle WebLogic Server for WebCenter, by uncommenting lines at WEBTIER_HOME/instances/<your_instance>/config/OHS/ohs1/mod_wl_ohs.conf. This file is included by the httpd.conf file.

To configure Web Tier OHS to work with multiple non-clustered servers, use the example below in mod_wl_ohs.conf. Make sure that the WebLogic port numbers match your configuration.

<IfModule mod_weblogic.c>
MatchExpression  /webcenter   WebLogicHost=webcenter.example.com|WebLogicPort=8888
MatchExpression  /rss         WebLogicHost=webcenter.example.com|WebLogicPort=8890
MatchExpression  /owc_wiki    WebLogicHost=webcenter.example.com|WebLogicPort=8890
MatchExpression  /owc_discussions  WebLogicHost=webcenter.example.com|WebLogicPort=8890
MatchExpression /workflow WebLogicHost=soa.example.com|WebLogicPort=8888
MatchExpression /integration/worklistapp WebLogicHost=soa.example.com|WebLogicPort=8888
MatchExpression /integration/services WebLogicHost=soa.example.com|WebLogicPort=8888
MatchExpression /soa-infra WebLogicHost=soa.example.com|WebLogicPort=8888
</IfModule>

14.7.1.3.2 Create an AccessGate Entry

An AccessGate entry needs to be created on the Access Manager to be shared by the OAM Identity Assertion Provider (IAP), and the WebGate performing perimeter authentication on the webtier reverse proxy.

To create an AccessGate entry:

1. Log in to the Access Server Console using your browser to navigate to:

   http://host:port/access/oblix
   

   Where host is the host ID of the server hosting the Access Manager (for example, oam.example.com), and port is the HTTP port number (for example, 8888).

2. Open the Access System Configuration page.

3. Click Add New AccessGate to create a new AccessGate entry.

4. Click List Access Servers on the Details pane and bind the AccessGate to the Access Server that has been set up for OAM Single Sign-on.

Some of the settings specified here will be needed for WebGate installation and OAM Identity Assertion Provider (IAP) setup. Table 14-2 shows settings for a typical AccessGate entry.

14.7.1.3.3 Install WebGate on the WebTier

This section describes how to install the WebGate.

To install the WebGate:

1. Copy the ZIP file (Oracle_Access_Manager10_1_4_3_0_linux_GCClib.zip) containing the two gcc libraries required for the installation (libgcc_s.so.1 and libstdc++.so.5) to a /tmp directory.

2. Run the installation as root. For example, from the /tmp directory run:

   sudo -u root ./Oracle_Access_Manager10_1_4_3_0_linux_OHS11g_WebGate
   

3. Follow the installation runtime instructions, providing the installation directory, information of the AccessGate that you created earlier and the absolute path to the httpd.conf file of the web server. For example:

   WEBTIER_HOME/instances/instance1/config/OHS/ohs1/httpd.conf
   

   Information for the AccessGate can be found in the Access System Console. For more information, see Section 14.7.1.3.2, "Create an AccessGate Entry".

4. After the installation a new section is inserted in the httpd.conf file between the following entries:

   #** BEGIN WEBGATE SPECIFIC ***
   #** END Oblix NetPoint Specific ***  
   

   Check to see if the content is consistent with your environment.

14.7.1.6.1 Configuring the Oracle Internet Directory Authenticator

Assuming Oracle Internet Directory is backing the OAM identity store, an Oracle Internet Directory authenticator (OracleInternetDirectoryAuthenticator) should be configured for the LDAP server that is used as the identity store of OAM, and the provider should be set to SUFFICIENT.

To configure the Oracle Internet Directory authenticator:

1. Log in to the WLS Administration Console.

   For information on logging into the WLS Administration Console, see Section 1.12.2, "Oracle WebLogic Server Administration Console".

2. From the Domain Structure pane, click Security Realms.

   The Summary of Security Realms pane displays (see Figure 14-62).

   Figure 14-62 Summary of Security Realms Pane

   
   Description of "Figure 14-62 Summary of Security Realms Pane"
   
   

3. Click the realm entry for which to configure the OAM authenticator.

   The Settings pane for the realm displays (see Figure 14-63).

   Figure 14-63 Settings Pane

   
   Description of "Figure 14-63 Settings Pane"
   
   

4. Open the Providers tab.

   The Provider Settings display (see Figure 14-64).

   Figure 14-64 Settings Pane - Providers

   
   Description of "Figure 14-64 Settings Pane - Providers"
   
   

5. Click New to create a new provider.

   The Create a New Authentication Provider pane displays (see Figure 14-65).

   Figure 14-65 Create a New Authentication Provider Pane

   
   Description of "Figure 14-65 Create a New Authentication Provider Pane"
   
   

6. Enter a name for the new provider (for example, OID Authenticator), select OracleInternetDirectoryAuthenticator as its type and click OK.

7. On the Providers tab, click the newly added provider.

   The Common Settings pane for the authenticator displays (see Figure 14-66).

   Figure 14-66 Common Settings Pane

   
   Description of "Figure 14-66 Common Settings Pane"
   
   

8. Set the control flag to SUFFICIENT and click Save.

9. Open the Provider Specific tab.

   The Provider Specific Settings pane for the authenticator displays (see Figure 14-67).

   Figure 14-67 Provider Specific Settings for OID Authenticator

   
   Description of "Figure 14-67 Provider Specific Settings for OID Authenticator"
   
   

10. Complete the fields as shown in the table below. Leave the rest of the fields set to their default values.

    Field	Value	Comment
    Host:		The host ID for the LDAP server
    Port:		The LDAP server port number
    Principal:		The LDAP administrator principal (for example, cn=orcladmin)
    Credential:	<password>	The administrator principal password
    Confirm Credential:	<password>
    User Base DN:		User Search Base - this value would be same as #1.d in OAM Access Manager Setup
    All Users Filter:	"(&(uid=*)(objectclass=person))"
    User Name Attribute:	"uid"
    Group Base DN:		Group search base - Same as User Base DN

    
    

11. Click Save.

12. Restart the WebCenter Administration Server and managed server and validate the configuration by navigating to the Realm Settings page in the WLS Administration Console and opening the Users and Groups tab.

14.7.1.6.2 Configuring the OAM Identity Asserter

An OAM identity asserter needs to be configured with the provider Control Flag set to REQUIRED.

To configure the OAM Identity asserter:

1. Log in to the WLS Administration Console.

   For information on logging into the WLS Administration Console, see Section 1.12.2, "Oracle WebLogic Server Administration Console".

2. From the Domain Structure pane, click Security Realms.

   The Summary of Security Realms pane displays (see Figure 14-68).

   Figure 14-68 Summary of Security Realms Pane

   
   Description of "Figure 14-68 Summary of Security Realms Pane"
   
   

3. Click the realm entry for which to configure the OAM identity asserter.

   The Settings pane for the realm displays (see Figure 14-69).

   Figure 14-69 Settings Pane

   
   Description of "Figure 14-69 Settings Pane"
   
   

4. Open the Providers tab.

   The Provider Settings display (see Figure 14-70).

   Figure 14-70 Settings Pane - Providers

   
   Description of "Figure 14-70 Settings Pane - Providers"
   
   

5. Click New to create a new provider.

   The Create a New Authentication Provider pane displays (see Figure 14-71).

   Figure 14-71 Create a New Authentication Provider Pane

   
   Description of "Figure 14-71 Create a New Authentication Provider Pane"
   
   

6. Enter a name for the new provider (for example, OAM ID Asserter), select OAMIdentityAsserter as its type and click OK.

7. On the Providers tab, click the newly added provider.

   The Common Settings pane for the authenticator displays (see Figure 14-72).

   Figure 14-72 Common Settings Pane

   
   Description of "Figure 14-72 Common Settings Pane"
   
   

8. Set the control flag to REQUIRED and check that ObSSOCookie is set for Active Types.

9. Click Save.

10. Open the Provider Specific tab.

    The Provider Specific Settings pane for the OAMIdentityAsserter displays (see Figure 14-73).

    Figure 14-73 Provider Specific Settings for the OAMIdentityAsserter

    
    Description of "Figure 14-73 Provider Specific Settings for the OAMIdentityAsserter"
    
    

11. Complete the fields as shown in the table below. Leave the rest of the fields set to their default values.

    Field	Value	Comment
    Primary Access Server:		The OAM server endpoint information in HOST:PORT format
    Access Gate Name:		Name of the Access Gate
    Access Gate Password:		Provide the Access Gate password and confirm in the field below.

    
    

12. Click Save to save your settings.

14.7.1.6.3 Configuring the Default Authenticator and Setting the Provider Order

After configuring the OAM identity asserter, make sure that the default authenticator's control flag is set to SUFFICIENT and reorder the providers as shown below:

1. Navigate to the Provider Settings pane (see Figure 14-70).

2. Open the Default Authenticator and check that the control flag is set to SUFFICIENT.

3. Do the same for any providers other than the two you just created.

4. On the Settings Pane, reset the provider order to:

   • OAMIdentityAsserter (REQUIRED)

   • OracleInternetDirectoryAuthenticator (SUFFICIENT)

   • DefaultAuthenticator (SUFFICIENT)

   • DefaultIdentityAsserter

14.7.1.6.4 Configuring the Application for Oracle Access Manager SSO

Configure the applications for SSO by adding a setting to EXTRA_JAVA_PROPERTIES.

There is a system property that tells WebCenter and ADF that the application is configured in SSO mode and some special handling is required. The following system property is required in this mode:

To set this property, edit the setDomainEnv.sh script located in your <domain>/bin directory. Add the property to the EXTRA_JAVA_PROPERTIES variable, as follows:

EXTRA_JAVA_PROPERTIES="-Dweblogic.security.SSL.ignoreHostnameVerification=true -Doracle.mds.bypassCustRestrict=true
-Djps.update.subject.dynamic=true -Doracle.webcenter.spaces.osso=true
-noverify ${EXTRA_JAVA_PROPERTIES}"

After making this change, restart the following servers:

• WebCenter's Administration Server

• All the domain's managed servers

• WebTier OHS

14.7.1.7.1 Configuring the WLS Administration Console and Enterprise Manager

This section describes how to optionally set up OAM single sign-on for the WLS Administration Console and Enterprise Manager.

To set up OAM SSO for the WLS Administration Console and Enterprise Manager:

1. Log in to the Access Server Console using your browser to navigate to:

   http://host:port/access/oblix
   

   Where host is the host ID of the server hosting the Access Manager (for example, oam.example.com), and port is the HTTP port number (for example, 8888).

2. Click Policy Manager.

   The Policy Manager pane displays (see Figure 14-74).

   Figure 14-74 Policy Manager Pane

   
   Description of "Figure 14-74 Policy Manager Pane"
   
   

3. Search for the policy domain that you created earlier to protect WebCenter resources in Section 14.7.1.5, "Manually Defining the WebCenter Policy Domain".

4. Open the Resources tab and click Add.

   The Resource page displays (see Figure 14-75).

   Figure 14-75 Policy Domain Resource Page

   
   Description of "Figure 14-75 Policy Domain Resource Page"
   
   

5. Add the resources that need to be secured. For each resource:

   1. Select http as the Resource Type.

   2. Select the Host Identifier for the WebCenter webtier.

   3. Enter the URL Prefix for the WLS Administration Console or Enterprise Manager.

   4. Enter a Description for the resource.

   5. Make sure that Update Cache is selected, and then click Save.

6. In your webtier, modify the mod_wl_ohs.conf file (in WEBTIER_HOME/instances/your_instance/config/OHS/ohs1/) to include the WLS Administration Console and Enterprise Manager, using the actual host ID for the WebCenter Administration Server for WebLogicHost.

   <IfModule mod_weblogic.c>
     MatchExpression  /webcenter WebLogicHost=example.com|WebLogicPort=8888
     MatchExpression  /rss WebLogicHost=example.com|WebLogicPort=8888
     MatchExpression  /owc_wiki WebLogicHost=example.com|WebLogicPort=8890
     MatchExpression  /owc_discussions WebLogicHost=example.com|WebLogicPort=8890
     MatchExpression  /console WebLogicHost=example.com|WebLogicPort=7001
     MatchExpression  /em WebLogicHost=example.com|WebLogicPort=7001
   </IfModule>
   

7. Restart the Oracle HTTP Server for your changes to take effect.

   You should now be able to access the WLS Administration Console and Enterprise Manager with the following links:

   http://host:OHS port/console
   http://host:OHS port/em
   

   and be prompted with the OAM SSO login form.

14.7.1.7.2 Deploying the Discussions Server

Prior to configuring the Oracle WebCenter Discussions Server for SSO, you may need to deploy it.

To deploy the discussions server:

1. Log into the WLS Administration Console.

   For information on logging into the WLS Administration Console, see Section 1.12.2, "Oracle WebLogic Server Administration Console".

2. In the Domain Structure pane, click Deployments.

   The Deployments Summary pane displays (see Figure 14-76).

   Figure 14-76 Deployment Summary Pane

   
   Description of "Figure 14-76 Deployment Summary Pane"
   
   

3. On the Deployment Summary page, select owc_discussions stop and delete and click Install.

4. Using the Install Application Assistant Path field, locate the SSO enabled owc_discussions .EAR file (typically in MW_HOME/Oracle_WC1/discussionserver).

5. Select the owc_discussions_sso.ear file and click Next.

6. Select Install this deployment as an application and click Next.

7. Deploy the .EAR file with all default options except the Name, which should be set to owc_discussions.

8. Restart the WLS_Services managed server.

   Now, when you access the discussion server's Admin Console through the OHS port:

   http://<host>:<OHS port>/owc_discussions/admin/
   

   you should be challenged by the WebGate login form.

14.7.1.7.3 Configuring the Discussions Server

This section describes how to configure Oracle WebCenter Discussions Server for OAM single sign-on. Before configuring the discussions server for OAM SSO, deploy it as shown in Section 14.7.1.7.2, "Deploying the Discussions Server", and configure it to use the same identity store LDAP as WebCenter Spaces, as described in Section 14.3.6, "Configuring the Discussions Server to Share the Identity Store LDAP Server".

To set up the discussions server for OAM SSO

1. Log in to the Oracle WebCenter Discussions Server Admin Console at:

   http://host:port/owc_discussions/admin
   

   Where host and port are the host ID and port number of the WLS_Services managed server.

2. Open the System Properties page and edit (if it already exists) or add the AuthFactory.className property setting it's value to oracle.jive.sso.OracleSSOAuthFactory.

3. Edit or add the jiveURL property to point to the base URL of the SSO server. For example:

   jiveURL = example.com:8890/owc_discussions
   

4. Deploy the SSO-enabled owc_discussions application.

To create a discussions server connection for WebCenter Spaces

1. Log into Fusion Middleware Control and select the WebLogic domain for WebCenter Spaces.

   For information on logging into Fusion Middleware Control, see Section 6, "Starting Enterprise Manager Fusion Middleware Control".

2. In the Navigation pane, open the WebCenter node, and then the WebCenter Spaces node, and click WebCenter Spaces (WLS_Spaces).

3. Register the discussion server as described in Section 11.1.3.1, "Registering Discussion Servers Using Fusion Middleware Control".

   For Server URL, enter http://<host>:<port>/owc_discussions .

4. Restart the WLS_Spaces managed server.

   When you log into WebCenter Spaces, you automatically sign on to the discussion server as well.

14.7.1.7.4 Configuring the Wiki Server

Wiki page functionality is supported as a portlet, which you can embed in a Web page, and OAM single sign-on is supported this way. Since the Oracle WebCenter Wiki and Blog Server does not require or support an identity store, there is no need to configure the LDAP.

To add a wiki page to a WebCenter identity store, follow the steps below:

1. Log in to WebCenter Spaces, and open a group space.

2. Add a page, choosing Web Page as the Style.

3. When the page is created, click the Edit icon.

   The Component properties dialog displays.

4. Enter the following URL in the Source box:

   http://host:OHS port/owc_wiki/page/show.jz?inline=1&scope=#{communityContext.communityName}
   

   Where host is the host ID of the WLS_Spaces server, and OHS_port is the port number of the Oracle HTTP Server. The OHS port is used so the call goes through the WebGate which will initiate SSO.

   After specifying the component properties you will see the wiki page contents.

5. Save the changes.

14.7.1.7.5 Restricting Access with Connection Filters

Follow the steps below to only allow users to access WebCenter and other services through the WebTier OHS ports so that they can be properly authenticated.

1. Log in to the WLS Administration Console.

   For information on logging into the WLS Administration Console, see Section 1.12.2, "Oracle WebLogic Server Administration Console".

2. In the Domain Structure pane, select the domain you want to configure (for example, webcenter).

3. Open the Security tab and the Filter subtab.

   The Security Filter Settings pane displays (see Figure 14-77).

   Figure 14-77 Security Filter Settings Page

   
   Description of "Figure 14-77 Security Filter Settings Page"
   
   

4. Check Connection Logger Enabled to enable the logging of accepted messages.

   The Connection Logger logs successful connections and connection data in the server. This information can be used to debug problems relating to server connections.

5. In the Connection Filter field, specify the connection filter class to be used in the domain.

   • To configure the default connection filter, specify weblogic.security.net.ConnectionFilterImpl.

   • To configure a custom connection filter, specify the class that implements the network connection filter. Note that this class must also be present in the CLASSPATH for WebLogic Server.

6. In the Connection Filter Rules field, enter the syntax for the connection filter rules.

   For example:

   <webtier IP>/0 * * allow
   0.0.0.0/0  *  *  deny
   

   which says: allow all traffic coming from the local host and disallow all traffic from any other IP address. You should, of course, write the network filter(s) that are relevant to your environment. For more information about writing connection filters, see "Developing Custom Connection Filters" in Oracle Fusion Middleware Programming Security for Oracle WebLogic Server.

7. Click Save and activate the changes.

8. Restart all the managed servers and the Administration Server.

9. Verify that all direct traffic to the WLS server is blocked by attempting to navigate to:

   http://host:WLS_port/webcenter
   

   This should produce the following error:

   "The Server is not able to service this request: [Socket:000445]Connection rejected, filter blocked Socket, weblogic.security.net.FilterException: [Security:090220]rule 3"

   You should, however, still be able to access WebCenter through the OHS port:

   http://host:OHS_port/webcenter
   

14.7.3.2.1 Checking the Default WebCenter Spaces and Services Login

After installing WebCenter Spaces and the Wiki and Worklist services, you must test the single sign-on configuration.

To check the default WebCenter Spaces and Wiki service login:

1. Install WebCenter Spaces, and select the Wiki service and Discussions service, and any other service applications to be configured for SSO (RSS is automatically deployed when you install WebCenter Spaces). For information on installing WebCenter Spaces, see "Installing WebCenter Spaces, Portlet Producers, Discussions, and Wiki and Blogs" in the Oracle Fusion Middleware Installation Guide for Oracle WebCenter.

   When the installation is complete, WebCenter Spaces is hosted on the WLS_Spaces managed server, and Wiki and Discussions services are hosted on the WLS_Services managed server. Record the host and port that the Wiki service is running on so, later on, you can construct the URL and test single sign-on.

2. Log into WebCenter Spaces and create a personal page with a link to the Wiki service as shown below:

   1. Log in to WebCenter Spaces as a user with create page permissions.

   2. Create a new page by clicking on the Create a page tab in a group space.

   3. Title the page appropriately (for example, "Wiki") and choose the Web page template.

   4. Click the Inspector button and click on the Web page.

   5. Change the source to be the URL specified below:

      http://host:port/owc_wiki/page/show.jz?inline=1&scope=#{communityContext.communityName}
      

      Where host is the Wiki server host ID and port is the Wiki server port number.

   6. Save the page.

   When you click the link, note that you are challenged to log in by the Wiki service. Once you have completed the remainder of the steps, this is not required. You will be automatically logged into Wiki service.

3. For the Worklist service, install SOA (which includes the BPEL server). For information on installing SOA, see Oracle Fusion Middleware Installation Guide for Oracle SOA Suite.

4. Configure the BPEL connection for WebCenter Spaces as described in Section 11.5, "Setting Up Connections for the Worklist Service".

5. To test the BPEL connection:

   1. Log into WebCenter Spaces, create a group space, and add your administrator account as a moderator.

   2. Log into WebCenter Spaces with your administrator account.

      You should see a new item in the Worklist task flow indicating that you have been added as a moderator for the group space.

   3. Click the link.

      Note that you are challenged to log in. After you have completed the rest of the steps you automatically log into the Worklist service on the SOA domain.

14.7.3.2.2 Generating and Registering Certificates

Although optional, to secure communication between the SAML source and destination sites, communication should be encrypted. Additionally, certificates should be used to verify the identity of the other party during SAML interaction. Follow the steps below to generate a key using the keytool utility (available as part of the JDK 6.0), and register it using the WLS Administration Console.

To create certificates using keytool

1. Navigate to the WEBLOGIC_HOME/server/lib directory.

2. Using keytool, generate the key with the following command:

   keytool -genkey -keypass key_password -keystore keystore_name -storepass keystore_password -keyalg rsa -alias alias
   

   Where:

   • key_password is the password to apply to the generated key

   • keystore_name is the name of the custom keystore

   • keystore_password is the password for the custom keystore

   • alias is the alias name (for example, testalias)

3. Run the keytool command with -export option to generate a key file calling it, for example, testalias.der.

   keytool -export -keypass key_password -keystore keystore_name -storepass keystore_password -alias alias -file testalias.der
   

   where:

   • key_password is the password for the generated key

   • keystore_name is the name of the custom keystore

   • keystore_password is the password for the custom keystore

   • alias is the alias name (for example, testalias)

To register the keystore using the WLS Administration Console

1. Log in to the WLS Administration Console.

   For information on logging into the WLS Administration Console, see Section 1.12.2, "Oracle WebLogic Server Administration Console".

2. In the Domain Structure pane, expand Environment and click Servers.

   The Summary of Servers pane displays (see Figure 14-85).

   Figure 14-85 Summary of Servers Pane

   
   Description of "Figure 14-85 Summary of Servers Pane"
   
   

3. Click the WebCenter Spaces server (WLS_Spaces) to configure the identity and trust keystore.

   The Settings pane for the WebCenter Spaces server displays (see Figure 14-86).

   Figure 14-86 Settings Pane for WebCenter Spaces Server

   
   Description of "Figure 14-86 Settings Pane for WebCenter Spaces Server"
   
   

4. Open the Configuration tab, and then the Keystores subtab.

   The Keystores pane displays (see Figure 14-87).

   Figure 14-87 Keystores Pane

   
   Description of "Figure 14-87 Keystores Pane"
   
   

5. For Keystores, select Custom Identity and Java Standard Trust.

6. In the Identity section, enter the path to the Custom Identity Keystore you created, choose JKS as the Type, and enter and confirm the Custom Identity Keystore Passphrase.

7. In the Trust section, enter the path to the trust keystore in Java Standard Trust Keystore, enter JKS as the Type, and enter and confirm the Java Standard Trust Keystore Passphrase.

8. Click Save.

14.7.3.2.3 Creating the SAML Credential Mapping Provider Instance

This section describes how to create a SAML Credential Mapping Provider V2 instance. Note that the SAML Credential Mapping provider is not part of the default security realm and must be created.

Creating the SAML Credential Mapping Provider instance is the first of two steps required to configure the credential mapping provider:

• Creating the SAML Credential Mapping Provider instance

• Configuring a Relying Party for each of the participating service applications (which can include OWC Wiki, OWC Discussions, RSS, Worklist Community Detail, Worklist SDP, and Worklist Integration)

To create a SAML Credential Mapping Provider instance:

1. Log in to the WLS Administration Console.

   For information on logging into the WLS Administration Console, see Section 1.12.2, "Oracle WebLogic Server Administration Console".

2. From the Domain Structure pane, click Security Realms.

   The Summary of Security Realms pane displays (see Figure 14-88).

   Figure 14-88 Summary of Security Realms Pane

   
   Description of "Figure 14-88 Summary of Security Realms Pane"
   
   

3. Click your security realm.

   The Settings page for the security realm displays (see Figure 14-89).

   Figure 14-89 Security Realm Settings Page

   
   Description of "Figure 14-89 Security Realm Settings Page"
   
   

4. Open the Providers tab and select the Credential Mapping subtab.

   The Credential Mapping pane displays (see Figure 14-90).

   Figure 14-90 Credential Mapping Pane

   
   Description of "Figure 14-90 Credential Mapping Pane"
   
   

5. Click New.

   The Create a New Credential Mapping Provider pane displays (see Figure 14-91).

   Figure 14-91 Create a New Credential Provider Pane

   
   Description of "Figure 14-91 Create a New Credential Provider Pane"
   
   

6. Enter a Name for the provider, select the Type as SAMLCredentialMapperV2, and click OK.

7. On the Security Realm Settings page, click the provider you just created.

   The Settings page for the new provider displays (see Figure 14-92).

   Figure 14-92 Provider Settings Pane

   
   Description of "Figure 14-92 Provider Settings Pane"
   
   

8. Open the Provider Specific tab.

   The Provider Specific Settings Pane displays (see Figure 14-93).

   Figure 14-93 Provider Specific Settings Pane

   
   Description of "Figure 14-93 Provider Specific Settings Pane"
   
   

9. Configure the SAML Credential Mapping provider as a SAML authority, using the Issuer URI, Name Qualifier, and other attributes as shown below in Table 14-3. Leave the remaining parameters set to their default values.

   Table 14-3 SAML Credential Mapping Provider Security Realm Settings

   Parameter	Value	Description
   Issuer URI	http://www.example.com/webcenter	The Issuer URI (name) of this SAML Authority. This unique URI tells the destination site (Wiki service) the origin of the SAML message and allows it to match with the key. Typically, the URI is used to guarantee uniqueness.
   Name Qualifier	example.com	The Name Qualifier value used by the Name Mapper. The value of the Name Qualifier is the security or administrative domain that qualifies the name of the subject. This provides a means to federate names from disparate user stores while avoiding the possibility of subject name collision.
   Web Service Assertion Signing Key Alias		The alias used to retrieve from the keystore the key that is used to sign assertions (for example, testalias).
   Web Service Assertion Signing Key Passphrase		The credential (password) used to retrieve from the keystore the keys used to sign assertions (for example, testkeypass).
   Please type again To confirm		Re-enter the credential password.

   
   

10. Click Save to save your settings.

11. Restart the WebLogic Administration server.

14.7.3.2.4 Configuring a Relying Party

Configuring a relying party is the second of two steps required to configure the credential mapping provider:

• Creating the SAML Credential Mapping Provider instance

• Configuring a relying party for each of the participating service applications (which can include OWC Wiki, OWC Discussions, RSS, Worklist Community Detail, Worklist SDP, and Worklist Integration)

To configure a relying party:

1. From the Domain Structure pane, click Security Realms.

   The Summary of Security Realms pane displays (see Figure 14-94).

   Figure 14-94 Summary of Security Realms Pane

   
   Description of "Figure 14-94 Summary of Security Realms Pane"
   
   

2. Click your security realm and open the Providers tab and the Credential Mapping subtab.

   The Credential Mapping Providers Settings pane displays (see Figure 14-95).

   Figure 14-95 Credential Mapping Providers Settings Pane

   
   Description of "Figure 14-95 Credential Mapping Providers Settings Pane"
   
   

3. Click the SAML Credential Mapping Provider you created.

4. Open the Management tab and the Relying Parties tab on the Settings page for the provider.

   The Relying Parties Management Settings pane displays (see Figure 14-96).

   Figure 14-96 Relying Parties Management Settings Pane

   
   Description of "Figure 14-96 Relying Parties Management Settings Pane"
   
   

5. Click New.

   The Create a New Relying Parties page displays (see Figure 14-97).

   Figure 14-97 Create a New Relying Party Page

   
   Description of "Figure 14-97 Create a New Relying Party Page"
   
   

6. Select Browser/POST as the SAML Profile, and provide a Description (for example, Wiki).

7. Click OK to save your settings.

8. On the Relying Parties Management Settings pane, click the Partner ID of the Relying Party you just created (the Partner ID is automatically generated for you).

   The Relying Party Settings page displays (see Figure 14-98).

   Figure 14-98 Relying Party Settings Page

   
   Description of "Figure 14-98 Relying Party Settings Page"
   
   

9. On the Relying Parties page, use the settings shown in Table 14-1 to configure a relying party for the Wiki service. Leave the remaining parameters set to their default values. Click Save when finished.

   Table 14-4 Relying Party Settings for Wiki Service

   Parameter	Value	Description
   Enabled	Checked	The state of this SAML Relying Party.
   Description	OWC Wiki	A short description of this Relying Party
   Target URL		The destination site URL for which authentication is requested (for example: http://example.com:8890/owc_wiki/user/login.jz).
   Assertion Consumer URL		The URL at which an Assertion Consumer Service for this SAML Relying Party can be reached (for example, http://exmple.com:8888/owc_wiki/samlacs/acs). Indicates the URL to which an assertion or artifact should be POSTed or redirected. Note: If you have checked ACS requires SSL while configuring destination site federation services, then use HTTPS protocol and the SSL port for the WLS_Services managed server.
   Assertion Consumer Properties	APID=ap_00001	One or more optional query parameters, in the form name=value, that will be added to the ACS URL when redirecting to the destination site. In the case of POST profile, these parameters will be included as form variables when using the default POST form. In this case, ap_00001 indicates the ID of the asserting party for the Wiki application configured in the SAML Identity Asserter of the WebCenter domain which provides the source site (WebCenter Spaces) and ITS details.
   Sign Assertions	Checked	Specifies whether generated assertions for this SAML Relying Party are signed.
   Include KeyInfo	Checked	Indicates whether a <ds:keyinfo> element containing the signing certificate should be included when signing assertions. The default value is true. This value is ignored if Sign Assertions is false.

   
   

10. Repeat steps 1 - 8 to configure a relying party for the Worklist Community Detail service using the settings shown in Table 14-1. Leave the remaining parameters on the Relying Parties page set to their default values. Click Save when finished.

    Table 14-5 Relying Party Settings for Worklist Community Detail

    Parameter	Value	Description
    Enabled	Checked	The state of this SAML Relying Party.
    Description	Worklist Detail	A short description of this Relying Party
    Target URL		The destination site URL for which authentication is requested (for example: http://example.com:8001/workflow/WebCenterWorklistDetail/faces/adf.task-flow).
    Assertion Consumer URL		The URL at which an Assertion Consumer Service for this SAML Relying Party can be reached (for example, http://example.com:8888/workflow/WebCenterWorklistDetail/samlacs/acs). Indicates the URL to which an assertion or artifact should be POSTed or redirected. Note: If you have checked ACS requires SSL while configuring destination site federation services, then use https protocol and the SSL port for the SOA managed server.
    Assertion Consumer Properties	APID=ap_00001	One or more optional query parameters, in the form name=value, that will be added to the ACS URL when redirecting to the destination site. In the case of POST profile, these parameters will be included as form variables when using the default POST form. In this case ap_00001 indicates the ID of the asserting party configured for Worklist Detail in the SAML Identity Asserter of the SOA domain, which provides the source site (WebCenter Spaces) and ITS details.
    Sign Assertions	Checked	Specifies whether generated assertions for this SAML Relying Party are signed.
    Include KeyInfo	Checked	Indicates whether a <ds:keyinfo> element containing the signing certificate should be included when signing assertions. The default value is true. This value is ignored if Sign Assertions is false.

    
    

11. Repeat steps 1 - 8 to configure a relying party for the Worklist SDP service using the settings shown in Table 14-1. Leave the remaining parameters on the Relying Parties pages set to their default values. Click Save when finished.

    Table 14-6 Relying Party Settings for Worklist SDP

    Parameter	Value	Description
    Enabled	Checked	The state of this SAML Relying Party.
    Description	WebCenter SDP	A short description of this Relying Party
    Target URL		The destination site URL for which authentication is requested (for example: http://example.com:8001/workflow/sdpmessagingsca-ui-worklist/faces/adf.task-flow).
    Assertion Consumer URL		The URL at which an Assertion Consumer Service for this SAML Relying Party can be reached (for example, http://exmple.com:8888/workflow/sdpmessagingsca-ui-worklist/samlacs/acs). Indicates the URL to which an assertion or artifact should be POSTed or redirected. Note: If you have checked ACS requires SSL while configuring destination site federation services, then use https protocol and the SSL port for the SOA managed server.
    Assertion Consumer Properties	APID=ap_00002	One or more optional query parameters, in the form name=value, that will be added to the ACS URL when redirecting to the destination site. In the case of POST profile, these parameters will be included as form variables when using the default POST form. In this case ap_00002 indicates the ID of the asserting party configured for the Worklist SDP application in the SAML Identity Asserter of the SOA domain, which provides the source site (WebCenter Spaces) and ITS details.
    Sign Assertions	Checked	Specifies whether generated assertions for this SAML Relying Party are signed.
    Include KeyInfo	Checked	Indicates whether a <ds:keyinfo> element containing the signing certificate should be included when signing assertions. The default value is true. This value is ignored if Sign Assertions is false.

    
    

12. Repeat steps 1 - 8 to configure a relying party for the Worklist Integration service using the settings shown in Table 14-1. Leave the remaining parameters on the Relying Parties pages set to their default values. Click Save when finished.

    Table 14-7 Relying Party Settings for Worklist Integration

    Parameter	Value	Description
    Enabled	Checked	The state of this SAML Relying Party.
    Description	WebCenter SDP	A short description of this Relying Party
    Target URL		The destination site URL for which authentication is requested (for example: http://example.com:8001/integration/worklistapp).
    Assertion Consumer URL		The URL at which an Assertion Consumer Service for this SAML Relying Party can be reached (for example, http://exmple.com:8888/workflow/sdpmessagingsca-ui-worklist/samlacs/acs). Indicates the URL to which an assertion or artifact should be POSTed or redirected. Note: If you have checked ACS requires SSL while configuring destination site federation services, then use https protocol and the SSL port for the SOA managed server.
    Assertion Consumer Properties	APID=ap_00003	One or more optional query parameters, in the form name=value, that will be added to the ACS URL when redirecting to the destination site. In the case of POST profile, these parameters will be included as form variables when using the default POST form. In this case ap_00003 indicates the ID of the asserting party configured the for Worklist Integration application in the SAML Identity Asserter of the SOA domain, which provides the source site (WebCenter Spaces) and ITS details.
    Sign Assertions	Checked	Specifies whether generated assertions for this SAML Relying Party are signed.
    Include KeyInfo	Checked	Indicates whether a <ds:keyinfo> element containing the signing certificate should be included when signing assertions. The default value is true. This value is ignored if Sign Assertions is false.

    
    

13. Repeat steps 1 - 8 to configure a relying party for the RSS application using the settings shown in Table 14-1. Leave the remaining parameters on the Relying Parties pages set to their default values. Click Save when finished.

    Table 14-8 Relying Party Settings for RSS

    Parameter	Value	Description
    Enabled	Checked	The state of this SAML Relying Party.
    Description	RSS	A short description of this Relying Party
    Target URL		The destination site URL for which authentication is requested (for example: http://example.com:8888/rss/rssservlet).
    Assertion Consumer URL		The URL at which an Assertion Consumer Service for this SAML Relying Party can be reached (for example, http://exmple.com:8888/rss/samlacs/acs). Indicates the URL to which an assertion or artifact should be POSTed or redirected. Note: If you have checked ACS requires SSL while configuring destination site federation services, then use https protocol and the SSL port for the WLS_Spaces managed server.
    Assertion Consumer Properties	APID=ap_00002	One or more optional query parameters, in the form name=value, that will be added to the ACS URL when redirecting to the destination site. In the case of POST profile, these parameters will be included as form variables when using the default POST form. In this case ap_00002 indicates the ID of the asserting party configured for RSS in the SAML Identity Asserter of the WebCenter domain, which provides the source site (WebCenter Spaces) and ITS details.
    Sign Assertions	Checked	Specifies whether generated assertions for this SAML Relying Party are signed.
    Include KeyInfo	Checked	Indicates whether a <ds:keyinfo> element containing the signing certificate should be included when signing assertions. The default value is true. This value is ignored if Sign Assertions is false.

    
    

14. Repeat steps 1 - 8 to configure a relying party for the Discussions application using the settings shown in Table 14-1. Leave the remaining parameters on the Relying Parties pages set to their default values. Click Save when finished.

    Table 14-9 Relying Party Settings for Discussions

    Parameter	Value	Description
    Enabled	Checked	The state of this SAML Relying Party.
    Description	Discussions	A short description of this Relying Party
    Target URL		The destination site URL for which authentication is requested (for example: http://example.com:8890/owc_discussions/admin/content-main.jsp).
    Assertion Consumer URL		The URL at which an Assertion Consumer Service for this SAML Relying Party can be reached (for example, http://exmple.com:8890/owc_discussions/samlacs/acs). Indicates the URL to which an assertion or artifact should be POSTed or redirected. Note: If you have checked ACS requires SSL while configuring destination site federation services, then use https protocol and the SSL port for the managed server.
    Assertion Consumer Properties	APID=ap_00003	One or more optional query parameters, in the form name=value, that will be added to the ACS URL when redirecting to the destination site. In the case of POST profile, these parameters will be included as form variables when using the default POST form. In this case ap_00003 indicates the ID of the asserting party configured for the Discussions application in the SAML Identity Asserter of the WebCenter domain, which provides the source site (WebCenter Spaces) and ITS details.
    Sign Assertions	Checked	Specifies whether generated assertions for this SAML Relying Party are signed.
    Include KeyInfo	Checked	Indicates whether a <ds:keyinfo> element containing the signing certificate should be included when signing assertions. The default value is true. This value is ignored if Sign Assertions is false.

    
    

14.7.3.2.5 Configuring Source Site Federation Services

This section describes how to create and configure source site Federation services.

To configure Source Site Federation Services:

1. Log in to the WLS Administration Console.

   For information on logging into the WLS Administration Console, see Section 1.12.2, "Oracle WebLogic Server Administration Console".

2. On the Domain Structure pane, expand the Environment node and click Servers.

   The Summary of Servers page displays (see Figure 14-99).

   Figure 14-99 Summary of Servers Page

   
   Description of "Figure 14-99 Summary of Servers Page"
   
   

3. Click WLS_Spaces and open the Configuration tab.

4. Open the Federation Services subtab and the SAML 1.1 Source Site subtab.

   The Federation Services Configuration SAML 1.1 Source Site Settings page for the WLS_Spaces server displays (see Figure 14-100).

   Figure 14-100 Federation Services Configuration SAML 1.1 Source Site Settings Page

   
   Description of "Figure 14-100 Federation Services Configuration SAML 1.1 Source Site Settings Page"
   
   

5. Configure the SAML source site attributes as shown in Figure 14-100. Leave the remaining parameters set to their default values.

   Table 14-10 Source Site Federation Services Parameters

   Parameter	Value	Description
   Source Site Enabled	Checked	Allow the WebLogic server instance to serve as a SAML source site by setting Source Site Enabled to true.
   Source Site URL		Set the URL for the SAML source site (for example, http://example.com:8888/webcenter). This is the URL that hosts the Intersite Transfer Service and Assertion Retrieval Service. The source site URL is encoded as a source ID in hex and Base64.
   Signing Key Alias		The SAML source site requires a trusted certificate with which to sign assertions. Add this certificate to the keystore and enter the alias (for example, testalias) to be used to access the certificate. The server's SSL identity key/certificates will be used by default if a signing alias and passphrase are not supplied.
   Signing Key Passphrase		The SAML source site requires a trusted certificate with which to sign assertions. Add this certificate to the keystore and enter the passphrase (for example, testkeypass) to be used to access the certificate. The server's SSL identity key/certificates will be used by default if a signing alias and passphrase are not supplied.
   Intersite Transfer URIs	/webcenter/samlits/its [add on top, leave the rest]	Specify the URIs for the Intersite Transfer Service. These URIs are also specified in the configuration of an Asserting Party.
   Assertion Retrieval URIs	/webcenter/samlars/ars [add on top, leave the rest]	N/A - URI for Assertion Retrieval Service used when artifact profile is used.
   ITS Requires SSL	Unchecked	Note: If you check this, then you need to change the Source Site ITS URL specified in the SAML Asserting Party configuration in the SAML Identity provider as HTTPS and the server's SSL port.
   ARS Requires SSL	Unchecked	Applicable only when Artifact profile is used

   
   

6. Click Save to save your settings when done.

7. Restart the WLS_Spaces managed server.

14.7.3.2.6 Configuring the SAML Identity Assertion Provider

This section describes how to create and configure a SAML Identity Assertion Provider V2 instance (the SAML Identity Assertion provider is not part of the default security realm). This section also describes how to establish trust by registering the source site's SSL certificate in the certificate registry maintained by the SAML Identity Assertion provider.

To create a SAML Identity Assertion Provider

1. Log in to the WLS Administration Console.

   For information on logging into the WLS Administration Console, see Section 1.12.2, "Oracle WebLogic Server Administration Console".

2. From the Domain Structure pane, click Security Realms.

   The Summary of Security Realms pane displays (see Figure 14-101).

   Figure 14-101 Summary of Security Realms Pane

   
   Description of "Figure 14-101 Summary of Security Realms Pane"
   
   

3. Click your security realm.

   The Settings page for the security realm displays (see Figure 14-102).

   Figure 14-102 Security Realm Settings Page

   
   Description of "Figure 14-102 Security Realm Settings Page"
   
   

4. Open the Providers tab and select the Authentication subtab.

   The Authentication Settings pane displays (see Figure 14-103).

   Figure 14-103 Authentication Settings Pane

   
   Description of "Figure 14-103 Authentication Settings Pane"
   
   

5. Click New.

   The Create a New Authentication Provider page displays (see Figure 14-104).

   Figure 14-104 Create a New Authentication Provider Page

   
   Description of "Figure 14-104 Create a New Authentication Provider Page"
   
   

6. Enter a Name for the new SAML Identity Asserter, and select the Type as SAMLIdentityAsserterV2.

7. Click OK to save your settings.

8. Restart the WebLogic Administration server if indicated in the Messages area.

9. Go to the SOA domain and create a SAML Identity Asserter provider there as well using the steps above.

To configure a certificate for the SAML ID Asserter

1. Log in to the WLS Administration Console.

   For information on logging into the WLS Administration Console, see Section 1.12.2, "Oracle WebLogic Server Administration Console".

2. From the Domain Structure pane, click Security Realms.

   The Summary of Security Realms pane displays (see Figure 14-105).

   Figure 14-105 Summary of Security Realms Pane

   
   Description of "Figure 14-105 Summary of Security Realms Pane"
   
   

3. Click your security realm.

   The Settings page for the security realm displays (see Figure 14-106).

   Figure 14-106 Security Realm Settings Page

   
   Description of "Figure 14-106 Security Realm Settings Page"
   
   

4. Open the Providers tab and select the Authentication subtab.

   The Authentication Settings pane displays (see Figure 14-107).

   Figure 14-107 Authentication Settings Pane

   
   Description of "Figure 14-107 Authentication Settings Pane"
   
   

5. Click the SAML Identity Asserter you created and open the Management tab and the Certificates subtab.

   The Certificate Settings pane displays (see Figure 14-108).

   Figure 14-108 Certificate Settings Pane

   
   Description of "Figure 14-108 Certificate Settings Pane"
   
   

6. Click New.

   The Create a New Identity Asserter Certificate page displays (see Figure 14-109).

   Figure 14-109 Create a New Identity Asserter Certificate Page

   
   Description of "Figure 14-109 Create a New Identity Asserter Certificate Page"
   
   

7. Configure the certificate as shown in Table 14-11.

   Table 14-11 Certificates Page Parameters

   Parameter	Value	Description
   alias		The name to assign to your new Certificate This is the alias of the keystore you created in Section 14.7.3.2.2, "Generating and Registering Certificates".
   Path		Specify the path name of the .der file containing the X509 certificate you wish to import. This is the file you created in Section 14.7.3.2.2, "Generating and Registering Certificates".

   
   

8. Click OK to save your settings.

9. Repeat the previous step for the SAML ID Asserter created in the SOA domain. Be sure to copy over testalias.der (assuming that this was the name given to your .DER file) from your WebLogic Home to the machine hosting the SOA domain.

To Configure an Asserting Party

1. Log in to the WLS Administration Console.

   For information on logging into the WLS Administration Console, see Section 1.12.2, "Oracle WebLogic Server Administration Console".

2. From the Domain Structure pane, click Security Realms.

   The Summary of Security Realms pane displays (see Figure 14-110).

   Figure 14-110 Summary of Security Realms Pane

   
   Description of "Figure 14-110 Summary of Security Realms Pane"
   
   

3. Click your security realm.

   The Settings page for the security realm displays (see Figure 14-111).

   Figure 14-111 Security Realm Settings Page

   
   Description of "Figure 14-111 Security Realm Settings Page"
   
   

4. Open the Providers tab and select the Authentication subtab.

   The Authentication Settings pane displays (see Figure 14-112).

   Figure 14-112 Authentication Settings Pane

   
   Description of "Figure 14-112 Authentication Settings Pane"
   
   

5. Click the SAML Identity Asserter you created and open the Management tab and the Asserting Parties subtab.

   The Asserting Parties Settings pane displays (see Figure 14-113).

   Figure 14-113 Asserting Parties Settings Pane

   
   Description of "Figure 14-113 Asserting Parties Settings Pane"
   
   

6. Click New.

   The Create a New Asserting Party page displays (see Figure 14-114).

   Figure 14-114 Create a New Asserting Party Page

   
   Description of "Figure 14-114 Create a New Asserting Party Page"
   
   

7. Select the Profile and provide a Description for the Asserting Party.

   Use the same SAML profile you chose for the corresponding relying party (for example, Browser/POST).

8. Click OK to save your settings.

9. From the Asserting Parties Settings pane, click the Partner ID of the Asserting Party you just created (the Partner ID is assigned automatically).

   The Settings page for the new Asserting Party displays (see Figure 14-115).

   Figure 14-115 Asserting Party Settings Page

   
   Description of "Figure 14-115 Asserting Party Settings Page"
   
   

10. Configure the Asserting Party for the WC domain Wiki service as shown in Table 14-12. For more information, see Table 14-4, "Relying Party Settings for Wiki Service".

    Table 14-12 WC Domain - Asserting Party for Wiki

    Parameter	Value	Description
    Enabled	Checked	Specifies whether this Asserting Party can be used to obtain SAML assertions
    Description		A short description of this Asserting Party (for example, WebCenter Spaces for Wiki)
    Target URL		The target URL of this SAML Asserting Party (for example, http://example.com:8888/webcenter)
    POST Signing Certificate alias		The alias of the certificate trusted for verifying signatures on SAML protocol elements from this Asserting Party (for example, testalias). Must be set when using the Browser/POST profile.
    Source Site Redirect URIs	/owc_wiki/user/login.jz	An optional set of URIs from which unauthenticated users will be redirected to the configured ITS URL. If set, the IntersiteTransferURL must also be set. Note: Based on this setting, when you first access the destination site, you are redirected to the configured ITS URL (which in this case is within the source application), your session is established with the source application and then redirected to the destination site.
    Source Site ITS URL		The Intersite Transfer Service (ITS) URL of the SAML Source Site for this Asserting Party (for example, http://example.com:8888/webcenter/samlits/its). Used with SSO profiles only, to support the destination site first scenario, whereby a user tries to access a destination site URL prior to being authenticated and is redirected to the source site to be authenticated and obtain a SAML assertion. The Redirect URIs attribute must also be configured for source-site redirection to work. Note: If you check ITS requires SSL in Source Site Federation Services, you must also change the Source Site ITS URL to use HTTPS and the server's SSL port.
    Source Site ITS parameters	RPID=rp_00001	Optionally, zero or more query parameters, of the form name=value, that will be added to the ITS URL when redirecting to the source site. In this case, rp_00001 is the relying party ID for the OWC Wiki application specified in the SAML Credential Mapping Provider of the WebCenter domain which provides the destination site details. For more information, see Table 14-4, "Relying Party Settings for Wiki Service".
    Issuer URI		The issuer URI of the SAML Authority issuing assertions for this SAML Asserting Party (for example, http://www.example.com/webcenter).
    Signature Required	Checked	If true, assertions must be signed. If false, signature elements are not required, but will be verified if present.
    Assertion Signing Certificate alias		The alias of the certificate trusted for verifying signatures on assertions from this Asserting Party (for example, testalias). This must be set if Signature Required is checked. The certificate must also be registered in the SAML Identity Asserter's certificate registry.

    
    

11. Click Save to save your settings.

12. Repeat steps 1 - 11 using the settings shown in Table 14-13 to configure the Asserting party for the WC domain RSS application.

    Table 14-13 WC Domain - Asserting Party for RSS

    Parameter	Value	Description
    Enabled	Checked	Specifies whether this Asserting Party can be used to obtain SAML assertions.
    Description		A short description of this Asserting Party (for example, WebCenter Spaces for RSS)
    Target URL		The target URL of this SAML Asserting Party (for example, http://example.com:8888/webcenter)
    POST Signing Certificate alias		The alias of the certificate trusted for verifying signatures on SAML protocol elements from this Asserting Party (for example, testalias). Must be set when using the Browser/POST profile.
    Source Site Redirect URIs	/rss/rssservlet	An optional set of URIs from which unauthenticated users will be redirected to the configured ITS URL. If set, the IntersiteTransferURL must also be set. Note: Based on this setting, when you first access the destination site, you are redirected to the configured ITS URL (which in this case is within the source application), your session is established with the source application and then redirected to the destination site.
    Source Site ITS URL		The Intersite Transfer Service (ITS) URL of the SAML Source Site for this Asserting Party (for example, http://example.com:8888/webcenter/samlits/its). Used with SSO profiles only, to support the destination site first scenario, whereby a user tries to access a destination site URL prior to being authenticated and is redirected to the source site to be authenticated and obtain a SAML assertion. The Redirect URIs attribute must also be configured for source-site redirection to work. Note: If you check ITS requires SSL in Source Site Federation Services, you must also change the Source Site ITS URL to use HTTPS and the server's SSL port.
    Source Site ITS parameters	RPID=rp_00002	Optionally, zero or more query parameters, of the form name=value, that will be added to the ITS URL when redirecting to the source site. In this case rp_00005 is the relying party ID for RSS specified in the SAML Credential Mapping provider of the WebCenter domain which provides the destination site details. See Table 14-8, "Relying Party Settings for RSS" for more information about RSS settings.
    Issuer URI		The issuer URI of the SAML Authority issuing assertions for this SAML Asserting Party (for example, http://www.example.com/webcenter).
    Signature Required	Checked	If true, assertions must be signed. If false, signature elements are not required, but will be verified if present.
    Assertion Signing Certificate alias		The alias of the certificate trusted for verifying signatures on assertions from this Asserting Party (for example, testalias). This must be set if Signature Required is checked. The certificate must also be registered in the SAML Identity Asserter's certificate registry.

    
    

13. Repeat steps 1 - 11 using the settings shown in Table 14-14 to configure the Asserting party for the WC domain Discussions application.

    Table 14-14 WC Domain - Asserting Party for RSS

    Parameter	Value	Description
    Enabled	Checked	Specifies whether this Asserting Party can be used to obtain SAML assertions.
    Description		A short description of this Asserting Party (for example, WebCenter Spaces for Discussions)
    Target URL		The target URL of this SAML Asserting Party (for example, http://example.com:8888/webcenter)
    POST Signing Certificate alias		The alias of the certificate trusted for verifying signatures on SAML protocol elements from this Asserting Party (for example, testalias). This must be set when using the Browser/POST profile.
    Source Site Redirect URIs	/owc_discussions/admin/content-main.jsp /owc_discussions/login!withRedirect.jspa /owc_discussions/login!default.jspa /owc_discussions/login.jspa	An optional set of URIs from which unauthenticated users will be redirected to the configured ITS URL. If set, the IntersiteTransferURL must also be set. Note: Based on this setting, when you first access the destination site, you are redirected to the configured ITS URL (which in this case is within the source application), your session is established with the source application and then redirected to the destination site.
    Source Site ITS URL		The Intersite Transfer Service (ITS) URL of the SAML Source Site for this Asserting Party (for example, http://example.com:8888/webcenter/samlits/its). Used with SSO profiles only, to support the destination site first scenario, whereby a user tries to access a destination site URL prior to being authenticated and is redirected to the source site to be authenticated and obtain a SAML assertion. The Redirect URIs attribute must also be configured for source-site redirection to work. Note: If you check ITS requires SSL in Source Site Federation Services, you must also change the Source Site ITS URL to use HTTPS and the server's SSL port.
    Source Site ITS parameters	RPID=rp_00006	Optionally, zero or more query parameters, of the form name=value, that will be added to the ITS URL when redirecting to the source site. In this case rp_00006 is the relying party ID for OWC Discussions specified in the SAML Credential Mapping provider of the WebCenter domain which provides the destination site details. See Table 14-8, "Relying Party Settings for RSS" for more information about RSS settings.
    Issuer URI		The issuer URI of the SAML Authority issuing assertions for this SAML Asserting Party (for example, http://www.example.com/webcenter).
    Signature Required	Checked	If true, assertions must be signed. If false, signature elements are not required, but will be verified if present.
    Assertion Signing Certificate alias		The alias of the certificate trusted for verifying signatures on assertions from this Asserting Party (for example, testalias). This must be set if Signature Required is checked. The certificate must also be registered in the SAML Identity Asserter's certificate registry.

    
    

14. Change domains to the SOA domain and repeat steps 1 - 11 using the settings shown in Table 14-15 to configure the Asserting Party for the SOA domain Worklist Community Detail service.

    Table 14-15 SOA Domain - Asserting Party for Worklist Community Detail

    Parameter	Value	Description
    Enabled	Checked	Specifies whether this Asserting Party can be used to obtain SAML assertions
    Description		A short description of this Asserting Party (for example, WebCenter Spaces for Worklist Detail)
    Target URL		The target URL of this SAML Asserting Party (for example, http://example.com:8888/webcenter)
    POST Signing Certificate alias		The alias of the certificate trusted for verifying signatures on SAML protocol elements from this Asserting Party (for example, testalias). Must be set when using Browser/POST profile.
    Source Site Redirect URIs	/workflow/WebCenterWorklistDetail/faces/adf.task-flow	An optional set of URIs from which unauthenticated users will be redirected to the configured ITS URL. If set, the IntersiteTransferURL must also be set. Note: Based on this setting, when you first access the destination site, you are redirected to the configured ITS URL (which in this case is within the source application), your session is established with the source application and then redirected to the destination site.
    Source Site ITS URL		The Intersite Transfer Service (ITS) URL of the SAML Source Site for this Asserting Party (for example, http://example.com:8888/webcenter/samlits/its). Used with SSO profiles only, to support the destination site first scenario, whereby a user tries to access a destination site URL prior to being authenticated and is redirected to the source site to be authenticated and obtain a SAML assertion. The Redirect URIs attribute must also be configured for source-site redirection to work. Note: If you check ITS requires SSL in Source Site Federation Services, you must also change the Source Site ITS URL to use HTTPS and the server's SSL port.
    Source Site ITS parameters	RPID=rp_00001	Optionally, zero or more query parameters, of the form name=value, that will be added to the ITS URL when redirecting to the source site. In this case rp_00002 is the relying party ID for the Worklist Detail application specified in the SAML Credential Mapping provider for the WebCenter domain, which provides the destination site details. For more information, see Table 14-5, "Relying Party Settings for Worklist Community Detail".
    Issuer URI		The issuer URI of the SAML Authority issuing assertions for this SAML Asserting Party (for example, http://www.example.com/webcenter).
    Signature Required	Checked	If checked, assertions must be signed. If unchecked, signature elements are not required, but will be verified if present.
    Assertion Signing Certificate alias		The alias of the certificate trusted for verifying signatures on assertions from this Asserting Party (for example, testalias). This must be set if Signature Required is checked. The certificate must also be registered in the SAML Identity Asserter's certificate registry.

    
    

15. Change domains to the SOA domain and repeat steps 1 - 11 using the settings shown in Table 14-16 to configure the Asserting Party for the SOA domain Worklist SDP service. For more information see Table 14-6, "Relying Party Settings for Worklist SDP" and Table 14-7, "Relying Party Settings for Worklist Integration".

    Table 14-16 SOA Domain - Asserting Party for Worklist SDP

    Parameter	Value	Description
    Enabled	Checked	Specifies whether this Asserting Party can be used to obtain SAML assertions.
    Description		A short description of this Asserting Party (for example, WebCenter Spaces for Worklist SDP)
    Target URL		The target URL of this SAML Asserting Party (for example, http://example.com:8888/webcenter)
    POST Signing Certificate alias		The alias of the certificate trusted for verifying signatures on SAML protocol elements from this Asserting Party (for example, testalias). Must be set when using Browser/POST profile.
    Source Site Redirect URIs	/workflow/sdpmessagingsca-ui-worklist/faces/adf.task-flow	An optional set of URIs from which unauthenticated users will be redirected to the configured ITS URL. If set, the IntersiteTransferURL must also be set. Note: Based on this setting, when you first access the destination site, you are redirected to the configured ITS URL (which in this case is within the source application), your session is established with the source application and then redirected to the destination site.
    Source Site ITS URL		The Intersite Transfer Service (ITS) URL of the SAML Source Site for this Asserting Party (for example, http://example.com:8888/webcenter/samlits/its). Used with SSO profiles only, to support the destination site first scenario, whereby a user tries to access a destination site URL prior to being authenticated and is redirected to the source site to be authenticated and obtain a SAML assertion. The Redirect URIs attribute must also be configured for source-site redirection to work. Note: If you check ITS requires SSL in Source Site Federation Services, you must also change the Source Site ITS URL to use HTTPS and the server's SSL port.
    Source Site ITS parameters	RPID=rp_00002	Optionally, zero or more query parameters, of the form name=value, that will be added to the ITS URL when redirecting to the source site. In this case rp_00003 is the relying party ID for the Worklist SDP application specified in the SAML Credential Mapping provider of the WebCenter domain, which provides the destination site details. For more information, see Table 14-6, "Relying Party Settings for Worklist SDP".
    Issuer URI		The issuer URI of the SAML Authority issuing assertions for this SAML Asserting Party (for example, http://www.example.com/webcenter).
    Signature Required	Checked	If true, assertions must be signed. If false, signature elements are not required, but will be verified if present.
    Assertion Signing Certificate alias		The alias of the certificate trusted for verifying signatures on assertions from this Asserting Party (for example, testalias). This must be set if Signature Required is checked. The certificate must also be registered in the SAML Identity Asserter's certificate registry.

    
    

16. Change domains to the SOA domain and repeat steps 1 - 11 using the settings shown in Table 14-17 to configure the Asserting Party for the SOA domain Worklist Community Integration service.

    Table 14-17 In SOA Domain, Asserting party For Worklist Integration

    Parameter	Value	Description
    Enabled	Checked	Specifies whether this Asserting Party can be used to obtain SAML assertions
    Description	WebCenter Spaces for Worklist SDP	A short description of this Asserting Party (for example, WebCenter Spaces for Worklist SDP)
    Target URL		The target URL of this SAML Asserting Party (for example, http://example.com:8888/webcenter)
    POST Signing Certificate alias		The alias of the certificate trusted for verifying signatures on SAML protocol elements from this Asserting Party (for example, testalias). Must be set when using Browser/POST profile.
    Source Site Redirect URIs	/integration/worklistapp/ssologin /integration/worklistapp/faces/home.jspx	An optional set of URIs from which unauthenticated users will be redirected to the configured ITS URL. If set, the IntersiteTransferURL must also be set. Note: Based on this setting, when you first access the destination site, you are redirected to the configured ITS URL (which in this case is within the source application), your session is established with the source application and then redirected to the destination site.
    Source Site ITS URL		The Intersite Transfer Service (ITS) URL of the SAML Source Site for this Asserting Party (for example, http://example.com:8888/webcenter/samlits/its). Used with SSO profiles only, to support the destination site first scenario, whereby a user tries to access a destination site URL prior to being authenticated and is redirected to the source site to be authenticated and obtain a SAML assertion. The Redirect URIs attribute must also be configured for source-site redirection to work. Note: If you check ITS requires SSL in Source Site Federation Services, you must also change the Source Site ITS URL to use HTTPS and the server's SSL port.
    Source Site ITS parameters	RPID=rp_00003	Optionally, zero or more query parameters, of the form name=value, that will be added to the ITS URL when redirecting to the source site. In this case rp_00004 is the relying party ID for the Worklist Integration application specified in the SAML Credential Mapping provider of the WebCenter domain, which provides the destination site details. For more information, see Table 14-7, "Relying Party Settings for Worklist Integration".
    Issuer URI		The issuer URI of the SAML Authority issuing assertions for this SAML Asserting Party (for example, http://www.example.com/webcenter).
    Signature Required	Checked	If true, assertions must be signed. If false, signature elements are not required, but will be verified if present.
    Assertion Signing Certificate alias		The alias of the certificate trusted for verifying signatures on assertions from this Asserting Party (for example, testalias). This must be set if Signature Required is checked. The certificate must also be registered in the SAML Identity Asserter's certificate registry.

    
    

14.7.3.2.7 Configuring Destination Site Federation Services

This section describes how to configure the Destination Site Federation Services for the Wiki service, RSS, and the Worklist service on the SOA domain.

To configure the Destination Site Federation Services:

1. Log in to the WLS Administration Console.

   For information on logging into the WLS Administration Console, see Section 1.12.2, "Oracle WebLogic Server Administration Console".

2. On the Domain Structure pane, expand the Environment node and click Servers.

   The Summary of Servers page displays (see Figure 14-116).

   Figure 14-116 Summary of Servers Page

   
   Description of "Figure 14-116 Summary of Servers Page"
   
   

3. Click WLS_Services (the managed server where the Wiki service and Discussions service are deployed) and open the Configuration tab.

4. Open the Federation Services tab and the SAML 1.1 Destination Site subtab.

   The SAML 1.1 Destination Site Settings pane displays (see Figure 14-117).

   Figure 14-117 SAML 1.1 Destination Site Settings Pane (Wiki and Discussions)

   
   Description of "Figure 14-117 SAML 1.1 Destination Site Settings Pane (Wiki and Discussions)"
   
   

5. Configure the SAML destination site attributes for the Wiki and Discussions applications as shown in Table 14-18.

   Table 14-18 SAML Destination Site Attributes (Wiki and Discussions)

   Parameter	Value	Description
   Destination Site Enabled	Checked	Specifies whether the Destination Site is enabled.
   ACS Requires SSL	Unchecked	Specifies whether the Assertion Consumer Service requires SSL. If checked, then ensure that the ACS URL specified in the Credential Mapper's relying party uses HTTPS and target server's SSL port.
   Assertion Consumer URIs	/owc_wiki/samlacs/acs/owc_discussions/samlacs/acs[add on top, leave rest as is]	The Assertion Consumer URIs. In this case, we have chosen for the ACS to reside within the target app so that it uses the same login cookie.
   POST Recipient Check Enabled	Checked	Specifies whether the POST recipient check is enabled. When checked, the recipient of the SAML Response must match the URL in the HTTP Request.
   POST One use Check Enabled	Checked	Specifies whether the POST one-use check is enabled.

   
   

6. Click Save to save your settings, and restart the WLS_Services server so that they take effect.

7. From the Domain Structure pane, expand the Environment node and click Servers.

8. Click WLS_Spaces (the managed server where RSS is deployed) and open the Configuration tab.

9. Open the Federation Services tab and the SAML 1.1 Destination Site subtab.

   The SAML 1.1 Destination Site Settings pane displays (see Figure 14-118).

   Figure 14-118 SAML 1.1 Destination Site Settings Pane (RSS)

   
   Description of "Figure 14-118 SAML 1.1 Destination Site Settings Pane (RSS)"
   
   

10. Configure the SAML destination site attributes for RSS as shown in Table 14-19.

    Table 14-19 SAML Destination Site Attributes (RSS)

    Parameter	Value	Description
    Destination Site Enabled	Checked	Specifies whether the Destination Site is enabled.
    ACS Requires SSL	Unchecked	Specifies whether the Assertion Consumer Service requires SSL. If checked, then ensure that ACS URL specified in Credential Mapper's relying party uses https and target server's SSL port.
    Assertion Consumer URIs	/rss/samlacs/acs (add on top, leave rest as is)	The Assertion Consumer URIs. In this case, we have chosen for the ACS to reside within the target app so that it uses the same login cookie.
    POST Recipient Check Enabled	Checked	Specifies whether the POST recipient check is enabled. When true, the recipient of the SAML Response must match the URL in the HTTP Request.
    POST One use Check Enabled	Checked	Specifies whether the POST one-use check is enabled.

    
    

11. Click Save to save your settings, and restart the WSL_Spaces server so that they take effect.

12. Navigate to the SOA domain and then to soa_server1, or the managed server where the Worklist applications are deployed.

13. Follow the same steps as above to open the SAML 1.1 Destination Site subtab.

    The SAML 1.1 Destination Site Settings pane displays (see Figure 14-119).

    Figure 14-119 SAML 1.1 Destination Site Settings Pane (Worklist Detail and SDP)

    
    Description of "Figure 14-119 SAML 1.1 Destination Site Settings Pane (Worklist Detail and SDP)"
    
    

14. Configure the SAML 1.1 Destination Site attributes for Worklist Detail and SDP as shown in Table 14-20.

    Table 14-20 SOA Domain - SAML Destination Site Attributes (Worklist Detail and SDP)

    Parameter	Value	Description
    Destination Site Enabled	Checked	Specifies whether the Destination Site is enabled.
    ACS Requires SSL	Unchecked	Specifies whether the Assertion Consumer Service requires SSL. If checked, then ensure that ACS URL specified in Credential Mapper's relying party uses HTTPS and the target server's SSL port.
    Assertion Consumer URIs	/workflow/WebCenterWorklistDetail/samlacs/acs /workflow/sdpmessagingsca-ui-worklist/samlacs/acs /integration/worklistapp/samlacs/acs (add on top, leave rest as is)	The Assertion Consumer URIs. In this case, we have chosen for the ACS to reside within the target app so that it uses the same login cookie.
    POST Recipient Check Enabled	Checked	Specifies whether the POST recipient check is enabled. When checked, the recipient of the SAML Response must match the URL in the HTTP Request.
    POST One use Check Enabled	Checked	Specifies whether the POST one-use check is enabled.

    
    

15. Click Save to save your settings.

16. Restart the SOA managed server.

14.7.3.2.8 Checking Your Configuration

The last step in the process is to check that your single sign-on configuration is working. To do that:

1. Check that when you try to access the Wiki and RSS applications independently, you are taken to the WebCenter Spaces login page (source site) and then directed to the URL you were trying to access.

2. Now log into WebCenter Spaces and check that you're not challenged for credentials when:

   • You access the Wiki from a group space

   • You access RSS from a list task flow

   • You click Forum Administration from Group Space Settings > Services > Discussions (assuming this service is provisioned for the group space)

   • You click a Forum from Group Space Settings from Discussions

14.7.3.2.9 Configuring the Discussions Server for SAML SSO

To configure the discussions server for SAML single sign-on, be sure to perform these steps:

1. Deploy the SSO-enabled discussions server as described in Section 14.7.1.7.2, "Deploying the Discussions Server"

2. Configure a relying party for the Discussions application as described in Section 14.7.3.2.4, "Configuring a Relying Party"

3. Configure an asserting party for the Discussions application as described in Section 14.7.3.2.6, "Configuring the SAML Identity Assertion Provider".

4. Configure the Discussions application in the destination site federation services as described in Section 14.7.3.2.7, "Configuring Destination Site Federation Services"

14.7.4.3.1 Configuring the Negotiate Identity Assertion Provider

This section provides instructions for creating and configuring a Negotiate Identity Assertion provider. The Negotiate Identity Assertion provider enables single sign-on (SSO) with Microsoft clients. The identity assertion provider decodes Simple and Protected Negotiate (SPNEGO) tokens to obtain Kerberos tokens, validates the Kerberos tokens, and maps them to WebLogic users. The Negotiate Identity Assertion provider uses the Java Generic Security Service (GSS) Application Programming Interface (API) to accept the GSS security context via Kerberos.

To configure the Negotiate Identity Assertion provider:

1. Log in to the WLS Administration Console.

   For information on logging into the WLS Administration Console, see Section 1.12.2, "Oracle WebLogic Server Administration Console".

2. From the Domain Structure pane, click Security Realms.

   The Summary of Security Realms pane displays (see Figure 14-123).

   Figure 14-123 Summary of Security Realms Pane

   
   Description of "Figure 14-123 Summary of Security Realms Pane"
   
   

3. Click your security realm.

   The Settings page for the security realm displays (see Figure 14-124).

   Figure 14-124 Security Realm Settings Page

   
   Description of "Figure 14-124 Security Realm Settings Page"
   
   

4. Open the Providers tab and select the Authentication subtab.

   The Authentication Settings pane displays (see Figure 14-125).

   Figure 14-125 Authentication Settings Pane

   
   Description of "Figure 14-125 Authentication Settings Pane"
   
   

5. Click New.

   The Create a New Authentication Provider pane displays (see Figure 14-126).

   Figure 14-126 Create a New Authentication Provider Pane

   
   Description of "Figure 14-126 Create a New Authentication Provider Pane"
   
   

6. Enter a Name for the identity asserter, and select NegotiateIdentityAsserter as the Type.

7. Click OK.