Oracle Fusion Middleware Documentation > Oracle WebLogic Server 12.1.3.0 Documentation > Administration Console Online Help > Create a SAML 2.0 Web service Service Provider partner

Administration Console Online Help

Previous Next Open TOC in new window
Content starts here

Create a SAML 2.0 Web service Service Provider partner

Before you begin

Before you configure a SAML 2.0 Web service Service Provider partner, create an instance of the SAML 2.0 Credential Mapping provider in the security realm and configure it. See Configuring a SAML 2.0 Credential Mapping Provider for SAML 2.0.


To create a SAML 2.0 Web service Service Provider partner:

  1. In the left pane, select Security Realms.
  2. On the Summary of Security Realms page, select the name of the realm (for example, myrealm).
  3. On the Settings for Realm Name page select Providers > Credential Mapping.
  4. In the Credential Mapping Providers table, select the SAML 2.0 Credential Mapping provider.
  5. On the Settings for SAML 2.0 CredMapper page, select Management.
  6. In the table under Service Provider Partners, click New > New Web Service Service Provider Partner.
  7. On the Create a SAML 2.0 Web Service Service Provider Partner page, enter the name of the new Service Provider partner, and click Finish.

    Note: If you click the browser's Back button after clicking Finish, the partner name is reset to the default.

  8. In the Service Provider Partners table, select the name of your newly-created Service Provider partner.
  9. In the Settings for SAML 2.0 CredMapper page, select Enabled to enable interactions between this server and this Service Provider partner.
  10. Specify one or more partner lookup strings, and optionally Audience URIs, as Audience URI attributes. WebLogic Server overloads this attribute to serve both functions, as follows:
    • A partner lookup string contains an endpoint URL that enables the SAML 2.0 Credential Mapping provider to match a requested Web service endpoint with a Service Provider partner for which an assertion is then generated. Configuring a partner lookup string for a Service Provider partner is necessary in order for WebLogic Server to be able to discover that partner at run time.
    • The endpoint URL in a partner lookup string may optionally also be designated as an Audience URI that must be included in the assertion that is generated for the Service Provider partner.

    Note: You may also designate Audience URIs separately from partner lookup strings.

    For details about how to create a partner lookup string, and also how to designate the lookup URL as an Audience URI in that string, see Create partner lookup strings.

  11. Configure additional settings as appropriate. For example, you may choose to do one or more of the following:
    1. Specify a Service Provider Name Mapper Class, which is a custom implementation of the com.bea.security.saml2.providers.SAML2CredentialNameMapper interface. If specified, this class overrides the default SAML 2.0 credential mapper name mapper class, with which the SAML 2.0 Credential Mapping provider is configured. The class you specify here is used only for assertions generated for this Service Provider partner.

      For more information about this name mapper class, see Configuring a SAML 2.0 Credential Mapping Provider for SAML 2.0 and API Reference for com.bea.security.saml2.providers.SAML2CredentialNameMapper interface.

    2. Specify time to live values for assertions generated for this Service Provider partner.
    3. Select Generate Attributes to include group information in the assertions generated for this particular Service Provider partner. This partner can subsequently extract this information from the assertion to determine the groups to which the mapped Subject belongs.
    4. Select Include One Time Use Condition if you want the generated assertions to be used only once by your Service Provider partner and not to be available for reuse.

      Note that the Key Info Included attribute is available in WebLogic Server for SAML 2.0 services, but no signing certificate is included in assertions generated by SAML 2.0 services. Partners should rely upon the signing certificates that they should have already exchanged securely and maintain in their partner registry.

    5. Coordinate with your Service Provider partner to agree upon the assertion confirmation method and whether assertions generated for this partner should be signed.

    For more information about the options for configuring a Web service Service Provider partner, see Using Security Assertion Markup Language (SAML) Tokens For Identity.

  12. Click Save.

Result

The Web service Service Provider partner is created in the local server instance.


Back to Top