16 Federated Security Support

In some security architectures, the identity used by an individual user can be shared across identity systems. Typically, this is used for cloud implementations where the product or identity is housed on a cloud system and needs to be shared across on-premise and cloud systems. This is the basis for the support of Federated Security within the product.

The Federated Security Support is supported for the following:

• Federated Single Sign On Support for the online channel.
• Support for OAuth2 tokens for Inbound Web Services.
• Support for OAuth2 tokens for inbound RESTful Web Services.
• Support for OAuth2 tokens for outbound calls to external SOAP based web services.
• Support for OAuth2 tokens for outbound calls to external RESTful based web services.

Support for OAuth2 tokens for the mobile framework.

Note:

This capability supports Security Assertion Markup Language (SAML) 2.0 but is limited to authentication only. Authorization is supported in the product using the Security Model.

Note:

WLST commands in this section are for illustrative purposes only and assume that the user has connected to the relevant domain using the relevant WLST commands prior to execution of the command with the relevant credentials.

This chapter includes the following:

• Prerequisites for Federated Security
• Federated Online Authentication
• Federated Web Services
• Federated Outbound Messages
• Configuring OAuth for the Mobile Framework

Suggested References

Note:

It is assumed that sites wanting to use this capability are familiar with Federated Security and the products discussed in this section. Oracle strongly recommends reading relevant documentation related to this topic prior to using this advice.

The following references are recommended to be read before proceeding using this capability:

• Oracle Identity Federation Overview
• Fusion Middleware Administrating Oracle Access Management
• Oracle Unified Directory (optional)
• Fusion Middleware Administering Security for Oracle WebLogic Server
• Introducing Identity Federation in Oracle Access Management
• Fusion Middleware Understanding Oracle Web Services Manager

Federated Architecture

The Federated Architecture is based upon the following components:

• An Identity Provider (IdP) which authenticates the SAML 2.0 based identity. This is typically an on-premise (or third party) provider that provides the ability to validate and share identity across applications/requesting systems.
• A single sign on product, acting as a Service Provider (SP), to detect logins and appropriately process SAML 2.0 requests and responses.
• For Web Services a SAML 2.0 security-based provider or WS-Policy compliant policy.