The Discovery Service attributes are global attributes whose values are applied across the OpenSSO Enterprise configuration and inherited by every configured organization. The Discovery Service attributes are:
This attribute takes a URI that points to the Discovery Service. Use the format protocol://host:port/opensso/Liberty/disco. This value can be changed only if other relevant attributes values are changed to match the new pointer.
This attribute specifies the authentication methods supported by the Discovery Service. These security mechanisms refer to the way a web service consumer authenticates to the web service provider or provides message-level security. By default, all available methods are selected. If an authentication method is not selected and a WSC sends a request using that method, the request is rejected.
This attribute allows you to specify a policy-related directive for a resource. If a service provider wants to use an unsupported directive, the request will fail. The following table describes the available options. .
Table 9–2 Policy-Related Directives
Directive |
Purpose |
---|---|
AuthenticateRequester |
The Discovery Service should include a SAML assertion containing an AuthenticationStatement in its query responses to enable the client to authenticate to the service instance hosting the resource. |
AuthenticateSessionContext |
The Discovery Service should include a SAML assertion containing a SessionContextStatement in its query responses that indicate the status of the session. |
AuthorizeRequestor |
The Discovery Service should include a SAML assertion containing a ResourceAccessStatement in its responses that indicate whether the client is allowed to access the resource. |
EncryptResourceID |
The Discovery Service should encrypt the resource identifier in responses to all clients. |
GenerateBearerToken |
For use with Bearer Token Authentication, the Discovery Service should generate a token that grants the bearer permission to access the resource. |
If enabled, the service will perform a policy evaluation for the DiscoveryLookup operation. By default, the check box is not selected.
If enabled, the service will perform a policy evaluation for the DiscoveryUpdate operation. By default, the check box is not selected.
The value of this attribute is the name and path to the class that implements the com.sun.identity.liberty.ws.interfaces.Authorizer interface used for policy evaluation of a WSC. The default class is com.sun.identity.liberty.ws.disco.plugins.DefaultDiscoAuthorizer.
The value of this attribute is the name and path to the class that implements the com.sun.identity.liberty.ws.disco.plugins.DiscoEntryHandler interface. This interface is used to set or retrieve a principal’s discovery entries. To handle discovery entries differently, implement the com.sun.identity.liberty.ws.disco.plugins.DiscoEntryHandler interface and set the implementing class as the value for this attribute. The default implementation for the Discovery Service is com.sun.identity.liberty.ws.disco.plugins.UserDiscoEntryHandler.
The value of this attribute is a list of classes that generate identifiers for a resource offering configured for an organization or role. com.sun.identity.liberty.ws.interfaces.ResourceIDMapper is an interface used to map a user identifier to the resource identifier associated with it. The Discovery Service provides two implementations for this interface:
com.sun.identity.liberty.ws.disco.plugins.Default64ResourceIDMapper assumes the format to be providerID + / + the Base64 encoded userIDs.
com.sun.identity.liberty.ws.disco.plugins.DefaultHexResourceIDMapper assumes the format to be providerID + / + the hex string of userIDs.
Different implementations may also be developed with the interface and added as a value of this attribute by clicking New and defining the following attributes:
Provider ID takes as a value a URI that points to the Discovery Service. Use the format http://host:port/opensso/Liberty/disco. See Provider ID.
ID Mapper takes as a value the class name and path of the implementing class.
If enabled, the service authenticates the response message. By default, the function is not enabled.
If enabled, this attribute specifies whether to generate a SessionContextStatement for bootstrapping. A SessionContextStatement conveys the session status of an entity. By default, this function is not enabled.
If enabled, the service encrypts the name identifier in a SessionContextStatement. By default, this function is not enabled.
If enabled, the service does not generate a resource identifier for bootstrapping. By default, this function is not enabled.
Defines the class and path that implements the NameIdentifierMapper interface. It is used to map user's Name Identifier from one provider to another.
Defines the class and path that implements the DiscoEntryHandler interface. It is used to get and set Disco Entries for a user stored in a realm. When an implied resource is used in a discovery service request, this implementation is used to perform the operation.
This attribute defines a resource offering for bootstrapping a service. After single sign-on (SSO), this resource offering and its associated credentials will be sent to the client in the SSO assertion. Only one resource offering is allowed for bootstrapping. The value of the Resource Offerings for Bootstrapping attribute is a default value configured during installation. If you want to define a new resource offering, you must first delete the existing resource offering, then click New to define the attributes for a new resource offering. If you want to edit an existing resource offering, click the name of the existing Service Type to modify the attributes.