Authentication in IdP

This article discusses about authentication when OAM acts as an IdP and how the server can be configured to use specific OAM Authentication Schemes to challenge the user. When OAM 11gR1 acting as an IdP and OAM 11g were integrated together, OAM was delegating the user authentication to OAM via the use of WebGate:

Note: Given the advanced nature of the configuration, OAM authentication setup can only be managed via OAM WLST commands.

Overview

In the 11.1.2.2.0 or later release of OAM, the OAM J2EE Web Application and the OAM J2EE Web Application are contained in the same OAM J2EE EAR Application which is deployed in a standalone WLS instance. This deployment approach allows the two modules to internally forward the incoming user’s HTTP request from OAM to OAM and vice versa. This allows the IdP application to trigger a local OAM authentication operation that challenges and identify the user. At runtime, when authentication is required by IdP in a Federation operation, IdP will:

Testing Setup

Use the following testing environment:

Execute several test cases:

Test #1:

Test #2:

Note: If HTTP Basic Authentication will be used at the IdP, the WebLogic domain where OAM are running needs to be configured to not validate the HTTP Basic Authentication for unsecured resources.

HTTP Basic Authentication

By default, if a browser sends HTTP Basic Authentication credentials to OAM, the WLS server attempts to validate those before letting OAM process the request: this can result in authentication failures, particularly if the WLS domain was not configured with WLS LDAP Authenticators for each Identity Store created in OAM.

Note: Even if the WLS domain was configured correctly to have a WLS LDAP Authenticator for each Identity Store created in OAM, this results in two authentication operations, one by WLS, and the other one required by OAM to create an OAM session.

It is possible to disable the automatic validation of HTTP Basic Authentication credentials sent to [unsecured applications]{.underline} in the WLS domain where OAM is running. See section “Understanding BASIC Authentication with Unsecured Resources” of the Oracle Fusion Middleware Programming Security for Oracle WebLogic Server guide for more information. To disable the automatic validation of HTTP Basic Authentication credentials sent to [unsecured applications]{.underline} in the WLS domain, execute the following steps:

  1. Enter the WLST environment by executing: $IAM_ORACLE_HOME/common/bin/wlst.sh
  2. Connect to the WLS Admin server: connect()
  3. Start an edit session: edit() startEdit()
  4. Navigate to the SecurityConfiguration node: cd('SecurityConfiguration')
  5. Navigate to the domain (replace DOMAIN_NAME with the name of the WLS domain where OAM is installed): cd('DOMAIN_NAME')
  6. Set the EnforceValidBasicAuthCredentials setting to false to disable tomatic validation of HTTP Basic Authentication credentials sent to unsecured applications: set('EnforceValidBasicAuthCredentials', 'false')
  7. Save and activate the changes: save() activate()
  8. Restart the servers in the WLS domain for the changes to take effect

Global Default Authentication

The first step is to create and configure SP Partners in IdP for SAML 2.0 SSO. After having set that up, the list of SP Partners in IdP looks like:

Description of the illustration accessmanagement.jpg

Performing Federation SSO involving either of those AcmeSP or HRsp with IdP results in the OAM server challenging the user using the default global Authentication Scheme configured to be LDAPScheme OOTB:

Description of the illustration accessmanager.jpg

To switch the default global Authentication Scheme to BasicScheme, use the OAM WLST setIdPDefaultScheme() command and specify which scheme to be used as the default:

  1. Enter the WLST environment by executing: \$IAM_ORACLE_HOME/common/bin/wlst.sh

  2. Connect to the WLS Admin server: connect()

  3. Navigate to the Domain Runtime branch: domainRuntime()

  4. Execute the setIdPDefaultScheme() command: setIdPDefaultScheme("BasicScheme")

  5. Exit the WLST environment: exit() Performing Federation SSO involving either of those AcmeSP or HRsp with IdP results in the OAM server challenging the user using the OAM BasicScheme instead of LDAPScheme:

    Description of the illustration windowssecurity.jpg

To switch back the default global Authentication Scheme to LDAPScheme, perform the following operations:

  1. Enter the WLST environment by executing: \$IAM_ORACLE_HOME/common/bin/wlst.sh
  2. Connect to the WLS Admin server: connect()
  3. Navigate to the Domain Runtime branch: domainRuntime()
  4. Execute the setIdPDefaultScheme() command : setIdPDefaultScheme("LDAPScheme")
  5. Exit the WLST environment: exit()

Performing Federation SSO involving either of those AcmeSP or HRsp with IdP results in the OAM server challenging the user via the LDAPScheme.

SP Partner Profile Authentication

From the previous test cases, the setup is as:

To configure HRsp to use a new SP Partner Profile, execute the following commands:

  1. Enter the WLST environment by executing: \$IAM_ORACLE_HOME/common/bin/wlst.sh
  2. Connect to the WLS Admin server: connect()
  3. Navigate to the Domain Runtime branch: domainRuntime()
  4. Create the new SP Partner Profile from the default SAML 2.0 SP Partner Profile: createFedPartnerProfileFrom("new-saml20-pp", "saml20-sp-partner-profile")
  5. Bind HRsp Partner to the new SP Partner Profile: setFedPartnerProfile("HRsp", "sp", "newsaml20-pp")
  6. Exit the WLST environment: exit()

At this point, performing Federation SSO involving either of those AcmeSP or HRsp with IdP results in the OAM server challenging the user via the LDAPScheme. To configure the new SP Partner Profile to have BasicScheme as the default Authentication Scheme, use the OAM WLST setSPPartnerProfileDefaultScheme() command:

  1. Enter the WLST environment by executing: \$IAM_ORACLE_HOME/common/bin/wlst.sh
  2. Connect to the WLS Admin server: connect()
  3. Navigate to the Domain Runtime branch: domainRuntime()
  4. Set the default Authentication Scheme for the new SP Partner Profile to BasicScheme: setSPPartnerProfileDefaultScheme("newsaml20-pp", "BasicScheme")
  5. Exit the WLST environment: exit()

Now, performing Federation SSO with:

Bind HRsp back to the default SP Partner Profile, and then delete the SP Partner Profile I created in this test:

  1. Enter the WLST environment by executing: \$IAM_ORACLE_HOME/common/bin/wlst.sh
  2. Connect to the WLS Admin server: connect()
  3. Navigate to the Domain Runtime branch: domainRuntime()
  4. Bind HRsp Partner to the default SP Partner Profile: setFedPartnerProfile("HRsp", "sp", "saml20-sp-partner-profile")
  5. Delete the new SP Partner Profile: deleteFedPartnerProfile("new-saml20-pp")
  6. Exit the WLST environment: exit()

After executing those commands, performing Federation SSO involving either of those AcmeSP or HRsp with IdP results in the OAM server challenging the user via the LDAPScheme.

SP Partner Authentication

From the previous test cases, the setup is as:

To configure the default SAML 2.0 SP Partner Profile to use BasicScheme as the Authentication Scheme, perform the following operations:

  1. Enter the WLST environment by executing: \$IAM_ORACLE_HOME/common/bin/wlst.sh
  2. Connect to the WLS Admin server: connect()
  3. Navigate to the Domain Runtime branch: domainRuntime()
  4. Set the default Authentication Scheme for the new SP Partner Profile to BasicScheme: setSPPartnerProfileDefaultScheme("saml20-sppartner-profile", "BasicScheme")
  5. Exit the WLST environment: exit()

At this point, performing Federation SSO involving either of those AcmeSP or HRsp with IdP results in the OAM server challenging the user via the BasicScheme. To configure the AcmeSP SP Partner to have LDAPScheme as the default Authentication Scheme, use the OAM WLST setSPPartnerDefaultScheme() command:

  1. Enter the WLST environment by executing: \$IAM_ORACLE_HOME/common/bin/wlst.sh
  2. Connect to the WLS Admin server: connect()
  3. Navigate to the Domain Runtime branch: domainRuntime()
  4. Set the default Authentication Scheme for the AcmeSP SP Partner to LDAPScheme: setSPPartnerDefaultScheme("AcmeSP", "LDAPScheme")
  5. Exit the WLST environment: exit()

Now, performing Federation SSO with:

Step Up Authentication via Different Authn Levels

From the previous test cases, the setup is as:

OOTB, the Authentication Level for both LDAPScheme and BasicScheme is set to 2. To change the Authentication Level of the LDAPScheme to 3, perform the following operations:

  1. Go to the OAM Administration Console: http(s)://oam-admin-host:oam-adminport/oamconsole

  2. Navigate to Access Manager, Authentication Schemes

  3. Click Search and select LDAPScheme

  4. Set the Authentication Level to 3

  5. Click Apply

    Description of the illustration Authenticationlevel.jpg

After those changes, if the user is already authenticated at OAM and that the user performs a Federation SSO operation with IdP, OAM ensures that the scheme which was used to authenticate the user in the first place has a level higher or equal to the scheme configured for the current SP Partner with which Federation SSO is exercised. For example:

More Learning Resources

Explore other labs on docs.oracle.com/learn or access more free learning content on the Oracle Learning YouTube channel. Additionally, visit education.oracle.com/learning-explorer to become an Oracle Learning Explorer.

For product documentation, visit Oracle Help Center.