Crypto Settings in OAM

This article covers the various crypto configuration properties in OAM that are used to affect the Federation SSO exchanges, including:

Hashing Algorithms

OAM supports the consumption and issuance of SAML messages signed with

By default, OAM uses SHA-1 when signing outgoing messages.

Messages are signed differently, based on the binding being used:

SHA-1

An example of a signed AuthnRequest message sent via the HTTP-Redirect binding is:

https://acme.com/idp/saml20?SAMLRequest=hVPLbtswEPwVgT1LpB6tY8JyoNZ1q9ZujVgJ3N4Yio5ZSKTMpaz470v5ESQB4gA8LWZ2ZnaXo%2BvHuvJ2woDUKkVhQJAnFNelVA8pui2m%2FhXywDJVskorkaK9AHQ9HgGrq4Zmrd2oG7FtBVjPNVJAS5COuLG2oRh3XRd0ca%2B%2FruIoOPN0IOU8aba1MxeDtpXXKj1AeoOxUq7R%2BMX0py%2Fko5iQiKsWd3rj%2FAzyfPN%2FnJd88lCV5Lv37URBuFrGzWTVVaWRgAgL6sq3X0xgln3NaxpBcLjo%2BrLzzH%2BDw%3D%3D&RelayState=id-AkgTE5PMRAZTaKRcZHT-2rIse-oPhCxyI00Xycbf&SigAlg=http%3A%2F%2Fwww.w3.org%2F2000%2F09%2Fxmldsig%23rsa-sha1&Signature=rjZFsFuaFKv77JbspdDwT2wGV366iL3zvWc%2B1aybu%2FW%2BpFwLOfTJBtVsKfwJre1nGCU5SEvFD%2FBBURkxOG1KhR3k%2FrOw%2Bj7g7RlHfSaHKaAO3p6aAGQYPCpz%2Fd0%2BKArDAL%2FDNoH46G6Pnf7VWSb6a2COUiTV6118KaPbex

An example of a SAML 2.0 Assertion sent via the HTTP-POST binding is:

<samlp:Response ...<samlp:Response ...>
 <saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">...
</saml:Issuer>
 <samlp:Status><samlp:StatusCode
Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status> <saml:Assertion ID="id-BgLUimKUWYyS3JQbf2geeP9EwS-eGKxOPTuPvxgJ" ...> <saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">...
</saml:Issuer>
 <dsig:Signature>
 <dsig:SignedInfo>
 <dsig:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-excc14n#"/>
<dsig:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsasha1"/>
 <dsig:Reference URI="#id-BgLUimKUWYyS3JQbf2geeP9EwS-eGKxOPTuPvxgJ">
 <dsig:Transforms>
 <dsig:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#envelopedsignature"/>
 <dsig:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/> </dsig:Transforms>
<dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
 <dsig:DigestValue>uS85cIFf4z9KcHH/z60fNRPLoyo=</dsig:DigestValue>
 </dsig:Reference>
 </dsig:SignedInfo>
 <dsig:SignatureValue>NiTyPtOEjyG...SpVjbhKxY=</dsig:SignatureValue>
 </dsig:Signature>
 <saml:Subject>
 ...
 </saml:Subject> <saml:Conditions ...>
 ...
 </saml:Conditions> <saml:AuthnStatement ...>
 ...
 </saml:AuthnStatement>
 </saml:Assertion> </samlp:Response>

SHA-256

An example of a signed AuthnRequest message sent via the HTTP-Redirect binding is:

https://acme.com/idp/saml20?SAMLRequest=hVNdb9owFP0rkfec%2BCbAVixClY2hIdGWDui6vhnbFEuOndoOKfv1c%2Fio2kqlkp%2BuzrnnnHuvB5fPpYq2wjppdI7SBFAkNDNc6sccLRfj%2BAJFzlPNqTJa5GgnHLocDhwtVUWK2m%2F0b%2FFUC%2Bej0Eg7wp0MxI33FcG4%2F%2FFLDswb9bFN2dNp61G584V4vJ3o4PJUi7MYTXWaRd0vtKoP%2BAolHYsdTU71nHbJQzgEo8JbULASlTImGmJN%2B6%2FT5eC44lr3A7%2F20G6HAzZC9lo7GxJfXng7aVEGq9h4ZD8dLv0PCNNGPvpLMOQIYNLVv9AX4lebrZ69B1MpoZJdnuUxtpkrRelayState=id-BiQreMi9cMY3oFI9PKMNKtuOjpuFS2PrW4R8KKvd&SigAlg=http%3A%2F%2Fwww.w3.org%2F2001%2F04%2Fxmldsig-more%23rsa-sha256&Signature=PvyMUD%2FKXnCc0drlN1pvoK171znJkajEHLgtzE4I7YFQIvP4wp3M%2FV7y08x0Qkv0jwo9K4VBG%2BQUBFtXr41ZDp%2BHOb7GlmaY973n7X2UDlbUbVlrJX%2FqS1GyyNY6MSMcO5K0J7VJcQXf8CvGEcVHr%2FZhPjihnAO2vi%2Bej3fbfgo%3D

An example of a SAML 2.0 Assertion sent via the HTTP-POST binding is:

<samlp:Response ...<samlp:Response ...>
 <saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">...
</saml:Issuer>
 <samlp:Status><samlp:StatusCode
Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status> <saml:Assertion ID="id-5B4KZ-PeUzikxtC-Cr9g6uFQ-muwj3ZmC4PUW4wT" ...> <saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">...
</saml:Issuer>
 <dsig:Signature>
 <dsig:SignedInfo>
 <dsig:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-excc14n#"/>
<dsig:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsasha256"/>
 <dsig:Reference URI="#id-5B4KZ-PeUzikxtC-Cr9g6uFQ-muwj3ZmC4PUW4wT">
 <dsig:Transforms>
 <dsig:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#envelopedsignature"/>
 <dsig:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
 </dsig:Transforms>
<dsig:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
 <dsig:DigestValue>Ppx/...L9ooHtsvgxvI=</dsig:DigestValue>
 </dsig:Reference>
 </dsig:SignedInfo>
 <dsig:SignatureValue>G6yppQXy...SzHz2oa+zA=</dsig:SignatureValue>
 </dsig:Signature>
 <saml:Subject>
 ...
 </saml:Subject> <saml:Conditions ...>
 ...
 </saml:Conditions> <saml:AuthnStatement ...>
 ...
 </saml:AuthnStatement>
 </saml:Assertion> </samlp:Response>

WLST Command

OAM can be configured to use SHA-1 or SHA-256 in SAML signatures:

The OAM WLST configureFedDigitalSignature() command is used to configure how OAM should compute a signature:

  1. Enter the WLST environment by executing: $IAM_ORACLE_HOME/common/bin/wlst.sh.

  2. Connect to the WLS Admin server: connect().

  3. Navigate to the Domain Runtime branch: domainRuntime().

  4. Execute the configureFedDigitalSignature() command: configureFedDigitalSignature(partner="", partnerProfile="", partnerType="",default="false", algorithm="SHA-256", displayOnly="false", delete="false").

    5. The following parameters can be set:

    An example is:

    configureFedDigitalSignature(partner="AcmeIdP", partnerType="idp", algorithm="SHA-256")

  5. Exit the WLST environment: exit()

Signing Outgoing Messages

OOTB Configuration

Below are the OOTB boolean settings that indicate when OAM needs to sign outgoing SAML messages (if true, OAM signs the outgoing messages):

Configuration

Assume that you are already in the WLST environment and connected using:

  1. Enter the WLST environment by executing: $IAM_ORACLE_HOME/common/bin/wlst.sh.

  2. Connect to the WLS Admin server: connect().

  3. Navigate to the Domain Runtime branch: domainRuntime().

SAML 2.0 AuthnRequest

To configure OAM to sign an outgoing SAML 2.0 AuthnRequest, execute one of the following commands:

Other Settings

To configure the properties defined at the SP/IdP Partner Profiles above, execute one of the following commands:

Metadata

Changing the saml20sendsignedauthnrequest property at a global level changes the SAML 2.0 Metadata generated by OAM, as:

The AuthnRequestsSignedattribute in the SPSSODescriptor element is set based on saml20sendsignedauthnrequest.

A sample SAML 2.0 Metadata shows those two attributes:

<md:EntityDescriptor ...>
 <dsig:Signature>
 ...
 </dsig:Signature> <md:IDPSSODescriptor WantAuthnRequestsSigned="false" ...>
 ...
 </md:IDPSSODescriptor>
 <md:SPSSODescriptor AuthnRequestsSigned="true" WantAssertionsSigned="true"
...>
 </md:SPSSODescriptor> </md:EntityDescriptor>

Requiring Messages to be Signed

OOTB Configuration

Below are the OOTB boolean settings that govern when OAM needs to require incoming SAML messages to be signed (if true, OAM requires the incoming message to be signed):

Important Note: If an incoming message is signed, OAM verifies it and return an error if signature validation failed, even if OAM does not require that type of message to be signed.

Configuration

Assume that you are already in the WLST environment and connected using:

  1. Enter the WLST environment by executing: $IAM_ORACLE_HOME/common/bin/wlst.sh.

  2. Connect to the WLS Admin server: connect().

  3. Navigate to the Domain Runtime branch: domainRuntime().

SAML 2.0 AuthnRequest

To configure OAM to require or not incoming AuthnRequest messages to be signed, execute one of the following commands:

SAML 1.1 Assertion contained in a Response message

To configure OAM to require or not incoming SAML 1.1 Assertions to be signed, execute one of the following commands:

SAML 2.0 Assertion contained in a Response message

To configure OAM to require or not incoming SAML 2.0 Assertions to be signed, execute one of the following commands:

Other Settings

To configure the properties defined at the SP/IdP Partner Profiles above, execute one of the following commands:

Metadata

Changing the saml20requiresignedauthnrequest or saml20requiresignedassertion properties at a global level changes the SAML 2.0 Metadata generated by OAM, as:

A sample SAML 2.0 Metadata shows those two attributes:

<md:EntityDescriptor ...>
 <dsig:Signature>
 ...
 </dsig:Signature>
 <md:IDPSSODescriptor WantAuthnRequestsSigned="false" ...>
 ...
 </md:IDPSSODescriptor>
 <md:SPSSODescriptor AuthnRequestsSigned="true" WantAssertionsSigned="true"
...>
 </md:SPSSODescriptor> </md:EntityDescriptor>

X.509 Certificate in Message

OAM can be configured to send the X.509 signing certificate in the outgoing XML SAML message sent via the HTTP-POST or SOAP bindings.

The includecertinsignature boolean property indicates whether or not the certificate is added to the message.

To configure OAM to send the X.509 signing certificate in the outgoing message, execute one of the following commands to set the includecertinsignature boolean property:

SAML 2.0 Encryption

The SAML 2.0 protocol defines a way to encrypt various data in messages:

OAM allows an administrator to indicate which types of data should be encrypted.

OOTB Configuration

Below are the OOTB boolean settings that indicate when OAM needs to encrypt outgoing SAML messages (if true, OAM encrypts the outgoing data):

When creating a new SP Partner, the configuration for that Partner indicates that the IdP should not encrypt the Assertion:

Encrypted Assertion

To configure IdP to encrypt the outgoing Assertion for an SP Partner via the OAM Administration Console, perform the following steps:

  1. Go to the OAM Administration Console: http(s)://oam-admin-host:oam-adminport/oamconsole.
  2. Navigate to Identity Federation , Identity Provider Administration.
  3. Open the SP Partner.
  4. In the Advanced section, check the Encrypt Assertion checkbox.
  5. Click Save.

Description of the illustration Access_Management.jpg

To configure the SP Partner via WLST, perform the following steps:

  1. Enter the WLST environment by executing: $IAM_ORACLE_HOME/common/bin/wlst.sh.
  2. Connect to the WLS Admin server: connect().
  3. Navigate to the Domain Runtime branch: domainRuntime().
  4. Execute the updatePartnerProperty() command: updatePartnerProperty("PARTNER", "sp", "sendencryptedassertion", "true/false","boolean")
    1. Replace PARTNER by a Partner name.
    2. Set the value to true or false.
    3. An example is: updatePartnerProperty("AcmeSP", "sp", "sendencryptedassertion", "true","boolean")
  5. Exit the WLST environment: exit().

Encrypted NameID/Attributes

To configure the properties, perform the following steps:

  1. Enter the WLST environment by executing: $IAM_ORACLE_HOME/common/bin/wlst.sh.
  2. Connect to the WLS Admin server: connect().
  3. Navigate to the Domain Runtime branch: domainRuntime().
  4. Execute one of the following commands:
    1. To configure at a Partner Profile level, execute: putBooleanProperty("/fedpartnerprofiles/PARTNER_PROFILE/PROPERTY_NAME", "true/false")
      1. Replace PARTNER_PROFILE by a Partner Profile name.
      2. Replace PROPERTY_NAME by the name of the property to set.
      3. Set the value to true or false.
      4. An example is: putBooleanProperty("/fedpartnerprofiles/saml20-sp-partner-profile/sendencryptedattribute", "true")
    2. To configure at a Partner level, execute: updatePartnerProperty("PARTNER", "PARTNER_TYPE", "PROPERTY_NAME","true/false", "boolean")
      1. Replace PARTNER by a Partner name.
      2. Replace PARTNER_TYPE by the type of the specified Partner (idp or sp).
      3. Replace PROPERTY_NAME by the name of the property to set.
      4. Set the value to true or false.
      5. An example is: updatePartnerProperty("AcmeSP", "sp", "sendencryptedattribute", "true","boolean")
  5. Exit the WLST environment: exit()

Encryption Algorithm

The encryption algorithm can be defined at the Partner level or Partner Profile level, by setting the defaultencryptionmethod string property to one of the following values:

By default, that property is set to http://www.w3.org/2001/04/xmlenc#aes128-cbc (AES-128 CBC).

To configure the defaultencryptionmethod property, perform the following steps:

  1. Enter the WLST environment by executing: $IAM_ORACLE_HOME/common/bin/wlst.sh.

  2. Connect to the WLS Admin server: connect().

  3. Navigate to the Domain Runtime branch: domainRuntime().

  4. Execute one of the following commands:

    1. To configure at a Partner Profile level, execute:

      putStringProperty("/fedpartnerprofiles/PARTNER_PROFILE/defaultencryptionmethod", "ALGORITHM")

      1. Replace PARTNER_PROFILE by a Partner Profile name.

      2. Replace ALGORITHM by one of the above algorithm values.

      3. An example is:

      putStringProperty("/fedpartnerprofiles/saml20-sp-partner-profile/defaultencryptionmethod", "http://www.w3.org/2001/04/xmlenc#tripledes-cbc")

    2. To configure at a Partner level, execute:

      updatePartnerProperty("PARTNER", "PARTNER_TYPE","defaultencryptionmethod", "ALGORITHM", "string")

      1. Replace PARTNER by a Partner name.

      2. Replace PARTNER_TYPE by the type of the specified Partner (idp or sp).

      3. Replace ALGORITHM by one of the above algorithm values.

      4. An example is:

      updatePartnerProperty("AcmeSP", "sp", "defaultencryptionmethod","http://www.w3.org/2001/04/xmlenc#tripledes-cbc", "string")

  5. Exit the WLST environment: exit()

More Learning Resources

Explore other labs on docs.oracle.com/learn or access more free learning content on the Oracle Learning YouTube channel. Additionally, visit education.oracle.com/learning-explorer to become an Oracle Learning Explorer.

For product documentation, visit Oracle Help Center.