Adding an OAMAuth Authentication Module

The Oracle authentication module enables OpenSSO to authenticate and single sign-on an administrator, who previously authenticated to Oracle Access Manager, to OpenSSO. The administrator does not have to provide credentials to OpenSSO.

To Add a New Oracle Authentication Module Instance

1. In the OpenSSO console, go to the Access Control tab > RealmName > Authentication subtab.
2. In the Module Instances section, click New.
3. In the Name field, type a name for this Oracle authentication module instance.
4. For Type, choose OAMAuth.
5. Click OK.
6. Configure the OAMAuth authentication module instance.

To Configure an Oracle Authentication Module Instance

1. In the OpenSSO console, go to the Access Control tab > RealmName > Authentication subtab.
2. In the Module Instances section, click name of the OAMAuth authentication module instance you want to configure.
3. Provide values for the Oracle Authentication Module Instance Realm attributes.

   The following table provides a listing and descriptions of the attributes you can configure.

   Remote User HeaderName

   Specify the name of the REMOTE USER HEADER that is set by the Oracle Access Manager. Example: OAM_REMOTE_USER

   Allowed user values

   The Current Values list displays users who are allowed to access the OpenSSO STS administration console.

   • To add a user to the list, in the New Value field type a username, and then click Add.

   • To remove an entry from the Current Values list, select the entry and then click Remove.

   Authentication level

   Specify a value that indicates how much to trust an authentication mechanism. The default value is 0.

   The authentication level is set separately for each method of authentication. Once a user has authenticated, this value is stored in the SSOToken for the session. When the SSOToken is presented to an application the user wants to access, the application uses the stored value to determine whether the level is sufficient to grant the user access.

   If the authentication level stored in an SSOToken does not meet the minimum value required, the application can prompt the user to authenticate again through a service with a higher authentication level.

   0 is a low value. For example, if the user accesses the URL protocol://openssoServer:port/opensso/UI/Loin?authlevel=0, a selection menu is displayed containing all authentication module instances with an authentication level of 0 or greater, or all authentication module instances. Similarly if the user accesses the URL protocol://openssoServer:port/opensso/UI/Loin?authlevel=50, a selection menu is displayed containing authentication module instances with an authentication level of 50 or greater. Or if only one authentication module instance meets that constraint, a login screen for that authentication module instance is displayed.

   If no authentication level is specified, the SSO token stores the value specified in the Core Authentication attribute Default Authentication Level.