OracleIdentityCloudIntegratorMBean

Overview

This MBean specifies configuration attributes for the Oracle Identity Cloud Integrator provider. This provider supports simple authentication with the Oracle Identity Cloud Service and perimeter authentication (identity assertion) using Oracle Identity Cloud Service tokens.

Related MBeans

This section describes attributes that provide access to other MBeans.

Realm

Returns the realm that contains this security provider. Returns null if this security provider is not contained by a realm.

Attributes

This section describes the following attributes:

AccessTokenTimeoutWindow

The number of seconds before an access token times out that a new access token is requested. Adjusting the timeout window impacts how long access tokens are cached for reuse before an updated access token is requested from the authorization server.

ActiveTypes

The token types that are currently active.

AnyIdentityDomainEnabled

The Oracle Identity Cloud Integrator provider defines this setting as always enabled.

AppNameFilterHeaderName

The name of the HTTP header used to determine the application name applied when filtering the authentication and assertion requests to the Oracle Identity Cloud Service. When no value is supplied or can be determined, requests are not filtered by an application.

AppRolesTokenClaim

Used to get AppRoles from the token.

AudienceEnabled

Specifies whether the audience from the access token is stored in the subject for later use by the application.

Base64DecodingRequired

Specifies whether the tokens that are passed to the Oracle Identity Cloud Integrator provider for identity assertion are base 64 decoded first. This setting is defined by the Oracle Identity Cloud Integrator provider based on the supported tokens.

BasePath

The URI base path used for the connection to the Oracle Identity Cloud Service.

CacheEnabled

Specifies whether to cache the Oracle Identity Cloud Service user's information.

CacheSize

Specifies the maximum number of entries to cache.

CacheTTL

The time-to-live (TTL) of the Oracle Identity Cloud Service user cache, in seconds.

ClientAsUserPrincipalEnabled

Specifies whether the client name from the access token is stored in the subject as the username for later use by the application.

ClientId

The Client Id used when retrieving tokens from the Oracle Identity Cloud Service.

ClientIDResourceAttribute

Used for Client ID App Assertion. The default value results in the use of the attribute configured by the Oracle Identity Cloud Service.

ClientIDTokenClaim

Used to get the client Id (GUID) from the access token.

ClientNameTokenClaim

Used to get the client name from the access token.

ClientSecret

The Client secret used when retrieving tokens from the Oracle Identity Cloud Service.

ClientSecretEncrypted

ClientTenant

The tenant in which the Client Id resides from the Oracle Identity Cloud Service. When no client tenant name is configured, the tenant configured for the provider is used.

ClientTenantTokenClaim

Used to get the Identity Domain for the client from the access token.

ConnectTimeout

The maximum time to wait, in seconds, for the connection to the Oracle Identity Cloud Service to be established.

ControlFlag

Returns how the login sequence uses the Authentication provider.

A REQUIRED value specifies this LoginModule must succeed. Even if it fails, authentication proceeds down the list of LoginModules for the configured Authentication providers. This setting is the default.

A REQUISITE value specifies this LoginModule must succeed. If other Authentication providers are configured and this LoginModule succeeds, authentication proceeds down the list of LoginModules. Otherwise, control is return to the application.

A SUFFICIENT value specifies this LoginModule need not succeed. If it does succeed, return control to the application. If it fails and other Authentication providers are configured, authentication proceeds down the LoginModule list.

An OPTIONAL value specifies this LoginModule need not succeed. Whether it succeeds or fails, authentication proceeds down the LoginModule list.

Description

A short description of the Oracle Identity Cloud Integrator provider.

GroupsTokenClaim

Used to get groups from the token.

Host

The host name used to connect to the Oracle Identity Cloud Service.

Issuer

An override for the token issuer value used during validation. The issuer is normally obtained from the Oracle Identity Cloud Service Discovery Metadata. When configured, the issuer value is used for all tenants.

JSONWebKeySetURI

An override for the JSON Web Key Set location (jwks_uri) used during validation of tokens. A file location can be specified to load keys from the local environment. The location of the keys is normally obtained from the Oracle Identity Cloud Service Discovery Metadata. When configured, the URI is used for all tenants.

KnownTenantEmptyMetadataTTL

The time-to-live (TTL) of the empty metadata for known Oracle Identity Cloud Service tenants in Oracle Identity Cloud Service metadata cache, in seconds. The default value 300.

KnownTenantPrefixList

The list of tenant prefixes that would identify known or valid Oracle Identity Cloud Service tenant names. Used in combination with KnownTenantEmptyMetadataTTL to decide the TTL of cached empty metadata for Oracle Identity Cloud Service tenants. When no perfixes are configured, all tenants are considered as Oracle Identity Cloud Service tenants.

Name

OnlyUserTokenClaimsEnabled

Specifies whether the claims about the user from the token are the only claims processed when a subject is created. Any additional information in the subject about the user, including groups and application roles, is obtained from the Oracle Identity Cloud Service.

Port

The port number used to connect to the Oracle Identity Cloud Service.

ProviderClassName

The name of the Java class used to load the Oracle Identity Cloud Integrator provider.

ResourceTenantTokenClaim

Used to get the Identity Domain for the resource from the access token.

ResponseReadTimeout

The maximum time to wait, in seconds, for a response from the Oracle Identity Cloud Service.

ServerBackoffEnabled

Specifies whether to backoff and retry requests when Oracle Identity Cloud Service returns a response that too many requests are being processed in a specific time window.

ServerNotAvailableCounterInterval

The interval, in seconds, that the count of authentication failures caused by the Oracle Identity Cloud Service not being available are logged to the server log. Setting to zero (0) or negative value turns off the logging of the count.

SignaturePreferX509Certificate

If the optional X.509 certificate chain ("x5c claim") is available from the JSON Web Key Set, this attribute specifies whether the public key obtained from the X.509 certificate in the supplied chain is used during the verification of the token signature.

SSLEnabled

Specifies whether the TLS/SSL protocol is used when connecting to the Oracle Identity Cloud Service.

SupportedTypes

The types of tokens supported by the Oracle Identity Cloud Integrator provider.

SyncFilterEnabled

Specifies whether the synchronization filter is enabled for servlet applications deployed on the security realm.

SyncFilterMatchCase

Specifies whether the synchronization filter performs case match when comparing the session user and the remote user.

SyncFilterOnlyClientCertRequests

Specifies whether the synchronization filter only filters the requests with CLIENT_CERT or CLIENT-CERT Auth Type.

SyncFilterPreferHeader

Specifies whether the synchronization filter looks into the requests header before looking at the token for the remote user and tenant. This attribute is used only when the synchronization filter is enabled for requests with all authentication types.

SyncFilterUserHeaderNames

The names of HTTP headers sent on requests that the synchronization filter uses to look for remote user information.

Tenant

The name of the primary tenant where users and groups reside from the Oracle Identity Cloud Service. When the primary tenant is not configured, the user authentication processing must identify the tenant name.

TenantDataFlushInterval

The interval, in seconds, that the cached data for all the tenants, including the metadata and public key is flushed. Adjusting the interval impacts how long the tenant data is cached for reuse before it is updated. The default value is 0, which means that tenant data from a previous download is not cleared unless triggered by an MBean operation or configuration change.

TenantDataReloadEnabled

Specifies whether to re-load Oracle Identity Cloud Service tenant data when a token validation error occurs.

TenantDataReloadInterval

The interval, in seconds, that the Oracle Identity Cloud Service tenant data would not be removed when a token validation error occurs. Adjusting the interval impacts how long the tenant data is cached for reuse before repeated token validation errors result in a tenant data re-load.

TenantHeaderNames

The names of HTTP headers sent on requests to the Oracle Identity Cloud Service that are used to determine the tenancy during authentication.

TenantHostNameTemplate

The tenant-based host name, in Fully Qualified Domain name (FQDN) format, comprised of a tenant name and a host name. This attribute contains the tokens, such as {%tenant}.{%host}, that are replaced with the actual values.

TenantNames

The list of allowable tenant names consumed from the Oracle Identity Cloud Service. When no tenant names are configured, any tenant from the Oracle Identity Cloud Service is accessible.

TenantTokenClaim

Used to get the Identity Domain from the token.

ThreadLockTimeout

The maximum time to wait, in seconds, when a thread attempts to acquire a synchronization lock for obtaining metadata, keys and access tokens.

TokenCacheEnabled

Specifies whether to cache Oracle Identity Cloud Service tokens after successful validation of the token.

TokenClockSkew

The allowable variance, in seconds, for the token Expiration, Issued At, and Not Before attributes.

TokenSecureTransportRequired

Determines whether the Oracle Identity Cloud Integrator provider checks for a secure transport connection before accepting active token types. When enabled and a secure transport connection cannot be determined, tokens are not accepted for identity assertion.

TokenValidationLevel

The level of validation performed on Oracle Identity Cloud Service tokens passed to the Identity Asserter. Valid values are FULL, NORMAL, SIGNATURE and NONE.

TokenVirtualUserAllowed

Determines whether to allow identity assertion to authenticate WebLogic Server users who are not represented in the security store.

UnknownTenantEmptyMetadataTTL

The time-to-live (TTL) of the empty metadata for unknown tenants in Oracle Identity Cloud Service metadata cache, in seconds. The default value is 0 to disable the TTL.

UserAuthenticationAssertionAttribute

Used for User Authentication and Assertion. The default value results in the use of the attribute configured by the Oracle Identity Cloud Service.

UserIDResourceAttribute

SCIM User resource type attribute that specifies the ID (GUID) of the user.

UserIDTokenClaim

Used to get the user ID (GUID) from the token. Corresponds to the SCIM User ID resource type attribute.

UserNameResourceAttribute

SCIM User resource type attribute that specifies the name of the user.

UserNameTokenClaim

Used to get the user name from the token. Corresponds to the SCIM User name resource type attribute. If not set, the subject ("sub claim") is used.

Version

The version number of the Oracle Identity Cloud Integrator provider.

Operations

This section describes the following operations:

clearMetadata

Clears (removes) the loaded metadata for the specified tenant. The metadata is re-loaded upon access from a user of the specified tenant.

clearPublicKey

Clears (removes) the loaded public key(s) for the specified tenant. The public key(s) is re-loaded when a token requires verification.

clearTenantData

Clears (removes) all data (metadata, keys, etc.) for all the known tenants. Tenant data is re-loaded upon access from a user.

hasMetadataAvailable

Verifies if metadata is loaded for a tenant. It returns true if the metadata is available; false otherwise.

hasPublicKeyAvailable

Verifies if the public key is loaded for a tenant. It returns true if the public key is available; false otherwise.

isSet

Returns true if the specified attribute has been set explicitly in this MBean instance.

unSet

Restore the given property to its default value.

wls_getDisplayName