test

Sun Java System Federation Manager 7.0 User's Guide

ProcedureTo Add a New Remote Identity Provider to a Provider Entity

A remote provider is not hosted on the same server as Federation Manager. Editing the New Remote Identity Provider attributes entails adding metadata concerning the identity provider to the provider entity profile. The starting point is To Add an Identity Provider to a Provider Entity.

  1. Provide information for the Common Attributes.

    Common Attributes contain values that generally define the identity provider itself.

    Description

    This attribute contains the description provided when you created the entity. You can modify the description originally entered.

    Valid Until

    Type the expiration date for the metadata pertaining to the provider. Use Coordinated Universal Time (UTC) in the format yyyy-mm-ddThh:mm:ss.SZ. For example, 2004-12-31T12:30:00.0Z.

    Cache Duration

    Type the maximum amount of time the entity can be cached. The value is defined in the format PnYnMnDTnHnMnS, where n is an integer. For example, P1Y2M4DT9H8M20S defines the cache duration as 1 year, 2 months, 4 days, 9 hours, 8 minutes, and 20 seconds.

    Protocol Support Enumeration

    Choose the protocol release supported by this entity.

    • urn:liberty:iff:2003-08 refers to the Liberty Identity Federation Framework version 1.2.

    • urn:liberty:iff:2002-12 refers to the Liberty Identity Federation Framework version 1.1.

    Server Name Identifier Mapping Binding

    Name identifier mapping allows a service provider to obtain a name identifier for a principal that has federated in the namespace of a different service provider. Implementing this protocol allows the requesting service provider to communicate with the second service provider without an identity federation having been enabled. Type a URI that identifies the communication specifications.

    Note –

    Currently, the Name Identifier Mapping profile only supports SOAP. If this attribute is used, its value must be http://projectliberty.org/profiles/nim-sp-http.

    Additional Meta Locations

    Type a URL that points to other relevant metadata concerning the provider.

    Signing Key: Key Alias

    Type the key alias used to sign requests and responses.

    Encryption Key: Key Alias

    Type the security certificate alias. Certificates are stored in a Java keystore file. Each specific certificate is mapped to an alias that is used to fetch the certificate.

    Encryption Key: Key Size

    Type the length for keys used by the web service consumer when interacting with another entity.

    Encryption Key: Encryption Method

    Choose the method of encryption. The choices include:

    • None

    • AES

    • DES

    • 3DES

    Name Identifier Encryption

    Select the check box to enable encryption of the name identifier.

  2. Provide information for the Communication URLs attributes.

    Communication URLs attributes contain locations for sending transmissions to the remote identity provider.

    SOAP Endpoint

    Type a URL to the identity provider’s SOAP message receiver. This value communicates the location of the SOAP receiver in non browser communications.

    Single Sign-On Service URL

    Type a URL to which service providers can send single sign-on and federation requests.

    Single Logout Service

    Type a URL to which service providers can send logout requests. Single logout synchronizes the logout functionality across all sessions authenticated by the identity provider.

    Single Logout Return

    Type a URL to which the identity provider will redirect the principal after completing a logout.

    Federation Termination Service

    Type a URL to which a service provider will send federation termination requests.

    Federation Termination Return

    Type a URL to which the identity provider will redirect the principal after completing federation termination.

    Name Registration Service

    Type a URL to which a service provider will send requests to specify the name identifier that will be used when communicating with the identity provider about a principal. This service can only be used after a federation session is established.

    Name Registration Return

    Type a URL to which the identity provider will redirect the principal after HTTP name registration has been completed.

  3. Provide information for the Communication Profiles attributes.

    Communication Profiles attributes define the transmission methods used by the identity provider.

    Federation Termination

    Select a profile to notify other providers of a principal’s federation termination:

    • HTTP Redirect

    • SOAP

    Single Logout

    Select a profile to notify other providers of a principal’s logout:

    • HTTP Redirect

    • HTTP Get

    • SOAP

    Name Registration

    Select a profile to notify other providers of a principal’s name registration:

    • HTTP Redirect

    • SOAP

    Single Sign-on/Federation

    Select a profile for sending authentication requests:

    • Browser Post (specifies a browser-based HTTP POST protocol)

    • Browser Artifact (specifies a non-browser SOAP-based protocol)

    • LECP (specifies a Liberty-enabled Client Proxy)

      Note –

      Federation Manager can handle requests that come from a Liberty-enabled client proxy profile, but it requires additional configuration that is beyond the scope of this manual.

  4. Select any of the available authentication domains to assign to the provider.

    A provider can belong to one or more authentication domains, however a provider without a specified authentication domain can not participate in Liberty-based communications. If no authentication domains have been created, this attribute can be defined later.

  5. Provide information for the Proxy Authentication Configuration attributes.

    Proxy Authentication Configuration attributes define values for dynamic identity provider proxying.

    Enable Proxy Authentication

    Select the check box to enable proxy authentication for a service provider.

    Proxy Identity Providers List

    Add a list of identity providers that can be used for proxy authentication. The value is a URI defined as the provider's identifier.

    Maximum Number of Proxies

    Type the maximum number of identity providers that can be proxied.

    Use Introduction Cookie for Proxying

    Select the check box if you want introductions to be used to find the proxying identity provider.

  6. Provide values for the Organization attributes.

    The Organization attributes provide basic information that may be required when interacting with a principal. These attributes are optional.

    Names

    Type the complete legal name of the entity’s organization. Use the format locale|organization-name. For example, en|organization-name.com.

    Note –

    If the Names attribute contains a value, it is required to add values to the Display Names and URL attributes.

    Display Names

    Type a name that is suitable for display. Use the format locale|organization-display-name. For example, en|organization-display-name.com.

    URL

    Type a URL that can be used to direct a principal to additional information on the entity's organization. Use the format locale|organization-URL. For example, en|http://www.organization-name.com.

  7. (Optional) To configure Contact Persons for the provider, click New Contact Person.

    For more information, see To Add a Contact Person to a Provider in a Provider Entity.

  8. Click OK to add the provider to the entity.

  9. Continue configuring the entity by selecting another option from the View menu or click Save to complete the configuration.