Integrating ADFS 2.0 and 3.0 IdP with OAM SP

This article describes how to integrate ADFS 2.0/3.0 as an IdP and OAM as an SP. Before proceeding with the article, make sure to read the pre-requisites. The SAML 2.0 integration is be based on:

ADFS 2.0 is available in Windows 2008 R2, while ADFS 3.0 is available in Windows 2012 R2. The articles will showcase screenshots for ADFS 3.0, while the documented steps will apply to both versions.

ADFS Setup

To add OAM as an SP in ADFS IdP, perform execute the following steps:

  1. Go to the machine where ADFS 2.0 is deployed.

    1. If ADFS 2.0 is used

      1. Click Start Menu , Programs , Administrative

      2. Tools , AD FS 2.0 Management

      3. Expand ADFS 2.0 , Trust Relationships

    2. If ADFS 3.0 is used

      1. In Server Manager, click Tools , AD FS Management

      2. Expand AD FS , Trust Relationships

      3. Right click on Relying Party Trusts and select Add Relying Party Trust

      The Add Relying Party Trust window appears.

      Description of the illustration Add_Relying_Party_Trust.jpg

  2. Click Start.

  3. Select Import data about the relying party from a file.

  4. Click browse and select the OAM SP SAML 2.0 Metadata file from the local machine (it is required for the OAM endpoints to be SSL terminated, otherwise ADFS will not import the metadata. See pre-requisites article about SSL).

    5. Description of the illustration Import_File_Option.jpg

  5. Click Next.

  6. Enter a name for the new OAM SAML 2.0 Service Provider.

    7. Description of the illustration Specify_Display_Name.jpg

  7. If using ADFS 3.0, execute the following steps:

  8. Click Next.

    9. The next screen shows an optional multi factor authentication settings section

  9. Select the option depending on your requirements.

  10. Click Next.

  11. Select Permit all users to access this Relying Party.

    Description of the illustration Permit_all_users.jpg

  12. Click Next.

    13. A summary window is displayed.

    Description of the illustration summary_window.jpg

  13. Click Next.

  14. Leave Open the Edit Claims box checked.

    15. Description of the illustration Edit_Claims_Rules.jpg

  15. Click Close.

    16. The Edit Rule window appears.

    Description of the illustration Edit_Rule_Window.jpg

  16. Click Add Rule: We will configure ADFS to retrieve the user’s email address from LDAP and include it as EmailAddress SAML Attribute.

  17. Select Send LDAP Attributes as Claims.

    18. Description of the illustration Select_Rule_Template.jpg

  18. Click Next.

  19. Enter a name for the Claim Rule.

  20. Select Active Directory as the Attribute Store.

  21. Since we are using Email Address as the NameID, in the first row, select Email Addresses as the LDAP Attribute, and Email Address as the Outgoing Claim Type.

    22. Description of the illustration Configure_Rule.jpg

  22. Click Finish. A list of rules is displayed.

    23. Description of the illustration list_of_rules.jpg

    [Description of the illustration list_of_rules.jpg](files/list_of_rules.txt)

  23. Click Add Rule: We will transform the SAML Attribute EmailAddress to make it the NameID with its format set to email address.

  24. Select Transform an Incoming Claim.

    25. Description of the illustration Transform_Incoming_Claim.jpg

  25. Click Next.

  26. Enter a name for the rule.

  27. Select Email Address as the Incoming Claim Type.

  28. Select NameID as the Outgoing Claim Type.

  29. Select Email as the Outgoing name ID format.

  30. Select Pass through all claim values.

    31. Description of the illustration Add_Transform_Claim.jpg

  31. Click Finish. A list of claim rules is displayed.

  32. Click OK.

    33. Description of the illustration list_of_claim_rules.jpg

As mentioned in the pre-requisites article, if you want to configure ADFS to use/accept SHA-1 signatures, perform the following steps

Note: If you do not configure ADFS to use/accept SHA-1 signatures, you will have to configure OAM to use SHA-256 for signatures:

  1. Go to the machine where ADFS is deployed

  2. If ADFS 2.0 is used:

    1. Click Start Menu , Programs, Administrative Tools , AD FS 2.0 Management.

    2. Expand ADFS 2.0 , Trust Relationships.

  3. If ADFS 3.0 is used

    1. In Server Manager, click Tools , AD FS Management

    2. Expand AD FS , Trust Relationships

  4. Right click on the newly created Relying Party and select Properties.

  5. Select the Advanced Tab.

  6. Select SHA-1.

  7. Click OK.

Description of the illustration Secure_Hash_Algorithm.jpg

As also mentioned in the pre-requisites article, if you decided to disabled decryption on the ADFS IdP, execute the following steps:

  1. Go to the machine where ADFS is deployed.

  2. If ADFS 2.0 is used.

    1. Click Start Menu ,Programs , Administrative Tools , Windows PowerShell Modules

  3. If ADFS 3.0 is used

    1. Click Start Menu , Administrative Tools , Active Directory Module for Windows PowerShell

  4. Execute the following command (replace RP_NAME with the SP name used to create the partner in ADFS): set-ADFSRelyingPartyTrust –TargetName “RP_NAME” –EncryptClaims $False

For example: set-ADFSRelyingPartyTrust –TargetName “ACME SP” –EncryptClaims $False

OAM Setup

To add ADFS as an IdP partner in OAM, execute the following steps:

  1. Go to the OAM Administration Console: http(s)://oam-admin-host:oam-adminport/oamconsole.

  2. Navigate to Identity Federation , Service Provider Administration.

  3. Click on the Create Identity Provider Partner button.

  4. In the Create screen:

    1. Enter a name for the partner.

    2. Check whether or not this partner should be used as the IdP by default when starting a Federation SSO operation, if no IdP partner is specified. (in this example we will set it as the default IdP).

    3. Select SAML 2.0 as the Protocol.

  5. Click Load Metadata and upload the SAML 2.0 Metadata file for the IdP Assertion Mapping section:

    1. Optionally set the OAM Identity Store that should be used (Note: In the example, we left the field blank to use the default OAM Identity Store).

    2. Optionally set the user search base DN (Note: In the example, we left the field blank to use the user search base DN configured in the Identity Store).

    3. Select how the mapping occurs (Note: In the example, we are mapping the Assertion via the NameID to the LDAP mail attribute).

  6. Select the Attribute Profile that will be used to map the names of the attributes in the incoming SAML Assertion to local names. See article on IdP Attribute Profile for more information. In this example, use the default IdP Attribute Profile.

  7. Click Save.

Description of the illustration OIF_Setup.jpg

As mentioned in the pre-requisites article, if you want to configure OAM to use SHA-256 for signatures, perform the following steps (Note: if you don’t configure OAM to use SHA-256 for signatures, you will have to configure ADFS to use/accept SHA-1 signatures):

  1. Enter the WLST environment by executing: $IAM_ORACLE_HOME/common/bin/wlst.sh.

  2. Connect to the WLS Admin server: connect().

  3. Navigate to the Domain Runtime branch: domainRuntime().

  4. Execute the configureFedDigitalSignature() command: configureFedDigitalSignature(partner="PARTNER_NAME", partnerType="idp/sp", algorithm="SHA-256/SHA-1").

    1. Replace PARTNER_NAME with the name of the partner added.

    2. Set the partnerType to idp or sp.

    3. Set the algorithm to SHA-256 or SHA-1 An example will be: configureFedDigitalSignature(partner="ADFSIdP", partnerType="idp", algorithm="SHA-256").

  5. Exit the WLST environment: exit().

As also mentioned in the pre-requisites article, if you decided not to disable strong encryption on the ADFS IdP, be sure that the JCE Unlimited Strength Jurisdiction policy \les were installed in the OAM environment.

Test

To test the integration:

More Learning Resources

Explore other labs on docs.oracle.com/learn or access more free learning content on the Oracle Learning YouTube channel. Additionally, visit education.oracle.com/learning-explorer to become an Oracle Learning Explorer.

For product documentation, visit Oracle Help Center.