Create SAML 1.1 / OpenID 2.0 SP Partners in OIF/ IdP

This article is a continuation of my previous entry where I discussed how to create SAML 2.0 SP Partners in OIF/IdP. In this article, I will cover how to set up a Federation agreement between OIF acting as an IdP and a remote SP Partner via the SAML 1.1 or OpenID 2.0 protocols:

  • Set up a remote SAML 1.1 SP Partner
  • Set up a remote OpenID 2.0 SP Partner

The article will describe how to perform the above tasks either via the UI, or via the use of the OIF WLST commands.

Establishing Federation Trust


Establishing Trust between Federation partners is a pre-requisite before being able to perform any Federation SSO operation between the Federation servers.

Trust establishment involves exchanging certificate information, if the protocol used relies on PKI X.509 certificates to secure message exchanges, as well as the locations/URLs of the services implementing the federation protocol.

SAML 1.1


OAM Administration Console

  • To create a new SAML 1.1 SP Partner, execute the following steps (ensure first that you have all the data from the SP partner, such as certificates, SP identifiers and URLs):
  • Go to the OAM Administration Console: http(s)://oam-admin-host:oam-admin-port/oamconsole
  • Navigate to Identity Federation -> Identity Provider Administration
  • Click on the “Create Service Provider Partner” button
  • In the Create screen:
    • Enter a name for the partner
    • Select SAML 1.1 as the Protocol
    • Enter the Issuer / ProviderID of the SP Partner. In case the SP Partner does not have an Issuer (if the partner is only an SP, and not and IdP and SP), enter the Assertion Consumer Service URL
    • Enter the Assertion Consumer Service URL for that SP Partner: this is the URL where the user will be redirected from OIF/IdP with the SAML Assertion.
    • If the SP Partner will sign SAML messages, upload the Signing Certificate file:
      • either in PEM format (where the file contains as the first line -----BEGIN CERTIFICATE-----, then the certificate in Base64 encoded format, then the last line as -----END CERTIFICATE-----)
      • or in DER format where the certificate is stored in binary encoding
    • Enter how the NameID value will be set:
      • If selecting User ID Store Attribute, this means that the NameID value will be set to the LDAP Attribute specified in the field next to the drop down
      • If selecting Expression, this means that the NameID value will be set based on the expression specified in the field next to the drop down. See my next article on how to Configure IdP to send Attributes for more information on expressions.
    • Select the Attribute Profile that will be used to populate the SAML Assertion with attributes.
    • Click Save


After the partner is created, the “Edit Partner” screen will be shown with:

  • The settings set in the previous screen modifiable
  • An Advanced Settings section displayed:
    • SSO Response Binding: how the Assertion should be sent to the SP, if the SP did not request any particular binding
    • Note: the “Attribute Query User Mapping” sub-section is only relevant to the SAML Attribute Authority/Request flow, when the SAML Attribute Query exchange is exercised. This flow is not part of the Federation SSO flow.

WLST

To create a new SAML 1.1 SP Partner using the OIF WLST commands, execute the following steps (ensure first that you have all the data from the SP partner, such as certificates, SP identifiers and URLs):

  • Enter the WLST environment by executing:
    $IAM_ORACLE_HOME/common/bin/wlst.sh
  • Connect to the WLS Admin server:
    connect()
  • Navigate to the Domain Runtime branch:
    domainRuntime()
  • Create SAML 1.1 SP Partner that will be called acmeSP in OIF:
    addSAML11SPFederationPartner("acmeSP", "https://sp.com", "https://sp.com/saml11/sso")
  • By default, the new SP partner will be configured to:
    • Use Email Address as the NameID format
    • User the mail LDAP user attribute as the NameID value
    • Use HTTP-POST as the Default SSO Response Binding
    • Use the default Service Provider Attribute Profile
    • No certificate has been uploaded for this SP partner
  • Exit the WLST environment:
    exit()

Modifying Federation Settings via WLST

In this section, I will list how to change the common SP Partner settings via the OIF WLST commands:

  • SAML Signing Certificate
  • SP Partner Attribute Profile for an SP Partner
  • SAML NameID settings
  • SAML SSO Request and Response bindings

I will assume that you are already in the WLST environment and connected using:

  • Enter the WLST environment by executing:
    $IAM_ORACLE_HOME/common/bin/wlst.sh
  • Connect to the WLS Admin server:
    connect()
  • Navigate to the Domain Runtime branch:
    domainRuntime()

SAML Signing Certificate

There are various WLST commands available to manage signing and encryption certificates:

  • getFederationPartnerSigningCert() which prints the partner’s signing certificate in Base64 encoded format:
    getFederationPartnerSigningCert("acmeSP", "sp")
    • With acmeSP being the name of partner created earlier
    • sp indicates the partner type
  • setFederationPartnerSigningCert() which uploads the signing certificate file passed as a parameter to the SP Partner configuration:
    setFederationPartnerSigningCert("acmeSP", "sp", "/tmp/cert.file")
    • With acmeSP being the name of partner created earlier
    • sp indicates the partner type
    • the third parameter indicates the location on the file system of the file containing the certificate:
      • either in PEM format (where the file contains as the first line -----BEGIN CERTIFICATE-----, then the certificate in Base64 encoded format, then the last line as -----END CERTIFICATE-----)
      • or in DER format where the certificate is stored in binary encoding
  • deleteFederationPartnerSigningCert() which removes the signing certificate from the SP partner entry:
    deleteFederationPartnerSigningCert("acmeSP", "sp")
    • With acmeSP being the name of partner created earlier
    • sp indicates the partner type

SP Partner Attribute Profile

To configure the SP Partner Attribute Profile for a specific SP Partner, use the following commands:

  • To configure an SP Partner to use a specific SP Partner Attribute Profile, execute:
    setSPPartnerAttributeProfile(partnerName, attrProfileID)
    • partnerName is the name that was used to create the SP Partner
    • attrProfileID is the SP Partner Attribute Profile ID
  • To list the existing the SP Partner Attribute Profiles, execute:
    listSPPartnerAttributeProfileIDs()

SAML SSO Request and Response bindings

To configure the SAML bindings for a specific SP Partner, use the following commands:

  • To configure the SP partner, execute:
    configureSAMLBinding(partnerName, partnerType, binding, ssoResponseBinding="httppost")
    • partnerName is the name that was used to create the SP Partner
    • partnerType should be set to "sp" since the partner is an SP
    • binding: this only applies to SAML 2.0. Use httppost
    • ssoResponseBinding: The binding to use to send the SAML Assertion back to the SP; httppost for HTTP-POST binding, or artifact for Artifact binding

SAML NameID Settings

To configure NameID settings for a SAML SP Partner:

  • Use the following command:
    setSPSAMLPartnerNameID(partnerName, nameIDFormat, nameIDValue="", customFormat="", nameIDValueComputed="false")
    • partnerName is the name that was used to create the SP Partner
    • nameIDFormat: possible values are
      • orafed-emailaddress for urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
      • orafed-x509 for urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName
      • orafed-windowsnamequalifier for urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName
      • orafed-unspecified for urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
      • orafed-custom for a custom NameID format that will be specified in the customFormat parameter.
    • customFormat containing the format to be used, if nameIDFormat was set to orafed-custom
    • nameIDValueComputed: this setting is for SAML 2.0 only. Set it to false.

OpenID 2.0


OAM Administration Console

To create a new OpenID 2.0 SP/RP Partner, execute the following steps (ensure first that you have all the data from the SP partner, such as SP/RP realm and URLs):

  • Go to the OAM Administration Console: http(s)://oam-admin-host:oam-admin-port/oamconsole
  • Navigate to Identity Federation -> Identity Provider Administration
  • Click on the “Create Service Provider Partner” button
  • In the Create screen:
    • Enter a name for the partner
    • Select OpenID 2.0 as the Protocol
    • Enter the realm of the RP/SP Partner.
    • Enter the OpenID endpoint URL for that RP Partner: this is the URL where the user will be redirected from OIF/IdP with the OpenID Response.
    • Select the Attribute Profile that will be used to populate the OpenID Response with attributes.
    • Click Save


After the partner is created, the “Edit Partner” screen will be shown with the same information displayed in the “Create Partner” screen.

The OpenID 2.0 protocol mainly relies on user attributes being shared between the OP and the RP during the OpenID 2.0 SSO exchange. OIF/IdP achieves this via the SP Attribute Profile that will indicate which attributes will be added to the SSO response and how those attributes should be set. In my next article, I will be explaining how the IdP can be configured for sending attributes.

WLST

To create a new OpenID 2.0 RP Partner using the OIF WLST commands, execute the following steps (ensure first that you have all the data from the SP partner, such as SP/RP realm and URLs):

  • Enter the WLST environment by executing:
    $IAM_ORACLE_HOME/common/bin/wlst.sh
  • Connect to the WLS Admin server:
    connect()
  • Navigate to the Domain Runtime branch:
    domainRuntime()
  • Create OpenID 2.0 RP Partner that will be called acmeRP in OIF:
    addOpenID20SPFederationPartner("acmeRP", "https://sp.com", "https://sp.com/sso/openid20")
  • By default, the new SP partner will be configured to:
    • Use the default Service Provider Attribute Profile
  • Exit the WLST environment:
    exit()

Modifying Federation Settings via WLST

In this section, I will list how to change the common SP Partner settings via the OIF WLST commands:

  • SP Partner Attribute Profile for an SP Partner

I will assume that you are already in the WLST environment and connected using:

  • Enter the WLST environment by executing:
    $IAM_ORACLE_HOME/common/bin/wlst.sh
  • Connect to the WLS Admin server:
    connect()
  • Navigate to the Domain Runtime branch:
    domainRuntime()

SP Partner Attribute Profile

To configure the SP Partner Attribute Profile for a specific SP Partner, use the following commands:

  • To configure an SP Partner to use a specific SP Partner Attribute Profile, execute:
    setSPPartnerAttributeProfile(partnerName, attrProfileID)
    • partnerName is the name that was used to create the SP Partner
    • attrProfileID is the SP Partner Attribute Profile ID
  • To list the existing the SP Partner Attribute Profiles, execute:
    listSPPartnerAttributeProfileIDs()


In the next article, I will be discussing how to configure OIF to populate the SSO response with attributes (LDAP user attributes, session attributes…).
Cheers,
Damien Carru


Comments:

Hi,

I have a SP that is using Saml 1.1 and has the following requirement for encryption.
Cipher Mode: CBC
Padding Mode: PKCS7
Encoding Type: Base64
Encryption Type: TripleDES

Pre OAM 11.1.2.2.0 the OIF interface in enterprise manager you could specify these settings. I don't see how to set this in 11.1.2.2.0. Has this option been removed?

Posted by Steve on July 31, 2014 at 02:44 PM EDT #

Hi,

The SAML 1.1 SSO does not define/support encryption for the SAML Assertion. Only the SAML 2.0 specifications support that use case.

Even in OIF 11.1.1.x.0, there was no support for encrypting outgoing SAML 1.x Assertions.

Damien

Posted by Damien on October 07, 2014 at 05:43 PM EDT #

Post a Comment:
  • HTML Syntax: NOT allowed
About

Damien Carru is a member of the Oracle Identity Management organization, focusing on Federation and SSO. This blog will cover Federation use cases involving Oracle Access Manager, Oracle Identity Federation and Oracle Security Token Service

Search

Categories
Archives
« August 2015
SunMonTueWedThuFriSat
      
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
     
Today