Contents

List of Examples

List of Tables

Title and Copyright Information

Preface

• Who Should Use This Book
• Related Books
• Documentation Accessibility
• Additional Information and Resources
• Conventions
• Shell Prompts in Command Examples

What's New in the Oracle OpenSSO 8.0 Update 2 Release Notes

• Software Updates
• Documentation-Specific Updates

1 About OpenSSO 8.0 Update 2

• 1.1 What's New in OpenSSO 8.0 Update 2
  • 1.1.1 Security Token Service Enhancements
  • 1.1.2 Fedlet Enhancements
  • 1.1.3 Bugs Fixed in This Release
• 1.2 Hardware and Software Requirements For OpenSSO 8.0 Update 2
• 1.3 OpenSSO 8.0 Update 2 Issues and Workarounds
  • 1.3.1 General Security Advisory
  • 1.3.2 CR 6959610: OpenSSO 8.0 Update 2 samples should be removed in production environment
  • 1.3.3 CRs 6944573, 6964648: New Java security permissions are required for WebLogic Server 10.3.3
  • 1.3.4 CR 6939443: Certificate authentication with LDAP checking or OCSP checking fails on WebLogic Server 10.3.x
  • 1.3.5 CR 6960514: Cannot access authentication certificates
  • 1.3.6 To Configure JDBC Authentication with Oracle Database
  • 1.3.7 To Manually Configure NSS on OpenSSO
  • 1.3.8 CR 6967026: Configurator cannot connect to LDAPS-enabled directory server
  • 1.3.9 CR 6948937: Activating OpenSSO 8.0 Update 2 in WebLogic Server 10.3.3 admin console causes exceptions
  • 1.3.10 CR 6956461:SecurID authentication fails on IBM WebSphere Application Server
  • 1.3.11 CR 6959373: Web container requires a restart after running updateschema script
  • 1.3.12 CR 6961419: Running updateschema.bat script requires a password file
  • 1.3.13 CR 6970859: Browser scroll feature does not work
  • 1.3.14 Deploying OpenSSO 8.0 Update 2 on JBoss 5.0
    • 1.3.14.1 To Deploy OpenSSO on JBoss 5.0
  • 1.3.15 CR 6971437 : OpenSSO 8.0 Update 2 loses configuration after restart of JBoss Application Server 5.0.0.0
  • 1.3.16 CR 6972593: Java Oracle OpenSSO Fedlet single sign-on (SSO) fails on JBoss AS 5.0.x
  • 1.3.17 SR 72335286 and CR 6929674: LDAP Referrals Do Not Work as Expected
• 1.4 OpenSSO 8.0 Update 2 Documentation
  • 1.4.1 Documentation Issues
    • 1.4.1.1 CR 6958580: Console online Help documents unsupported Discovery Agents
    • 1.4.1.2 CR 6967006 Console online Help does not document OAMAuth and WSSAuth authentication modules
    • 1.4.1.3 CR 6953582: Fedlet Java API reference should be public
    • 1.4.1.4 CR 6953579: OpenSSO Fedlet README file should document single logout feature
    • 1.4.1.5 CR 6960630: Information for patching a specialized OpenSSO WAR should be revised
• 1.5 Additional Information and Resources
  • 1.5.1 Deprecation Notifications and Announcements
  • 1.5.2 How to Report Problems and Provide Feedback

2 OpenSSO 8.0 Update 2 Patch Releases

• 2.1 About OpenSSO 8.0 Update 2 Patch Releases
• 2.2 OpenSSO 8.0 Update 2 Patch 5
  • 2.2.1 New Features in Patch 5
  • 2.2.2 Bugs Fixed in Patch 5
    • 2.2.2.1 Bug 13845938: OpenSSO installation of second instance fails with JDK 1.6.0_21 and later
    • 2.2.2.2 Bug 13073465: Original client IP via proxy is not getting logged in OpenSSO
• 2.3 OpenSSO 8.0 Update 2 Patch 4
  • 2.3.1 Bug 12286933: Dist Auth cannot receive session notifications
  • 2.3.2 Bug 12427762: SAML attributes containing a | are not decoded in a SAML attribute
  • 2.3.3 Bug 13361224: SecurID authentication support for WebSphere Application Server 6.1 on AIX 6.1
• 2.4 OpenSSO 8.0 Update 2 Patch 3
  • 2.4.1 Known Issues in OpenSSO 8.0 Update 2 Patch 3
    • 2.4.1.1 Bug 12308272: OpenSSO list-agents command fails with GlassFish v2.1.1 patch 9
  • 2.4.2 Documentation Updates in OpenSSO 8.0 Update 2 Patch 3
    • 2.4.2.1 Bug 12307986: OpenSSO client SDK caches URL policy decision with correct methods
    • 2.4.2.2 Bug 12309423: Inconsistent session timeout behavior is fixed
• 2.5 OpenSSO 8.0 Update 2 Patch 2
  • 2.5.1 What's New in OpenSSO 8.0 Update 2 Patch 2
    • 2.5.1.1 CR 7016248: Validation of gotoOnFail URLs
    • 2.5.1.2 CR 6993122: SAMLv2 implementation of NameIDPolicy interface without SPNameQualifier
    • 2.5.1.3 HttpServletRequest and HttpServletResponse are available with Distributed Authentication User Interface (6677966)
  • 2.5.2 Known Issues in OpenSSO 8.0 Update 2 Patch 2
    • 2.5.2.1 CR 7017520: Missing property in Policy Service causes HTTP status code 500
  • 2.5.3 Documentation Updates in OpenSSO 8.0 Update 2 Patch 2
    • 2.5.3.1 CR 7013849: Documentation update: WS-Trust certificate must be the same on client and server
    • 2.5.3.2 CR 7007193: Documentation update: REST Get method parameter passing is changed in OpenSSO 8.0 Update 2
• 2.6 OpenSSO 8.0 Update 2 Patch 1
  • 2.6.1 Known Issues in OpenSSO 8.0 Update 2 Patch 1
    • 2.6.1.1 CR 6978018: Running OpenSSO 8.0 in GlassFish 2.1.x using LDAPS with JDK 1.6.x
    • 2.6.1.2 CR 7002787: OpenSSO 8.0 Update 2 is not working with Active Directory Data Store
    • 2.6.1.3 CR 6897101: After a login to a non-default realm, user experiences multiple logins after a timeout
    • 2.6.1.4 CR 6983035: Remote console with OpenSSO server returns errors after a session timeout
    • 2.6.1.5 CR 6983026: Remote console with OpenSSO server causes errors when modifying Federation or SAML v2 attributes requiring the certificate keystore
    • 2.6.1.6 CR 6995584: "Post-Authentication Plug-In for First Time Login" sample requires OpenSSO 8.0 Update 1 or later

3 Installing OpenSSO 8.0 Update 2

• 3.1 OpenSSO 8.0 Update 2 Installation Overview
  • 3.1.1 OpenSSO 8.0 Update 2 Patches
• 3.2 Planning Your Patch Operation
  • 3.2.1 To Plan Your Patch Operation for OpenSSO 8.0
• 3.3 Overview of the ssopatch Utility
• 3.4 Installing the ssopatch Utility
  • 3.4.1 To Install the ssopatch Utility
• 3.5 Backing Up an OpenSSO WAR File
• 3.6 Running the ssopatch Utility
  • 3.6.1 To run the ssopatch utility, follow this usage:
• 3.7 Comparing an OpenSSO WAR File to Its Internal Manifest
  • 3.7.1 To Compare an OpenSSO WAR File to Its Internal Manifest
• 3.8 Comparing Two OpenSSO WAR Files
  • 3.8.1 To Compare Two OpenSSO WAR Files
• 3.9 Patching an OpenSSO WAR File
  • 3.9.1 To Create a Staging Area to Patch an OpenSSO WAR File
• 3.10 Creating an OpenSSO WAR Manifest File
  • 3.10.1 To Create an OpenSSO WAR Manifest File
• 3.11 Patching a Specialized OpenSSO WAR
  • 3.11.1 To Patch a Specialized OpenSSO WAR
• 3.12 Running the updateschema Script
  • 3.12.1 Before You Begin
  • 3.12.2 To Run the updateschema Script
• 3.13 Backing Out a Patch Installation

4 Using the Security Token Service

• 4.1 Adding a WSSAuth Authentication Module
  • 4.1.1 To Add a New Web Service Security Authentication Module Instance
  • 4.1.2 To Configure a WSSAuth Authentication Module Instance
• 4.2 Adding an OAMAuth Authentication Module
  • 4.2.1 To Add a New Oracle Authentication Module Instance
  • 4.2.2 To Configure an Oracle Authentication Module Instance
• 4.3 Generating Security Tokens
  • 4.3.1 Registering a Web Service Provider to OpenSSO STS
  • 4.3.2 Requesting a Web Service Client Security Token from OpenSSO STS
    • 4.3.2.1 Using the Security Token Generation Matrix

5 Using the Oracle OpenSSO Fedlet

• 5.1 About the Oracle OpenSSO Fedlet
  • 5.1.1 Requirements for the Oracle OpenSSO Fedlet
  • 5.1.2 Oracle OpenSSO Fedlet Configuration
    • 5.1.2.1 To Configure the Java Fedlet
    • 5.1.2.2 To Configure the .NET Fedlet
• 5.2 New Features for the Fedlet in OpenSSO 8.0 Update 2
  • 5.2.1 Fedlet Version Information (CR 6941387)
  • 5.2.2 Java Fedlet Password Encryption and Decryption (CR 6930477)
  • 5.2.3 Java Fedlet Support for Signing and Encryption
    • 5.2.3.1 To Configure the Java Fedlet for Signing and Encryption
  • 5.2.4 Java Fedlet Support for Attribute Query (CR 6930476)
    • 5.2.4.1 To Configure the Java Fedlet for Attribute Query
  • 5.2.5 .NET Fedlet Encryption and Decryption of Requests and Responses (CR 6939005)
    • 5.2.5.1 To Configure the .NET Fedlet for Encryption and Decryption of Requests and Responses
  • 5.2.6 .NET Fedlet Signing of Requests and Responses (CR 6928530)
    • 5.2.6.1 To Configure the .NET Fedlet for Signing of Requests and Responses:
  • 5.2.7 .NET Fedlet Single Logout (CR 6928528 and CR 6930472)
    • 5.2.7.1 To Configure a .NET Fedlet Service Provider Application for Single Logout:
  • 5.2.8 .NET Fedlet Service Provider Initiated Single Sign-on (CR 6928525)
  • 5.2.9 .NET Fedlet Support for Multiple Identity Providers and Discovery Service (CR 6928524)
    • 5.2.9.1 To Configure the .NET Fedlet for Multiple Identity Providers
  • 5.2.10 .NET Fedlet Support for the Identity Provider Discovery Service (CR 6928524)
    • 5.2.10.1 To Configure the .NET Fedlet to Use the Identity Provider Discovery Service:
• 5.3 Documentation Errata

6 Integrating OpenSSO 8.0 Update 2 with Oracle Access Manager

• 6.1 Overview of Integration Steps
• 6.2 Before You Begin
• 6.3 Unpacking the Integration Bits
• 6.4 Building Source Files for Oracle Access Manager in OpenSSO
  • 6.4.1 To Build the Source Files for Oracle Access Manager
• 6.5 (Optional) Build an Authentication Scheme for OpenSSO in Oracle Access Manager
  • 6.5.1 To Build an Authentication Scheme for OpenSSO in Oracle Access Manager
• 6.6 Configuring Single Sign-On Using Oracle Access Manager and Oracle OpenSSO STS
  • 6.6.1 To Configure Single Sign-On Using Oracle Access Manager and Oracle OpenSSO 8.0 Update 2
• 6.7 To Test Single Sign-On
• 6.8 (Optional) Installing of Oblix AuthScheme into Oracle Access Manager
• 6.9 Integrating the OpenSSO 8.0 Update 2 with Oracle Access Manager

7 Documentation Errata

• 7.1 Bug 12271951: OpenSSO server and agents must be restarted after patch installation
• 7.2 Bug 12654373: updateschema.sh script generates harmless errors
• 7.3 Bug 14310764: Camel case required for com.iplanet.am.session.agentSessionIdleTime parameter
• 7.4 Bug 12289903: nsRoleDN attribute is not fetched by default
• 7.5 Bug 14695234: Documentation needed for com.iplanet.am.jssproxy.resolveIPAddress property
• 7.6 Bug 12260633: OpenSSO support on Red Hat Enterprise Linux 4 and 5 is clarified
• 7.7 Bug 12273592: OpenSSO 8.0 online help servers and sites documentation is inconsistent
• 7.8 Bug 12335605: Documentation has incorrect references to opensso.dev.java.net site