Skip to main content

Setting up federation between 2 OAM (PS3)

Decide which OAM will act as SP and which one will act as Idp.

 Access the Idp metadata from by accessing the below URL:
http://<IDP-OAM-Host>:14100/oamfed/idp/metadata

Please not that this metadata also contains the SP metadata so remove the SP metadata tags from the metadata else it will give 'Invalid format error' while importing it in SP.

Once the IDP metadata is downloaded and modified. Login to the SP-OAM and click on federation --> Service provider management.

Click on create identity provider partner. Provide a name and select the metadata file to import.


Provide the name of the id store from where it will be mapped. Also mention the attribute which will be mapped with the Name ID attribute from Assertion.

Click on 'Create Authentication Scheme and module'. This will create the required scheme and module in the OAM. Below is the Authentication scheme:

Use this Authentication Scheme to protect any existing resource.

Now access the service provide metadata as below:

http://<SP-OAM-HOST>:14100/oamfed/sp/metadata

Again this will contain Idp metadata as well so remove the idp part and keep only SP part.

Login to SP-OAM --> Federation --> Identity Provider Management.

Create New Service Provider Partner by selecting the SP metadata.




Select the Name ID format and attribute name which will be sent.


Configuration is completed. Now Access the resource protected by SP-OAM and it will redirect you to the IDP-OAM form. Login using USER-ID password and if authenticated it will send the email address in assertion. A user with the same email ID should exist in SP-OAM authentication store and User will be able to access the protected resource.

Comments

Post a Comment

Popular posts from this blog

Developing Prepopulate Adapter with OIM 11g R2

1.      Prepopulate Adapter in OIM uses the plugin point oracle.iam.request.plugins.PrePopulationAdapte r. 2.      Write the Java code which returns the value which has to be populated on the form. 3.      This code will implement the plugin point oracle.iam.request.plugins.PrePopulationAdapte r. Code Snippet: - package com.oracle.oim.utility.eventhandler; import java.io.Serializable; import java.util.Iterator; import java.util.List; import java.util.logging.Logger; import oracle.iam.identity.exception.NoSuchUserException; import oracle.iam.identity.exception.UserLookupException; import oracle.iam.identity.usermgmt.api.UserManager; import oracle.iam.identity.usermgmt.vo.User; import oracle.iam.platform.Platform; import oracle.iam.platform.authz.exception.AccessDeniedException; import oracle.iam.request.exception.RequestServiceException; import oracle.iam.request.vo.Beneficiary; import oracle.iam.request.vo.RequestData; public c
5 comments
Read more

OIM Tuning

Application Module tuning is a critical setting which will affect the UI performance. Following are the recommended application module settings for OIM and these are already set out-of-box (OOB) in later releases of OIM 11g R2. Ensure that these settings are implemented as recommended in your environment. -Djbo.ampool.doampooling=true -Djbo.ampool.minavailablesize=1 -Djbo.ampool.maxavailablesize=120 -Djbo.recyclethreshold=60 - Djbo.ampool.timetolive=-1 -Djbo.load.components.lazily=true - Djbo.doconnectionpooling=true -Djbo.txn.disconnect_level=1 - Djbo.connectfailover=false -Djbo.max.cursors=5 - Doracle.jdbc.implicitStatementCacheSize=5 - Doracle.jdbc.maxCachedBufferSize=19 open DOMAIN_HOME/bin/setDomainEnv.sh file for the WebLogic Server instance.find these lines: JAVA_OPTIONS="${JAVA_OPTIONS}" export JAVA_OPTIONS and change it to: JAVA_OPTIONS="-Djbo.ampool.doampooling=true -Djbo.ampool.minavailablesize=1 -Djbo.ampool.maxavailablesize=120 -D
Post a Comment
Read more

Creating Role through OIM API - 11gR2

package com.oim.utilities; import java.util.HashMap; import oracle.iam.identity.rolemgmt.api.RoleManager; import oracle.iam.identity.rolemgmt.api.RoleManagerConstants; import oracle.iam.identity.rolemgmt.vo.Role; import oracle.iam.platform.OIMClient; public class RoleManagement  { static RoleManager roleManager=null; static OIMClient client=null; @SuppressWarnings("null") public static void createRole(String roleName){ System.out.println("RoleManagement :: createRole :: role name is "+roleName); try  { if (roleName!=null) { HashMap<String, Object> mapAttrs = new HashMap<String, Object>();; mapAttrs.put(RoleManagerConstants.ROLE_NAME, roleName); mapAttrs.put(RoleManagerConstants.ROLE_DISPLAY_NAME,roleName); mapAttrs.put(RoleManagerConstants.ROLE_DESCRIPTION, roleName); Role role = new Role(mapAttrs); // Initialising the OIM Connection client=ClientOIM.initialise(); System.out.println("RoleManagemen
1 comment
Read more