SAML Federation in OAM 11g R2

Oracle Access Manger 11G R2 adds SAML Relying Party support as a native feature. You no longer need to stand up and integrate OIF if you want to federate with another IdP.

SAML IdP support didn't quite make it into the first OAM R2 release - so you will still need OIF. This is on the roadmap - so stay tuned.

In this article I will show how easy it is to set up OAM as a SAML relying party.

I am using OIF configured as the sample IdP. See my previous article on setting up OIF to self federate (handy for experimenting). Assuming you have OIF configured you should be able to bring up the test SP SSO page:  http://demo:7499/fed/user/testspsso


You will be challenged for credentials. After logging in you will see this:

Great. Now we have a working IdP we can proceed to setting up OAM as a relying party.

As a pre-requisite make sure you have federation services enabled in OAM 11G (System Configuration -> Available Services)

Bring up the OAM Console and navigate to System Configuration -> Identity Federation

Click on “Identity Providers” and select the new icon.







Next we need to load the SAML IdP meta data from OIF. You can export it from the em console or bring up and save this URL:

http://demo:7499/fed/idp/metadata

Select and import this meta data file into OAM. You should also select “Create Authentication Scheme and Module” at this time. Save your changes. You now have OAM configured as a Relying Party.


We still need to configure OIF to know about OAM as the service provider. To do this, export OAM’s SP meta data (under Federation Settings), and import it into OIF (Admin -> Federations ):

Edit the new federation in OIF:

In the edit screen click on the Enable Attributes in Single Sign-on.

• Click “X509 Subject Name” and “Email Address” checkboxes and click Apply button.
• Then click on Edit button next to the “Attribute Mapping and Filters”.
• In Name mapping tab – add two mappings
• User Attribute Name – givename Assertion Name givenname
• User Attribute Name – title Assertion Name role

Make sure “Send With SSO Assertion” is enabled.

Back in OAM, navigate to Policy -> Authentication Schemes. You will see a new Authentication Scheme has been created:

You can use this Authentication Scheme in a policy - just like any other (LDAP, Kerberos, etc.).

To test your federation, create a test directory under your ohs1 instance and protect this URL with the federation Authentication Scheme. The OHS folder is something like:

/app/oracle/fmw/Oracle_WT1/instances/instance1/config/OHS/ohs1/htdocs

For this example we have created federation/index.html file under htdocs.

Bring up the policy domain for ohs1, and create an Authentication Policy that use the Federation Scheme:

Now create a resource and protect it with the policy:






Clear your browsers cookies and bring up the URL:

http://demo:7777/federation/index.html

Because this URL is protected by the Federation Scheme, OAM will initiate federation with the configured IdP. You should see the IdP logon page. After log on you will be re-directed back to the protected page.


Pro Tip: Install the SAML tracer firefox plugin so you can watch the SAML message exchange!