Adding static attributes to #SAML Assertions in #OIF 11g #Oracle #Identity #IDM

Oracle Identity Federation is set up and configured as an Identity Provider.  One of the client’s partners would like for the assertion to include two (2) attributes that do not exist in the IDP’s user data store.  To include these attributes in the assertion we will use Oracle’s Custom Action Framework.  (Documented in 11.1.1.4)

The syntax to set up the environment on Linux systems is:

(replace $ORACLE_HOME with the correct path for your environment.)

[e.g. source /apps/oracle/Middleware/Oracle_IDM1/fed/scripts/setOIFEnv.sh]

1. Enter the WLS scripting environment for the OIF instance.
2. Set the authncontext property containing the root context of the post-processing plugin page

   setConfigProperty('serverconfig','authnpath','/bridge.jsp','string')

3. Set the authnpath property containing the relative path of the post-processing plugin page:

   setConfigProperty('serverconfig','authncontext','/bridge','string')

4. Exit the WLST script environment

Modifying the sample application :

To modify the attributes placed into the user session, modify the bridge.jsp

file in the /bridge/web directory.

To change the application name and/or context, modify the application.xml and
the web.xml file in the /bridge/descriptors directory.

After modifying the application JSP or descriptor files, you must rebuild the
application by invoking the Ant build script from the /bridge directory:

ant build

The resulting bridge.ear file is written to the /bridge/build/ear directory.

The JSP looks like this:

<%@page buffer="5" autoFlush="true" session="false"%> 
<%@page language="java" import="java.util.*"%> 
<% ///////////////////////////////////////////////////////////////////////// // This sample JSP sets an attribute in the OIF user session, by // acting as a bridge in the OIF authentication engine flow. // // Copyright (C) 2010, Oracle and/or its affiliates. All rights reserved. ///////////////////////////////////////////////////////////////////////// 
response.setHeader("Cache-Control", "no-cache"); 
response.setHeader("Pragma", "no-cache"); 
response.setHeader("Expires", "Thu, 29 Oct 1969 17:04:19 GMT"); 

// This JSP page receives a request from an OIF authentication engine,// adds an attribute to the map stored in the request obect for the user session, 
// and forwards the request back to OIF to resume the authentication flow. 
// Retrieve any exiting attribute map from the request. 

Map attributes = (Map)request.getAttribute("oracle.security.fed.authn.attributes"); 

// Create the attribute map if none exists yet. 
if (attributes == null) attributes = new HashMap(); 
// Add specVer={"1.0"} to attribute map. 
Set values = new HashSet(); 
Set values1 = new HashSet(); 
values.add("1"); 
values1.add("0"); 
attributes.put("application", values); 
attributes.put("siteid", values1); 

// Set the attribute map in the request. 

request.setAttribute("oracle.security.fed.authn.attributes", attributes); 

// Forward the user request back to OIF. 
request.getSession().getServletContext().getContext("/fed").getRequestDispatcher("/user/loginsso").forward(request, response); 

%>

This code is also available here in the file bridge.jsp.

• http://download.oracle.com/docs/cd/E13222_01/wls/docs91/config_scripting/using_WLST.html
• Oracle Identity Federation 11g Administrator’s Guide (11.1.1.4 BETA Draft)
• https://codesamples.samplecode.oracle.com/servlets/tracking?id=S489
  The  framework used in that example is present in OIF 11gR1 PS1 (11.1.1.2.0) but isn’t documented until PS3 (11.1.1.4.0)