1. Install Oracle HTTP Server 12c or Oracle HTTP Server 11g.

   To install Oracle HTTP Server 12c, see About the Oracle HTTP Server Installation in Installing and Configuring Oracle HTTP Server.

   To install Oracle HTTP Server 11g, see Installation Guide for Oracle Web Tier. Oracle HTTP Server is a component of Oracle Web Tier.

2. Update mod_wl_ohs.conf to configure web tier OHS so that it forwards requests to the Oracle WebLogic Server for WebCenter Portal. Refer to the example entries given below. Make sure that the WebLogic port numbers match your configuration.

   Note:

   This example assumes that WebCenter Portal is a non-cluster based installation. For a clustered environment change the WebLogicHost and WebLogicPort to WeblogicCluster as required for your environment.

   # NOTE : This is a template to configure mod_weblogic. 
    
   LoadModule weblogic_module   "${ORACLE_HOME}/ohs/modules/mod_wl_ohs.so"
    
   # This empty block is needed to save mod_wl related configuration from EM to this file when changes are made at the Base Virtual Host Level
   <IfModule weblogic_module>
   #      WebLogicHost <WEBLOGIC_HOST>
   #      WebLogicPort <WEBLOGIC_PORT>
   #      Debug ON
   #      WLLogFile /tmp/weblogic.log
   #      MatchExpression *.jsp
    
   <Location /webcenter>
         SetHandler weblogic-handler
         WebLogicHost webcenter.example.com
         WebLogicPort 8888
   </Location>
    
   <Location /webcenterhelp>
         SetHandler weblogic-handler
         WebLogicHost webcenter.example.com
         WebLogicPort 8888
   </Location>
    
   <Location /rss>
         SetHandler weblogic-handler
         WebLogicHost webcenter.example.com
         WebLogicPort 8888
   </Location>
    
   <Location /rest>
         SetHandler weblogic-handler
         WebLogicHost webcenter.example.com
         WebLogicPort 8888
   </Location>
    
   <Location /rsscrawl>
         SetHandler weblogic-handler
         WebLogicHost webcenter.example.com
         WebLogicPort 8888
   </Location>
   
   <Location /sesUserAuth>
         SetHandler weblogic-handler
         WebLogicHost webcenter.example.com
         WebLogicPort 8888
   </Location>
   
   <Location /owc_discussions>
         SetHandler weblogic-handler
         WebLogicHost webcenter.example.com
         WebLogicPort 8890
   </Location>
    
   <Location /wcps>
         SetHandler weblogic-handler
         WebLogicHost webcenter.example.com
         WebLogicPort 8891
   </Location>
    
   <Location /workflow>
         SetHandler weblogic-handler
         WebLogicHost soa.example.com
         WebLogicPort 8001
   </Location>
    

   <Location /integration/worklistapp>
         SetHandler weblogic-handler
         WebLogicHost soa.example.com
         WebLogicPort 8001
   </Location>
    
   <Location /integration/services>
         SetHandler weblogic-handler
         WebLogicHost soa.example.com
         WebLogicPort 8001
   </Location>
    
   <Location /soa-infra>
         SetHandler weblogic-handler
         WebLogicHost soa.example.com
         WebLogicPort 8001
   </Location>
    
   <Location /sdpmessaging/userprefs-ui>
         SetHandler weblogic-handler
         WebLogicHost soa.example.com
         WebLogicPort 8001
   </Location>
    
   <Location /DefaultToDoTaskFlow>
         SetHandler weblogic-handler
         WebLogicHost soa.example.com
         WebLogicPort 8001
   </Location>
    
   <Location /cs>
         SetHandler weblogic-handler
         WebLogicHost ucm.example.com
         WebLogicPort 16200
   </Location>
    
   <Location /adfAuthentication>
         SetHandler weblogic-handler
         WebLogicHost ucm.example.com
         WebLogicPort 16200
   </Location>
   
   
   <Location /services-producer>
         SetHandler weblogic-handler
         WebLogicHost webcenter.example.com
         WebLogicPort 8889
   </Location>
    
   <Location /wsrp-tools>
         SetHandler weblogic-handler
         WebLogicHost webcenter.example.com
         WebLogicPort 8889
   </Location>
    
   </IfModule>
    
   # <Location /weblogic>
   #      SetHandler weblogic-handler
   #      PathTrim /weblogic
   #      ErrorPage  http:/WEBLOGIC_HOME:WEBLOGIC_PORT/
   #  </Location>
   

   Note:

   The entries in the Location list above map the incoming paths to the appropriate WebLogic Server managed servers on which the corresponding applications reside.

1. Install WebGate as described in Installing and Configuring Oracle HTTP Server 11g WebGate for OAM in Installing WebGates for Oracle Access Manager. Use the same middleware home that was specified during Oracle HTTP Server installation.

   Note:

   Ensure that your Oracle HTTP server is down while installing OHS WebGate, and restart it only after you register the WebGate agent as described in Registering the WebGate Agent.

2. After installing Oracle HTTP Server 11g WebGate for Oracle Access Manager, move to the following directory under your Oracle Home for WebGate:

   For Unix operating systems:

   <Webgate_Home>/webgate/ohs/tools/deployWebGate
   

   For Windows operating systems:

   <Webgate_Home>\webgate\ohs\tools\deployWebGate
   

3. From the command line, run the following command to copy the required bits of the agent from the Webgate_Home directory to the WebGate instance location:

   For Unix operating systems:

   ./deployWebGateInstance.sh -w <Webgate_Instance_Directory> -oh <Webgate_Oracle_Home>
   

   For Windows operating systems:

   deployWebGateInstance.bat -w <Webgate_Instance_Directory> -oh <Webgate_Oracle_Home>
   

   Where <Webgate_Oracle_Home> is the directory where you have installed Oracle HTTP Server WebGate and defined it as the Oracle Home for WebGate, as in the following example:

   <MW_HOME>/Oracle_OAMWebGate1
   

   The <Webgate_Instance_Directory> is the location of the Webgate Instance Home (which should be the same as the Instance Home of Oracle HTTP Server), as in the following example:

   <MW_HOME>/Oracle_WT1/instances/instance1/config/OHS/ohs1
   

   Note that an Instance Home for Oracle HTTP Server is created after you configure the Oracle HTTP Server. This configuration should be performed after installing or patching to Oracle HTTP Server.

4. Run the following command to ensure that the LD_LIBRARY_PATH variable contains <Oracle_Home_for_Oracle_HTTP_Server>/lib:

   For Unix operating systems (depending on the shell):

   export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:<Oracle_Home_for_Oracle_HTTP_Server>/lib
   

   For Windows operating systems:

   Add the <Webgate_Installation_Directory>\webgate\ohs\lib and <Oracle_Home_for_Oracle_HTTP_Server>\bin locations to the PATH environment variable. Add a semicolon (;) followed by this path at the end of the entry for the PATH environment variable.

5. From your current working directory, move up one level:

   For Unix operating systems, move to:

   <Webgate_Home>/webgate/ohs/tools/setup/InstallTools
   

   For Windows operating systems, move to:

   <Webgate_Home>\webgate\ohs\tools\EditHttpConf
   

6. From the command line, run the following command to copy the apache_webgate.template from the Webgate_Home directory to the WebGate Instance location (renaming it to webgate.conf) and update the httpd.conf file to add one line to include the name of webgate.conf file:

   For Unix operating systems:

   ./EditHttpConf -w <Webgate_Instance_Directory> [-oh <Webgate_Oracle_Home>] [-o <output_file>]
   

   For Windows operating systems:

   EditHttpConf.exe -w <Webgate_Instance_Directory> [-oh <Webgate_Oracle_Home>] [-o <output_file>]

   Note:

   The -oh <WebGate_Oracle_Home> and -o <output_file> parameters are optional.

   Where <Webgate_Oracle_Home> is the directory where you have installed Oracle HTTP Server WebGate and defined it as the Oracle Home for WebGate, as in the following example:

   <MW_HOME>/Oracle_OAMWebGate1
   

   The <Webgate_Instance_Directory> is the location of the Web Gate instance home (which should be the same as the instance home of OHS), as in the following example:

   <MW_HOME>/Oracle_WT1/instances/instance1/config/OHS/ohs1

1. Log in to the WebLogic Server Administration Console.

   For information on logging in to the WebLogic Server Administration Console, see Oracle WebLogic Server Administration Console.

2. From the Domain Structure pane, click Security Realms.

   The Summary of Security Realms pane displays.

3. Click the realm entry for which to configure the OID authenticator.

   The Settings pane for the realm displays.

4. Open the Providers tab.

   The Provider Settings display.

5. Click New to create a provider.

   The Create a New Authentication Provider pane displays.

6. Enter a name for the new provider (for example, OID Authenticator), select OracleInternetDirectoryAuthenticator as its type and click OK.
7. On the Providers tab, click the newly added provider.

   The Common Settings pane for the authenticator displays.

8. Set the control flag to SUFFICIENT and click Save.
9. Open the Provider Specific tab.

   The Provider Specific Settings pane for the authenticator displays.

10. Complete the fields as shown in the table below. Leave the rest of the fields set to their default values.

    Field	Value	Comment
    Host:		The host ID for the LDAP server
    Port:		The LDAP server port number
    Principal:		The LDAP administrator principal (for example, cn=orcladmin)
    Credential:	<password>	The administrator principal password
    Confirm Credential:	<password>
    User Base DN:		User Search Base - this value should be the same as for the OAM Access Manager setup
    All Users Filter:	"(&(uid=*)(objectclass=person))"	The specified user name attribute must match in these three filters: All Users Filter and User Name Attribute and User From Name Filter
    User Name Attribute:	"uid"
    User From Name Filter:	"(&(uid=%u)(objectclass=person))"
    Group Base DN:		Group search base - Same as User Base DN
    Use Retrieved User Name as Principal	Checked	User login IDs are usually case insensitive. This flag is required so that the subject established contains the user name as stored in the OID.

    Note:

    The User Name Attribute, All Users Filter, and Users From Name Filter fields should all point to same OID attribute (uid in this case) and should match the Identity Store configuration for OAM. Additionally, these three fields should also match across all services participating in single sign-on, as well as OAM and WebCenter Portal.

11. Click Save.

1. Log in to the WebLogic Server Administration Console.

   For information on logging in to the WebLogic Server Administration Console, see Oracle WebLogic Server Administration Console.

2. From the Domain Structure pane, click Security Realms.

   The Summary of Security Realms pane displays.

3. Click the realm entry for which to configure the OAM identity asserter.

   The Settings pane for the realm displays.

4. Open the Providers tab.

   The Provider Settings display.

5. Click New to create a provider.

   The Create a New Authentication Provider pane displays.

6. Enter a name for the new provider (for example, OAM ID Asserter), select OAMIdentityAsserter as its type and click OK.
7. On the Providers tab, click the newly added provider.

   The Common Settings pane for the authenticator displays.

8. Set the control flag to REQUIRED and check that OAM_REMOTE_USER and ObSSOCookie is set for Active Types.
9. Click Save to save you settings.

1. Navigate to the Provider Settings pane.
2. Open the Default Authenticator and check that the control flag is set to SUFFICIENT.
3. Do the same for any providers other than the two you just created.
4. On the Settings Pane, reset the provider order to:

   • OAMIdentityAsserter (REQUIRED)

   • OracleInternetDirectoryAuthenticator (SUFFICIENT)

   • DefaultAuthenticator (SUFFICIENT)

   • DefaultIdentityAsserter

5. Continue by configuring WebCenter Portal for single sign-on mode as described in Configuring WebCenter Portal for SSO. Also be sure to perform any further service and component configurations that apply to your environment as described in Additional Single Sign-on Configurations.

1. Connect to the WebLogic domain using WLST and run the following command:

   addOAMSSOProvider(loginuri="/${app.context}/adfAuthentication", logouturi="/oamsso/logout.html")
   

2. Restart all servers.

1. Log in to the discussions server Admin Console at:

   http://host:port/owc_discussions/admin
   

   Where host and port are the host ID and port number of the WC_Collaboration managed server.

2. Open the System Properties page and edit (if it already exists) or add the owc_discussions.sso.mode property, setting it's value to true.
3. Edit or add the jiveURL property to point to the base URL of the web tier. For example:

   jiveURL = webtier.example.com:7777/owc_discussions
   

   The jiveURL property is used when constructing links to forums in emails.

   Note:

   The registered WebCenter connection in WebCenter Portal for discussions and forums should point to the OHS URL.

1. Open the OAM Admin Console.
2. Open the Policy Configuration tab and select Application Domain > <your application domain>.
3. Open the Resources tab and search for /rss*.

   Among the results, you should see:

   /rss*

   /rss/.../*

   /rss/rssservlet*

   /rss/rssservlet/.../*

4. For each resource, select the resource and click Edit.
5. Change each resource's Protection Level from Protected to Excluded and click Apply.

   Note that the resource's authentication policy and authorization policy are removed.

6. Close the tab and restart OHS.

The crawl sources that are defined to crawl WebCenter Portal data and repositories used by WebCenter Portal and the corresponding authentication end points defined in Elasticsearch must be routed through the web tier OHS ports so that they can be properly authenticated (the authentication method continues to be BASIC).

For Elasticsearch to work properly, ensure that the WebCenter Content crawl URLs, which are routed through the web tier OHS ports, are excluded in the OAM policy.

To exclude the WebCenter Content Crawl URLs:

1. Log in to the Oracle Access Management Console and click Application Security.

2. On the Application Security page, click the Application Domains link in the Access Manager section.

3. On the Application Domains page, enter the name of your Application Domain and click Search.

4. From the Search Results, click to open your Application Domain.

5. Open the Resources tab and click Create.

6. On the Create Resources page, enter the required details:

   • Type: Select HTTP as the resource type.

   • Description: Enter a description for the resource.

   • Host Identifier: Select the host Identifier created while registering the WebGate agent.

   • Resource URL: Enter the resource URl as/cs/idcplg

   • Query: Select the Name Value List and click Add icon to add the values. Enter name as IdcService and value as SES_CRAWLER_*.

   • Operations: Select all the operations

   • Protection Level: Select Excluded

7. Click Apply.

8. To verify if the Oracle Access Management exclusion is configured properly:

   1. Log in to Oracle WebCenter Portal as administrator.

   2. Configure the Oracle HTTP Server URL for documents crawl . See Creating a Documents Crawl Source.

   3. Click Test to test the document crawl endpoint.

      If the OAM exclusion is configured properly, the test is successful.

1. Log in to the WebLogic Server Administration Console.

   For information on logging in to the WebLogic Server Administration Console, see Oracle WebLogic Server Administration Console.

2. In the Domain Structure pane, select the domain you want to configure (for example, webcenter).
3. Open the Security tab and the Filter subtab.

   The Security Filter Settings pane displays.

4. Check Connection Logger Enabled to enable the logging of accepted messages.

   The Connection Logger logs successful connections and connection data in the server. You can use this information to debug problems relating to server connections.

5. In the Connection Filter field, specify the connection filter class to be used in the domain.

   • To configure the default connection filter, specify weblogic.security.net.ConnectionFilterImpl.

   • To configure a custom connection filter, specify the class that implements the network connection filter. Note that this class must also be present in the CLASSPATH for WebLogic Server.

6. In the Connection Filter Rules field, enter the syntax for the connection filter rules.

   For example:

   <webtier IP>/0 * * allow
   0.0.0.0/0  *  *  deny
   

   which says: allow all traffic coming from the local host and disallow all traffic from any other IP address. You should, of course, write the network filter(s) that are relevant to your environment. For more information about writing connection filters, see Developing Custom Connection Filters in Developing Applications with the WebLogic Security Service.

7. Click Save and activate the changes.
8. Restart all the managed servers and the Administration server.
9. Verify that all direct traffic to the WebLogic Server is blocked by attempting to navigate to:

   http://host:WLS_port/webcenter
   

   This should produce the following error:

   "The Server is not able to service this request: [Socket:000445]Connection rejected, filter blocked Socket, weblogic.security.net.FilterException: [Security:090220]rule 3"

   You should, however, still be able to access WebCenter Portal through the OHS port:

   http://host:OHS_port/webcenter

This section describes a set of steps that should be carried out prior to configuring SAML-based single sign-on. Note that these steps assume that WebCenter Portal and associated components are already installed and the relevant connections have been configured and tested.

The prerequisites for SAML-based SSO are described in the following topics:

• Configuring WebCenter Content Server for SAML SSO

• Configuring the Discussions Server for SAML SSO

• Configuring and Exporting the Certificates

• Setting Up SSL

After installing WebCenter Portal and services and components as required for your environment, continue by configuring SAML-based single sign-on using the scripts as described in this section.

The scripts set up SAML-based single sign-on in a WebLogic environment by configuring:

• SAML Credential Mapping Provider

• Necessary relying parties

• Source Site Federation Services

• SAML Identity Asserter

• Necessary asserting parties

• Destination Site Federation Services

This section includes the following topics:

• The Single Sign-on Script

• Using the Scripts

1. Log onto the WLS Administration Console for the WebCenter Portal domain.
2. Open the security realm and select Providers >Credential Mapping > wcsamlcm> Management > Relying Parties.
3. Disable or delete the relying party for RSS.
4. Open the security realm and select Providers > Authentication > wcsamlia > Management > Asserting Parties.
5. Disable or delete the asserting party for RSS.

1. Using a new browser, log in to WebCenter Portal and check that you're not challenged for credentials when you click Forum Administration from Portal Settings > Services > Discussions (assuming this service is provisioned for the portal).
2. Access the RSS link from the discussions or worklist task flow and check that you are not challenged to log in.
3. For Content Server, go to the Profile user interface and make sure you see Content Server screens embedded in iFrames without being challenged to log in. You should also be able to access Site Studio content in Content Presenter templates without being challenged to log in as you are already logged into WebCenter Portal.
4. Access http://host:port/rest/api/resourceIndex and make sure you see the BASIC authentication challenge. If you are already logged in to another related application that uses the same SSO, you should shown content without being challenged to log in.
5. To test SOA, access links in the Workflow task flow and make sure you are not challenged to log in.

You have to configure Credential Mapping Provider for WebLogic Server instance that serves as an Identity Provider. Credential Mapping Provider allows the WebLogic Server to log into a remote system that has been authenticated on your behalf. You need to configure the Credential Mapping Provider on the source site, for this example it is configured on the WebCenter Portal.

1. Log in to the source domain WebLogic Server Administration Console as an administrator.

   For information on logging in to the WebLogic Server Administration Console, see Oracle WebLogic Server Administration Console.

2. On the Domain Structure pane, click Security Realms and select myrealm.
3. On the Settings for myrealm page, click the Providers tab, then the Credential Mapping tab.
   The Credential Mapping Providers table lists the Credential Mapping providers configured in this security realm.
4. Click New.

   The Create a New Credential Mapping Provider page appears.

   Figure 26-5 Creating Credential Mapping Provider

   
5. In the Name field, enter a name for the Credential Mapping Provider.

   For example, SAML2CredentialMapper.

6. From the Type drop-down list, select SAML2CredentialMapper and click OK.
7. On the Settings for myrealm page, select the Providers tab, then the Credential Mapping tab.
8. Click the name of the new Credential Mapping Provider to complete the configuration. For example, SAML2CredentialMapper.
9. Click the Provider Specific tab.
   The Provider Specific Settings pane for the newly added Credential Mapping Provider appears.

   Figure 26-6 Configuration Settings for SAML 2.0 Credential Mapping Provider

   
10. Configure the provider-specific information for the newly added SAML 2.0 Credential Mapping Provider . Leave the rest of the fields set to their default values.

    • Issuer URI : Enter the IDP URL (http://host:port/saml) .

    • Name Qualifier: Enter webcenter.com

11. Click Save to save your changes.
12. Stop and restart all the servers..

You can configure WebCenter Portal running on a Weblogic server to act as a Identity Provider Service to enable single sign-on using SAML 2.0.

1. Log in to the source site WebLogic Server Administration Console as an administrator.
2. On the Home page, select Servers under Environment.
3. From the Servers table, select WebCenter Portal server (WC_Portal).
4. Click the Federation Services tab, then the SAML 2.0 Identity Provider tab.
   The SAML 2.0 Identity Provider page appears.
5. On the SAML 2.0 Identity Provider page, set the configuration options for the SAML 2.0 Service Provider services as appropriate.
   1. Select Enabled to activate SAML 2.0 services in WebCenter Portal server.
   2. From the Preferred Binding list, select POST.

   Figure 26-7 Configuration Settings for SAML 2.0 Identity Provider

   
6. Click Save.

1. On the WebLogic Server Administration Console Home page, select Servers under Environment.
2. From the Servers table, select WebCenter Portal server (WC_Portal).
3. Click the Federation Services tab, then the SAML 2.0 General tab.
4. Configure the general setting for Identity Provider as shown in the table. Leave the rest of the fields set to their default values.

   Table 26-2 General Setting Parameters

   Parameter	Description
   Replicated Cache Enabled	Select Replicated Cache Enabled to use the persistent cache for storing SAML 2.0 artifacts. This option is required if you are configuring SAML 2.0 services in two or more WebLogic Server instances in your domain. For example, if you are configuring SAML 2.0 services in a cluster, you must enable this option in each Managed Server instance individually. The replicated cache enables server instances to share and be synchronized with the data that is managed by the SAML 2.0 security providers; that is, either or both the SAML 2.0 Identity Assertion provider and the SAML 2.0 Credential Mapping provider.
   Site Info	The site information is for the benefit of the business partners in the SAML federation with whom you share it. Site information includes details about the local contact person who is your partners' point of contact, your organization name, and your organization's URL. Enter the following site information: Contact Person Given Name Contact Person Surname Contact Person Type Contact Person Company Contact Person Telephone Number Contact Person Email Address Organization Name Organization URL
   Published Site URL	The Published site URL specifies the base URL that is used to construct endpoint URLs for the SAML 2.0 services. The published site URL should specify the host name and port at which the server is visible externally, which might not be the same at which the server is accessed locally. For example, if SAML 2.0 services are configured in a cluster, the host name and port may correspond to the load balancer or proxy server that distributes client requests to the Managed Servers in that cluster. The published site URL should be appended with /saml2. For example: host:port/saml2
   Entity ID	The entity ID is a human-readable string that uniquely distinguishes your site from the other partner sites in your federation. When your partners need to generate or consume an assertion, the SAML 2.0 services use the entity ID as part of the process of identifying the partner that corresponds with that assertion. Enter Entity ID for Identity Provider as webcenter_IDP.
   Recipient Check Enabled	Enable the Recipient Check Enabled. The recipient of the authentication request or response must match the URL in the HTTP Request.
   Single Sign-on	The keystore alias and passphrase for the key is used when signing documents sent to your federated partners, such as authentication requests or responses. Enter the following information: Single Sign-on Signing Key Alias Single Sign-on Signing Key Pass Phrase: Note: In this example, OOTB WebLogic Server shipped DemoIdentity keystore is used and the password is DemoIdentityPassPhrase.

5. Click Save.
6. Click Publish Meta Data to create or update the partner metadata file, which contains the information about this site SAML 2.0 services to be shared with your federated partners that is used for SAML 2.0 web single sign-on.
   The Publish SAML 2.0 Meta Data page opens.
7. On the Publish SAML 2.0 Metadata page, enter the full path of the XML metadata file.

   For example, /mydomain/myserver/idp_metadata.xml

   Note:

   When you are publishing the metadata file for Identity Provider, name the file as idp_metadata.xm1

8. Click OK to publish the metadata file.

   The metadata file is published and copied to the specified path.

1. In the WebLogic Server Administration Console, click Security Realms and select myrealm.
2. Click the Providers tab, then the Credential Mapper tab
3. Select the SAML 2.0 Credential Mapping provider (For example, SAML2CredentialMapper).
4. On the Settings for SAML 2.0 Credential Mapping Provider page, click the Management tab.
5. Under Service Provider Partners, click New and select New Web Single Sign-On Service Provider Partner.
6. On the Create a SAML 2.0 Web Single Sign-on Service Provider Partner page:

   Figure 26-8 New Web Single Sign-On Service Provider Partner

   
   1. Enter the name of the Service Provider partner.
      For example SAML_SSO_SP01
   2. In the field next to Path, specify or browse to the full path of the metadata partner file.

      For example, sp_metadata.xml file.

7. Click OK.
8. On the Settings for SAML 2.0 Credential Mapper page, in the Service Provider Partners table, select the name of your newly-created Service Provider partner.
   For example, SAML_SSO_SP01.
9. On the General page, configure the following settings as appropriate:

   Figure 26-9 SAML 2.0 Web Single Sign-on Service Provider Partner General Settings

   

   1. Select Enabled to enable interactions between this server and this Service Provider partner.

   2. In the Description field, enter the description of the Service Provider partner. For example, SAML_SSO_SP01.

   3. Select Key Info Included

10. Click Save.
    The Service Provider partner is created in the local server instance.

You can configure SAML 2.0 Identity Assertion provider to act as a consumer of SAML 2.0 security assertions, allowing WebLogic Server to act as a Service Provider for web single sign-on. You need to configure the Identity Assertion provider on the destination site, for this example it is configured on the WebCenter Content.

1. Log in to the destination site WebLogic Server Administration Console as an administrator.
2. On the Domain Structure pane, click Security Realms and select myrealm.
3. On the Settings for myrealm page, click the Providers tab, then the Authentication tab.
4. Click New.
   The Create a New Authentication Provider page appears.

   Figure 26-10 Creating Authentication Provider

   
5. In the Name field, enter a name for the Authentication provider. For example, SAML2_IdentityAsserter
6. From the Type drop-down list, select SAML2_IdentityAsserter
7. Click OK
8. Stop and restart all the servers.

1. Log in to the destination site WebLogic Server Administration Console as an administrator.
2. On the Home page, select Servers under Environment.
3. From the Servers table, select WebCenter Content server (UCM_server1).
4. Click the Federation Services tab, then SAML 2.0 Service Provider tab.
   The SAML 2.0 Service Provider page appears.
5. On the SAML 2.0 Identity Service page, set the configuration options for the SAML 2.0 Service Provider services as appropriate.
   1. Select Enabled to activate SAML 2.0 services in WebLogic server in the role of Service Provider.
   2. From the Preferred Binding list, select POST.
   3. In the Default URL field, enter the destination URL.http://host:port/cs/idcplg?IdcService=GET_DOC_PAGE&Action=GetTemplatePage&Page=HOME_PAGE&Auth=Internet

   Figure 26-11 Configuration Settings for SAML 2.0 Service Provider

   
6. Click Save.

1. On the WebLogic Server Administration Console Home page, select Servers under Environment.
2. From the Servers table, select WebCenter Content server (UCM_server1).
3. Click the Federation Services tab, then the SAML 2.0 General tab.
4. Configure the general settings for service provider site as shown in the table. Leave the rest of the fields set to their default values.

   Table 26-3 General Setting Parameters

   Parameter	Description
   Replicated Cache Enabled	Select Replicated Cache Enabled to use the persistent cache for storing SAML 2.0 artifacts. This option is required if you are configuring SAML 2.0 services in two or more WebLogic Server instances in your domain. For example, if you are configuring SAML 2.0 services in a cluster, you must enable this option in each Managed Server instance individually. The replicated cache enables server instances to share and be synchronized with the data that is managed by the SAML 2.0 security providers; that is, either or both the SAML 2.0 Identity Assertion provider and the SAML 2.0 Credential Mapping provider.
   Site Info	The site information is for the benefit of the business partners in the SAML federation with whom you share it. Site information includes details about the local contact person who is your partners' point of contact, your organization name, and your organization's URL. Enter the following site information: Contact Person Given Name Contact Person Surname Contact Person Type Contact Person Company Contact Person Telephone Number Contact Person Email Address Organization Name Organization URL
   Published Site URL	The Published site URL specifies the base URL that is used to construct endpoint URLs for the SAML 2.0 services. The published site URL should specify the host name and port at which the server is visible externally, which might not be the same at which the server is accessed locally. For example, if SAML 2.0 services are configured in a cluster, the host name and port may correspond to the load balancer or proxy server that distributes client requests to the Managed Servers in that cluster. The published site URL should be appended with /saml2. For example: host:port/saml2
   Entity ID	The entity ID is a human-readable string that uniquely distinguishes your site from the other partner sites in your federation. When your partners need to generate or consume an assertion, the SAML 2.0 services use the entity ID as part of the process of identifying the partner that corresponds with that assertion. Enter Entity ID for Service Provider as webcenter_SP
   Recipient Check Enabled	Enable the Recipient Check Enabled. The recipient of the authentication request or response must match the URL in the HTTP Request.
   Single Sign-on	The keystore alias and passphrase for the key is used when signing documents sent to your federated partners, such as authentication requests or responses. Enter the following information: Single Sign-on Signing Key Alias Single Sign-on Signing Key Pass Phrase: Note: In this example, OOTB WebLogic Server shipped DemoIdentity keystore is used and the password is DemoIdentityPassPhrase.

5. Click Save.
6. Click Publish Meta Data to create or update the partner metadata file, which contains the information about this site's SAML 2.0 services to be shared with your federated partners that is used for SAML 2.0 web single sign-on.
   The Publish SAML 2.0 Meta Data page opens.
7. On the Publish SAML 2.0 Metadata page, enter the full path of the XML metadata file.

   For example, /mydomain/myserver/sp_metadata.xml

   Note:

   When you are publishing the metadata file for Service Provider, name the file as sp_metadata.xm1
8. Click OK to publish the metadata file.

   The metadata file is published and copied to the specified path.

1. In the destination site WebLogic Server Administration Console, click Security Realms and clickmyrealm.
2. On the Settings for myrealm page, click the Providers tab, then the Authentication tab.
3. In the Authentication Providers table, select the SAML 2.0 Identity Assertion provider (for example, SAML2_IdentityAsserter).
4. On the Settings for SAML 2.0 Identity Asserter page, click the Management tab.
5. Under Identity Provider Partners, click New and select New Web Single Sign-On Identity Provider Partner.

   Figure 26-12 New Web Single Sign-On Identity Provider Partner

   
6. On the Create a SAML 2.0 Web Single Sign-on Identity Provider Partner page:

   1. Specify the name of the name of the New Web Single Sign-on Identity Provider partner. For example, WebSSO-IdP-Partner-0

   2. In the field next to Path, specify or browse the name and location of the SAML 2.0 metadata file received from the Identity Provider partner. For example, idp_metadata.xml file.

7. Click OK.
8. On the Settings for SAML 2.0 Identity Asserter page, in the Identity Provider Partners table select the name of your newly-created web single sign-on Identity Provider partner.

   For example: WebSSO-IdP-Partner-0

9. On the General page, configure the following configure the following settings as appropriate:

   Figure 26-13 SAML 2.0 Web Single Sign-on Identity Provider Partner General Settings

   

   1. Select Enabled to enable interactions between this server and this Identity Provider partner.

   2. Enter a short description of this Identity Provider partner.

   3. Select Virtual User to specify user information contained in assertions received from this Identity Provider partner are mapped to virtual users in this security realm.

   4. In the Redirect URIs field, specify the URIs for resources hosted at the local site that, if invoked by an unauthorized user, cause an authentication request to be generated and sent to the Identity Provider partner. For example, /adfAuthentication for content server.

10. Click Save.

This section provides information to assist you in troubleshooting the problems you may encounter while configuring SAML 2.0 based Single Sign-On.

If there is difference in the time between the Identity Provider and Service Provider, the SSO will not be established.

For example, if the Service Provider time was set one minute behind the Identity Provider, the following error appears, when you access the Service Provider instance:

<Sep 2, 2015 1:08:28 AM EDT> <Debug> <SecuritySAML2Service> <BEA-000000> <[Security:090377]Identity Assertion Failed, weblogic.security.spi.IdentityAssertionException: [Security:090377]Identity Assertion Failed, weblogic.security.spi.IdentityAssertionException: [Security:096537]Assertion is not yet valid (NotBefore condition).>

Ensure the Identity Provider and Service Provider is synchronized. We recommend you to adjust the default values of Default Time to Live and Default Time to Live Offset to fix the offset in the timings between the Identity Provider and Service Provider.

Figure 26-14 Setting the Default Time

1. Log in to the WebLogic Server Administration Console.

   For information on logging in to the WebLogic Server Administration Console, see Oracle WebLogic Server Administration Console.

2. From the Domain Structure pane, click Security Realms.

   The Summary of Security Realms pane displays.

3. Click your security realm.

   The Settings page for the security realm displays.

4. Open the Providers tab and select the Authentication subtab.

   The Authentication Settings pane displays.

5. Click New.

   The Create a New Authentication Provider pane displays.

6. Enter a Name for the identity asserter, and select NegotiateIdentityAsserter as the Type.
7. Click OK.

1. Log in to the Oracle WebCenter Portal's Discussion Server Server Admin Console at:

   http://host:port/owc_discussions/admin
   

   Where host and port are the host ID and port number of the WC_Collaboration managed server.

2. Open the System Properties page and edit (if it already exists) or add the owc_discussions.sso.mode property, setting it's value to true.