OAM and OSTS Service Information

OAM and OSTS are two products designed to provide Federation capabilities across security domains:

Federation between services is based on trust which is established by exchanging

This article discusses the various kinds of information one has to know in order to be able to set up a Federation agreement between OAM and remote partners, including:

Enabling OAM / OSTS Services

OAM/OSTS Enablement

Out of the box, the OAM and OSTS components are disabled in the OAM server, and need to be enabled prior to using them. To enable OAM and/or OSTS, you need to:

  1. Go to the OAM Administration Console: http(s)://oam-admin-host:oam-adminport/oamconsole.

  2. Navigate to Configuration , Available Services.

  3. Enable the components you need.

Description of the illustration Available_services.jpg

To verify that OAM is correctly enabled, you can attempt to download OAM SAML 2.0 Metadata from http(s)://oam-runtime-host:oam-runtimeport/oamfed/idp/metadata

OAM Services

After having turned on the OAM component, all OAM services are enabled:

To selectively enable or disable those above services, use the OAM WLST command configureFederationService():

  1. Enter the WLST environment by executing: $IAM_ORACLE_HOME/common/bin/wlst.sh.

  2. Connect to the WLS Admin server: connect().

  3. Navigate to the Domain Runtime branch: domainRuntime().

  4. Execute the configureFederationService() command: configureFederationService(<SERVICE>,<true/false>).

  5. Replace <SERVICE> by idp, sp, attributeresponder or attributerequester.

  6. Set true to enable the service or false to disable it.

For example, to disable the SAML Attribute Authority service, execute:

configureFederationService("attributeresponder","false")

SAML Issuer / OpenID Realm

When communicating via the SAML protocols, Federation servers identify themselves via the Issuer element in the SAML messages. This is also known as the Entity ID or the Provider ID. This identifier must be unique among partners so that one identifier references a single entity.

In the OpenID 2.0 protocol, the Relying Party or Service Provider can be identified via the Realm element.

OAM

During installation, the Provider ID used in SAML operations and the Realm used in OpenID 2.0 exchanges are set to:

To change the Provider ID, perform the following steps:

  1. Go to the OAM Administration Console: http(s)://oam-admin-host:oam-adminport/oamconsole.

  2. Navigate to Configuration , Federation Settings.

  3. Set the Provider ID to the desired value.

    4. Note #1: The Succinct ID which is the SHA-1 hash of the Provider ID and used in SAML Artifact protocol is re-generated.

    Note #2: After resetting the Provider ID, you need to notify all the existing partners of the change and redistribute SAML 2.0 Metadata if necessary.

  4. Click Apply.

Description of the illustration Federation_Settings.jpg

OSTS

During installation, the Provider ID used in SAML Issuance Templates is set to:

`http://oam-runtime-hostname:oam-runtimeport/oam/fed`

To change or retrieve the Provider ID from an Issuance Template, perform the following steps:

  1. Go to the OAM Administration Console: http(s)://oam-admin-host:oam-adminport/oamconsole.

  2. Navigate to Configuration , Security Token Service Settings , Token Issuance Templates.

  3. Click on the desired SAML Issuance Template.

  4. Click on the Issuance Properties tab.

  5. The Provider ID is the Assertion Issuer property. Set the corresponding field to update the Provider ID for this SAML Issuance Template.

  6. Click Apply.

Description of the illustration Issuance_Properties.jpg

SAML 2.0 Metadata

The SAML 2.0 SSO protocol define the Metadata XML document which is used by Federation servers to publish all information the partners need to be aware of in order to exchange SAML 2.0 messages.

The SAML 2.0 Metadata of a Federation server includes:

The OAM Metadata can be retrieved from the OAM Administration Console:

  1. Go to the OAM Administration Console: http(s)://oam-admin-host:oam-adminport/oamconsole.

  2. Navigate to Configuration , Federation Settings.

  3. Click on the Export Metadata button.

  4. Save the file on your local computer.

Description of the illustration Export_Metadata.jpg

The OAM Metadata can also be retrieved by accessing a URL on the OAM runtime server: http://oam-runtime-host:oam-runtime-port/oamfed/idp/metadata.

Note: It is possible to generate OAM Metadata for specific signing and encryption keys by using the following URL (read article about Key Management in OAM/OSTS for more information) http://oam-runtime-host:oam-runtime-port/oamfed/idp/metadata?signid=<SIGN_KEYENTRY_ID>&encid=<ENC_KEYENTRY_ID>.

Certificates

For SAML 2.0 partners not supporting the consumption of SAML 2.0 Metadata, or for SAML 1.1 partner or even STS partners, the administrator needs to provide the signing certificate and possibly the encryption certificate as standalone files.

The OAM/OSTS Settings section in the administration console lists the key entries used by the system (read article about Key Management in OAM/OSTS for more information)

To view the current key entries known to OAM/OSTS:

  1. Go to the OAM Administration Console: http(s)://oam-admin-host:oam-adminport/oamconsole.

  2. Navigate to Configuration , Federation Settings / Security Token Service Settings.

  3. In the Keystore section, see the list of Key IDs, each representing a key entry in OAM/OSTS, and each referencing a key entry in the OAM Keystore (different key IDs can reference the same key entry in the OAM Keystore).

Description of the illustration key_entries.jpg

To retrieve the certificate file of a specific key ID, open a browser and use the following URL to generate the certificate in PEM format:

OAM Endpoints

This section lists the various endpoints published by OAM, some specific to a protocol, others protocol agnostic.

Note: It is important to access the OAM services via the public endpoints (load balancer, HTTP reverse proxy…) in order for HTTP cookies set in the browser to be sent back by the browser. In this list, only paths is listed, not the public protocol/hostname/port.

SAML 2.0

The IdP SAML 2.0 endpoints are:

The SP SAML 2.0 endpoints are:

The SAML 2.0 Attribute Authority/Responder endpoints are:

The SAML 2.0 Attribute Requester does not publish any endpoint.

SAML 1.1

The IdP SAML 1.1 endpoints are:

The SP SAML 1.1 endpoints are:

The SAML 1.1 Attribute Authority/Responder endpoints are:

The SAML 1.1 Attribute Requester does not publish any endpoint.

OpenID 2.0

The IdP OpenID 2.0 endpoints are:

The SP OpenID 2.0 endpoints are:

Other Services

There are a few services that are protocol agnostic:

Note: Prior to using this service, you must enable it via the configureTestSPEngine() command:

OSTS Endpoints

OSTS publishes SOAP endpoints based on how the Security Token Service is configured.

The Security Token Service , Endpoints section in the OAM Administration Console lists the endpoints defined for OSTS and how they are protected by the OWSM Agent.

Description of the illustration Endpoints.jpg

For a given endpoint (for example /wss11user), the following URLs are published:

More Learning Resources

Explore other labs on docs.oracle.com/learn or access more free learning content on the Oracle Learning YouTube channel. Additionally, visit education.oracle.com/learning-explorer to become an Oracle Learning Explorer.

For product documentation, visit Oracle Help Center.