1. Access the WebLogic Server Console as administrator.
2. Click Lock & Edit.
3. Select Security Realm.
4. Select myrealm.
5. Select Providers, and then click New.
6. Enter SAML2IdentityAsserter as Name, select SAML2IdentityAsserter as Type, and then click OK.

   The SAML2IdentityAsserter is displayed under the Authentication Providers table.

7. On the Providers page, click New.
8. Enter SAMLAuthenticator as Name, select SAMLAuthenticator as Type, and then click OK.

   The SAMLAuthenticator is displayed under the Authentication Providers table.

9. Click Reorder.
10. Select and reorder the providers in the following order:
    1. SAML2IdentityAsserter
    2. SAMLAuthenticator
    3. DefaultAuthenticator
    4. DefaultIdentityAsserter
11. Click OK.
12. Click SAMLAuthenticator.
13. Select SUFFICIENT as Control Flag and then click Save.
14. Return to the Providers page.
15. Click DefaultAuthenticator.
16. Select SUFFICIENT as Control Flag and then click Save.
17. Click Activate Changes.
18. Restart the server.

To specifiy General Information:

1. Access the WebLogic Server Console as administrator.
2. Click Lock & Edit.
3. Click Environment and then select Servers.
4. Click the manager server (AdminServer) that has the Inventory application (for example, ms1).
   • In a clustered environment, the later steps must be performed on each managed server that has the Inventory application. (other than proxy and admin server)
5. Click Federation Services and then select SAML 2.0 General.
6. Define the site information and additional settings for the SAML assertion.
7. Generate the service provider metadata file.
8. Modify the General settings as showin the the table by replacing the information according to your requirement and the server.
9. Click Save.

http://<InventoryHostName>:<InventoryPort>/saml2

samlUIM

Deselected

To configure the SAML service provider:

1. Access the WebLogic Server Console as administrator.
2. Click Lock & Edit.
3. Click Environment and then select Servers.
4. Click the manager server (AdminServer) that has the Inventory application (for example, ms1).
   • In clustered environment, the later steps must be performed on each managed server that has the Inventory application (other than proxy and admin server).
5. Select Configuration, then Federation Services and then SAML 2.0 Service Provider.
6. Select Enabled.
7. Select Single Logout Enabled.
8. Select Assertion Subject Timeout Check.
9. Select POST as Preferred Binding.
10. (Optional) Provide the list of Allowed redirect URIs to be used by Service Provider for after logout redirections.
11. Select POST as Preferred Binding.
12. Enter https://<InventoryHost>:<InventoryPort>/Inventory/ as Default URL, and then click Save.
13. Click Activate Changes.

To publish the service provider metadata:

1. Access the WebLogic Server Console as administrator.
2. Click Lock & Edit.
3. Click Environment and then select Servers.
4. Click the manager server (AdminServer) that has the Inventory application (for example, ms1).
   • In a clustered environment, the later steps must be performed on each managed server that has the Inventory application. (other than proxy and admin server)
5. Select Configuration, Federation Services, and then SAML 2.0 General.
6. Click Publish Meta Data.

   The Publish SAML 2.0 Meta Data page appears.

7. In the Path field, enter the full path and filename of the metadata file. For example, C:\mydomain\myserver\sppmeta.xml.
8. Click OK.

To register a SAML Identity Provider in WebLogic:

1. Upload the IdPMetadata.xml file from the Identity Provider to the server hosting WebLogic (for example, /path/to/metadata/file/IDCSMetadata.xml).
2. Open the WebLogic Administration Server Console as administrator.
3. Click Security Realm and then select myrealm.
4. Click Providers, and then select SAML2IdentityAsserter.
5. Click Management, click New, and then select New Web Single Sign-On Identity Provider Partner.

   The Create a Web Single Sign-On Identity Provider Partner page appears.

   Note:

   This is required for enabling Identity Provider users with UIM group to access the UIM UI. See Configuring the SAML Authentication Provider for more information.

6. In the Name field, enter WebSSO-IdP-Partner-1.
7. In the Path field, enter the path to the XML file that contains the Identity Provider metadata.
8. Click OK.
9. Click the WebSSO-IdP-Partner-1 link.
10. Ensure that the Identity Provider details appear in the Site Info and Single Sign-On Signing Certificate tabs.
11. In the General tab, select Enabled, Virtual User, and Process Attributes check boxes.
12. In the Redirect URIs field, enter /Inventory/*.
13. Click Save.

    The WebLogic server displays a confirmation message.

14. Sign out of the WebLogic server and close your browser.

Update the Plan.xml (Standalone) file or ClusterPlan.xml (Cluster) file depending on your environment, for the authentication to happen. These changes are applicable for a traditional UIM installation.

To update the deployment plan of UIM:

1. Within <variable-definition>, override the value of the existing logoutURL variable with the Identity Provider logout URL.

   Replace /oracle/communications/platform/logout.jspx with the Identity Provider logout URL. For example, https://<WL_SP_hostname>:<WL_SP_port>/saml2/sp/slo/init.

   <variable>
       <name>logoutURL</name>
       <value>IDP_LOGOUT_URL</value>
   </variable>
   

2. Update the <module-override> section of inv.war module name as follows:

   <module-override>
       <module-name>inv.war</module-name>
       <module-type>war</module-type>
       <module-descriptor external="false">
           <root-element>weblogic-web-app</root-element>
           <uri>WEB-INF/weblogic.xml</uri>
           <variable-assignment>
               <name>cookie-path</name>
               <xpath>/weblogic-web-app/session-descriptor/cookie-path</xpath>
               <operation>remove</operation>
           </variable-assignment>
       </module-descriptor>
       <module-descriptor external="false">
           <root-element>web-app</root-element>
           <uri>WEB-INF/web.xml</uri>
           <variable-assignment>
               <name>logoutURL</name>
               <xpath>/web-app/context-param[param-name="loginURL"]/param-value</xpath>
               <operation>replace</operation>
           </variable-assignment>
   	 <variable-assignment>
               <name>endURL</name>
               <xpath>/web-app/context-param[param-name="endUrl"]/param-value</xpath>
               <operation>replace</operation>
           </variable-assignment>
       </module-descriptor>
   </module-override>
   

To verify the SAML configuration:

1. Enter the URL http://<InventoryHostname>:<InventoryPort>/Inventory to open the Inventory login page.

   The login page of the Identity Provider appears.

2. Enter the login credentials.

   The UIM home page appears.

3. After you log in, you can logout using the Logout option from the top right corner of the page.

   The login page of Identity Provider appears or a successful logout message appears, based on the configurations entered in Identity Provider.

4. Close the browser or tab.

To register UIM in Identity Provider:

1. Use Entity ID (for example, samlUIM).

   Note:

   This value must be same as the value provided in "Configuring the SAML Service Provider" under the SAML 2.0 General section within the Federation Services section.
2. Enter Assertion consumer URL as http://<InventoryHostname>:<InventoryPort>/saml2/sp/acs/post

To manually configure UIM in IDCS Identity Provider:

1. Access the IDCS console and log in as administrator.
2. Navigate to the Domains and select the domain (Default domain) to add UIM as a SAML application.
3. Click Add Application button to register UIM as a SAML application.
   1. Select SAML Application and click Launch app catalog.
   2. Enter UIM Inventory Application as Name and UIM Inventory Application as SAML application as Description.
   3. Click Next.
   4. Enter Entity ID, for example: samlUIM. This should be same as the value provided in "Configuring the SAML Service Provider" under the SAML 2.0 General section under Federation Services.
   5. Enter http://InventoryHostname:InventoryPort/saml2/sp/acs/post as Assertion consumer URL.
   6. Select Unspecified as Name ID format.
   7. Select Username as Name ID value.
   8. Upload the SSL Certificate of UIM. This is required for SLO to work.
   9. Enter https://<WL_SP_hostname>:<WL_SP_port>/saml2/sp/slo as Single logout URL.
   10. Enter https://<WL_SP_hostname>:<WL_SP_port>/saml2/sp/slo as Logout response URL.
   11. Click + Additional attribute at the bottom-right corner of the page.
       1. Enter Groups as Name.
       2. Select User attribute as Type.
       3. Select Group membership as Type value.
       4. Select All groups as Condition.
   12. Click Finish.
4. Click Activate buttonfor the create application (UIM Inventory Application)
5. Click Activate application button in the pop-up window.
6. Click Download identity provider metadata button for downloading the IdP's metadata xml. (for example, IDCSMetadata.xml)
7. Click Users on the left side pane to assign users. (Ensure desired users are added to your domain prior to this step)
   1. Click Assign groups for adding domain groups to the registered application.
   2. Choose the desired users from the pop-up window and click Assign.
8. Click Groups on the left-side pane to assign groups.

   Note:

   Ensure uim-users group is created or added to your domain before performing this step.
   1. Click Assign users for adding the domain users to the registered application.
   2. Choose uim-users from the pop-up window and click Assign.

If your Identity Provider provides you an option to create SAML 2.0 client by importing the metadata file, you can use the published metadata file of UIM to create SAML2.0 client.

For traditional UIM, to publish the metadata file, verify the step on "Publishing the Service Provider Metadata".

For UIM cloud native, to publish metadata file, see Publishing UIM CN (service provider) Metadata file section in UIM Cloud Native Deployment Guide.

The IDCS provider can access IDCS only if you update the SSL.hostnameVerifier property.

To update the SSL.hostnameVerifier property:

1. Go to the WebLogic administrator console and open Environment, Servers, your server (AdminServer), Configuration and then SSL.
2. Click Lock & Edit.
3. Open Advanced.
4. Change Hostname Verification from BEA Hostname Verifier to Custom Hostname Verifier.
5. Set Custom Hostname Verifier to weblogic.security.utils.SSLWLSWildcardHostnameVerifier.
6. Click Save and then Activate Changes.
7. Start the Administration server and all Managed WebLogic servers.

The Oracle Identity Cloud Integrator provider is an authentication and identity assertion provider that accesses users, groups, and Identity Provider scopes, and application roles stored in the IDCS Identity Provider.

Before you can configure the provider, you must obtain the required OAuth client information from IDCS Identity Provider. To do so, you create a trusted application in the Identity Provider. A trusted application in the Identity Provider is a type of custom application that can be accessed by multiple users and hosted in a secure and protected place (server) where the trusted application uses OAuth 2.0. Because you know where the application is hosted, you can treat that application as trusted. Creating the application in Identity Provider results in the provisioning of an OAuth client.

To set up trust between IDCS and WebLogic:

1. Import the certificate in KSS store.
   1. Open the Administration Server node.
   2. Get the IDCS certificate as follows:

      echo -n | openssl s_client -showcerts -servername <IDCS_URL> -connect <IDCS_URL>:443|sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > /tmp/idcs_cert_chain.crt
       
      #sample echo -n | openssl s_client -showcerts -servername xyz.identity.oraclecloud.com -connect idcs-xyz.identity.oraclecloud.com:443|sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > /tmp/idcs_cert_chain.crt
      

   3. Import the certificate and run the <ORACLE_HOME>/oracle_common/common/bin/wlst.sh file.
   4. Run the following commands:

      connect('weblogic','<admin_pwd>','t3://<WEBLOGIC_HOST>:7001')
      svc=getOpssService(name='KeyStoreService')
      svc.importKeyStoreCertificate(appStripe='system',name='trust',password='',alias='idcs_cert_chain',type='TrustedCertificate',filepath='/tmp/idcs_cert_chain.crt',keypassword='')
      syncKeyStores(appStripe='system',keystoreFormat='KSS')
      

   5. Run exit().
2. Restart the Administration server and Managed servers.

You must create an Administrator user in IDCS because once the Managed servers are configured for SAML, the domain administrator user (usually, the weblogic user) cannot log into the Managed servers.

To create WebLogic Administrator user in IDCS for WebLogic JaxWS connection:

1. In IDCS, go to the Groups tab and create the Administrators and sysmanager roles.
2. Go to the Users tab and create a wls admin user, for example, weblogic and assign it to the Administrators and sysmanager groups.
3. Restart all Managed servers.

To manage group memberships, roles, and accounts, you must update OPSS and libOVD to access IDCS.

The following procedure is required only if you use IDCS for user authorization.

Ensure that all servers are stopped (including Administration) before proceeding further.

To manage group memberships, roles, and accounts:

1. Shutdown all servers that use WebLogic Server Administration Console.

   Note:

   You must use - kubectl patch domain command for starting or stopping pods and not the WebLogic Server Administration Console.
2. Run the following:

   #Run the wlst.sh
   cd /u01/oracle/oracle_common/common/bin/
   ./wlst.sh
   

   Note:

   This does not require a connection to the WebLogic Administration Server.
3. Read the domain as follows:

   readDomain(<DOMAIN_HOME>)

4. Add the template as follows:

   addTemplate(<MIDDLEWARE_HOME>/oracle_common/common/templates/wls/oracle.opss_scim_template.jar")

   Note:

   This step may throw a warning, which can be ignored. The addTemplate is deprecated. Use selectTemplate followed by loadTemplates instead of addTemplate.
5. Update the domain as follows:

   updateDomain()

6. Close the domain as follows:

   closeDomain()

7. Exit from the Administration server container using exit().
8. Start the Administration and Managed servers.