Integrating ADFS 2.0 and 3.0 SP with OAM IdP

This article describes how to integrate ADFS 2.0/3.0 as an SP and OAM as an IdP. Be sure to read entry covering the pre-requisites.

The SAML 2.0 integration is based on:

ADFS 2.0 is available in Windows 2008 R2, while ADFS 3.0 is available in Windows 2012 R2. The article showcases screenshots for ADFS 3.0, while the documented steps applies to both versions.

ADFS Setup

To add OAM as an IdP in ADFS SP, perform execute the following steps:

  1. Go to the machine where ADFS is deployed.

  2. If ADFS 2.0 is used

    • Click Start Menu , Programs , Administrative Tools , AD FS 2.0 Management

    • Expand ADFS 2.0 , Trust Relationships

  3. If ADFS 3.0 is used

    • In Server Manager, click Tools , AD FS Management

    • Expand AD FS , Trust Relationships

  4. Right click on Claims Provider Trusts and select Add Claims Provider Trust.

    5. The Add Claims Provider Trust window appears

    Description of the illustration Add_Claims_Provider.jpg

  5. Click Start.

  6. Select Import data about the claims provider from a file.

  7. Click browse and select the local OAM IdP SAML 2.0 Metadata file (it is required for the OAM endpoints to be SSL terminated, otherwise ADFS will not import the metadata. See pre-requisites article about SSL).

    8. Description of the illustration Import_Data.jpg

  8. Click Next.

  9. If a Warning window appear about unsupported features in ADFS, continue by clicking OK (this relates to the SAML Attribute Authority feature listed in the OAM IdP SAML 2.0 Metadata).

    10. Description of the illustration Warning_Message.jpg

  10. Enter a name for the new SAML 2.0 Identity Provider.

    11. Description of the illustration Identity_Provider.jpg

  11. Click Next. A summary window displays

    12. Description of the illustration summary_window.jpg

  12. Click Next.

  13. Leave Open the Edit Claims box checked

    14. Description of the illustration Edit_Claims.jpg

  14. Click Close. The Edit Rule window appears

    15. Description of the illustration Edit_Rule_Window.jpg

  15. Click Add Rule.

  16. Select Pass Through or Filter an Incoming Claim

    17. Description of the illustration Select_Rule_Template.jpg

  17. Click Next.

  18. Enter a name for the Claim Rule.

  19. Select NameID as the Incoming Claim Type.

  20. Select Email as the Incoming name ID format.

  21. Select Pass through all claim values if you want to accept any email addresses Pass through only claim values that match a specific email suffix value if you want to only accept a specific set of email addresses (in this example, select this choice as all users will have an @acme.com email address).

    22. Description of the illustration Configure_Rule.jpg

  22. Click Finish. A list of claim rules is displayed

  23. Click OK.

Description of the illustration list_of_claim_rules.jpg

As mentioned in the pre-requisites article, if you want to configure ADFS to use/accept SHA-1 signatures, perform the following steps (Note: if you don’t configure ADFS to use/accept SHA-1 signatures, you must configure OAM to use SHA-256 for signatures):

  1. Go to the machine where ADFS is deployed.

    • If ADFS 2.0 is used

      • Click Start Menu , Programs , Administrative Tools , AD FS 2.0 Management

      • Expand ADFS 2.0 , Trust Relationships

    • If ADFS 3.0 is used

      • In Server Manager, click Tools , AD FS Management

      • Expand AD FS , Trust Relationships

  2. Right click on the newly created Claims Provider Trust and select Properties.

  3. Select the Advanced Tab.

  4. Select SHA-1.

  5. Click OK.

Description of the illustration Secure_Hash_Algorithm.jpg

OAM Setup

To add ADFS as an SP partner in OAM, execute the following steps:

  1. Go to the OAM Administration Console: http(s)://oam-admin-host:oam-adminport/oamconsole.

  2. Navigate to Identity Federation , Identity Provider Administration.

  3. Click on the Create Service Provider Partner button.

  4. In the Create screen:

    1. Enter a name for the partner

    2. Select SAML 2.0 as the Protocol

  5. Click Load Metadata and upload the SAML 2.0 Metadata file for the SP.

  6. Select the NameID format to set in the SAML 2.0 Assertion (Email Address NameID format in this case).

  7. Enter how the NameID value must be set: User ID.

  8. Store Attribute, and mail attribute in this case.

  9. Select the default Attribute Profile that indicates how to populate the SAML Assertion with attributes.

  10. Click Save.

As mentioned in the pre-requisites article, if you want to configure OAM to use SHA-256 for signatures, perform the following steps (Note: if you don’t configure OAM to use SHA-256 for signatures, you must configure ADFS to use/accept SHA-1 signatures):

  1. Enter the WLST environment by executing: $IAM_ORACLE_HOME/common/bin/wlst.sh.

  2. Connect to the WLS Admin server: connect().

  3. Navigate to the Domain Runtime branch: domainRuntime().

  4. Execute the configureFedDigitalSignature() command: configureFedDigitalSignature(partner="PARTNER_NAME", partnerType="idp/sp", algorithm="SHA-256/SHA-1").

  5. Replace PARTNER_NAME with the name of the partner added

    1. Set the partnerType to idp or sp

    2. Set the algorithm to SHA-256 or SHA-1 An example is: configureFedDigitalSignature(partner="ADFSSP", partnerType="sp”, algorithm="SHA-256")

  6. Exit the WLST environment: exit().

Test

To test, access the OAM IdP initiated SSO page:

An example is: https://acme.com/oamfed/idp/initiatesso?providerid=ADFSSP

You will be redirected to ADFS SP with a SAML Assertion

Description of the illustration SAML_Assertion.jpg

More Learning Resources

Explore other labs on docs.oracle.com/learn or access more free learning content on the Oracle Learning YouTube channel. Additionally, visit education.oracle.com/learning-explorer to become an Oracle Learning Explorer.

For product documentation, visit Oracle Help Center.