How to configure SAML SSO with ADFS as IdP and Weblogic server as SP

Steps to configure SAML SSO with ADFS (as IDP) and Weblogic Server (as SP)

By: Puneeth Prakash | Principal Software Engineer (https://blogs.oracle.com/blogbypuneeth/steps-to-configure-saml-sso-with-adfs-as-idp-and-weblogic-server-as-sp)

Steps to integrate ADFS with Ping Identity  (https://technet.microsoft.com/en-us/library/adfs2-federation-with-ping-identity-ping-federate(v=ws.10).aspx)
Below are the steps to configure SAML 2.0 SSO using ADFS as Identity Provider and WLS as Service Provider.
In this example I am using ADFS 2.0 on Windows Server 2008R2.

Let's have a look at the ADFS IDP configuration first :

Step 1 :

Download and install ADFS 2.0
- Create a Federation Server 

Step 2 :

- Create a self signed certificate and configure SSL on IIS 

Step 3 :

- Start ADFS 2.0 Management / Configuration Wizard 
- Create a new Federation Service 
- Select the self-signed certificate you created using IIS from the drop down menu. 
- Lets create a Stand-alone federation server for this example. If you want to use the high-availability / load balancing feature in ADFS then create a Federation server Farm.
We have now completed the configuration of AD FS 2.0.

Step 4 : 

To download the AD FS metadata (i.e IDP metadata in our case) access the following link :
https:///federationmetadata/2007-06/federationmetadata.xml 
NOTE :
- Metadata downloaded from ADFS contains information about both SP and IDP. It also contains few tags which are not supported by WLS.
- Remove the following tags from federationmetadata.xml  :
(a) ..........  
(b) 
(c) 
(d)  ...........  
The final edited federationmetadata.xml file is as follows :

Step 5 :  

- Export the self-signed certificate you created in IIS to .pfx file (say adfscert.pfx).
Convert this pfx file to .jks using the following command :
Command :
keytool -importkeystore -srckeystore adfscert.pfx -srcstoretype PKCS12 -srcstorepass password -destkeystore identity.jks -deststoretype JKS -deststorepass password 
- Copy the identity.jks and modified federationmetadata.xml to Weblogic box.

Step 6:

Weblogic SP configuration : 

- Configure "Custom Identity and Custom Trust" on Admin Server using the identity.jks file that you copied from ADFS box.
NOTE : To reduce the complexity of this configuration I am avoiding creation of two separate certificates/keystores on ADFS box and WLS box. 
- Create an Identity Asserter using Weblogic Admin console.
Login to Weblogic console --> Click on ” myrealm ” –> ” Providers ” –> ” Authentication ” –> new ” SAML2IdentityAsserter “ say " saml_IA " :
- Create an AD provider and retrieve the users from Active Directory. (Alternatively, you can create a new SAMLAuthenticator provider and enable the " virtual user " feature in WLS SP). 
- Click on ” Servers ” –> Admin Server –> ” Federation Services ” –> ” SAML 2.0 Service Provider ” and make the following changes :
Enabled : check
Preferred Binding : POST
Default URL : http://:/console
Now click on ” Servers ” –> Admin Server –> ” Federation Services ” –> ” SAML 2.0 General ” and make the following changes :
Replicated Cache Enabled : Uncheck 
Contact Person Given Name
Contact Person Surname
Contact Person Type
Contact Person Company
Contact Person Telephone Number
Contact Person Email Address
Organization Name
Organization URL
Published Site URL : https://:/saml2
Entity ID : ( Destination Domain name)
Single Sign-on Signing Key Alias
Single Sign-on Signing Key Pass Phrase
Confirm Single Sign-on Signing Key Pass Phrase
Recipient Check Enabled : Uncheck
- Save the changes and export SP metadata into an XML file  ( say sp.xml ) –> Click on “ Publish Meta Data ” button.
- Create an IDP partner on Weblogic using the federationmetadata.xml file you copied from ADFS box.
Click on ” Security Realms ” –> ” myrealm ” –> ” Providers ” –> Authentication -> saml_IA –> ” Management ” –> ” New ” –> “ New Web Single Sign-On Identity Provider Partner ” say ” WebSSO-IdP-Partner-1 ” and then select ” federationmetadata.xml ” :
Click on ” WebSSO-IdP-Partner-1 ” and enter the following :
Name : WebSSO-IdP-Partner-1
Enabled : Check
Description : WebSSO-IdP-Partner-1
Redirect URIs : /console/*

Step 7 :

ADFS IDP configuration :

- Add a Replying Party Trust using ADFS 2.0 Management wizard
- Import the replying party data into ADFS IDP using the SP metadata file that you copied from WLS box (i.e sp.xml)

Step 8 : 

- We have completed all the SP and IDP related configuration now. It time to test SSO :)
- To access an SP initiated SSO access the following link :
https://:7002/console
- Once you access the console page you should be redirected to ADFS box asking for a credentials on a browser pop-up :
- To access IDP initiated SSO access the following link :
https:///adfs/ls/idpinitiatedsignon.aspx


Comments

Post a Comment

Popular posts from this blog

VMware fix for Invalid manifest and ova file import failed errors

Image
Recently we got a OVA file for a virtual machine. The vendor instructions were to import the ova file in vmware Workstation, Player for Windows/Linux, Fusion for Mac, and VirtualBox as well.  The instructions were to take the available package and launch the VM with VMware workstation. The package contained  Module.mf, Module.ovf and Module-disk.vmdk and a Module.ova file. The .mf and .ovf file were 2 KB each whereas the vmdk was several gigs. The package also contained a Module.ova file which was several gigs as well. OVF           Open Virtualization Format MF             Manifest file VMDK       Virtual Machine Disk OVA           Open Virtualization Appliance The ovf file is a xml file that contains metadata for the ovf package The mf file contains the SHA1 hash codes of all files in the package The vmdk file is the disk image of the virtual machine,  VMware Workstation or VirtualBox. (vmdk format was originally developed by VMware and is an open format now). All of
Read more

SOAPUI - import certificate

Image
Note: SoapUI has two versions, one is open source and second Professional version. The open source can be download here . (confirmed link 12/19/2018). SSL Handshake issue:   There is an Issue in SoapUI version 5.3.0 (and 5.2.0 version) with SSL handshake error. It was resolved by updating below in vmoptions file ( refer here ). However, the error that shows up while trying to load wsdl is "Error loading WSDL" as below The fix is to Enable TLS 1.2 protocol for SOAP/REST calls in SoapUI, by ammending the vmoptions file to add the directive for TLS as (-Dsoapui.https.protocols=TLSv1.2). Refer here . Update: Version 5.5.0 does not have this issue. If you are on 5.3.0 better upgrade to 5.5.0 which is available now (Feb 2019). I had above issue as well as another issue reaching to https endpoint. Upgrade to 5.5.0 resolved issue. Select "Check for updates" under the Help menu and you will get option for upgrade. Select upgrade current version and accept all defaul
Read more

Session Timeout in Oracle Access Manager

Image
Session Timeout in Oracle Access Manager (OAM) The session lifetime and Idle timeout entries control how long a user's session is valid. In OAM, a user session is an object which represents an authenticated user. This object is stored in the server memory and if Database session persistence is enabled, this object is stored or available in the database. Each session is unique and is identified by both a userid and Session ID (session identifier), see screenshot below "OAM User Session Management".  A valid session means a user has been authenticated with OAM. A session can have following three states: 1) active 2) inactive 3) expired When a session is created it is in active state and is available as an object in the OAM. After a set time - idle timeout, the session moves or transitions to inactive state. And finally after the Session Lifetime time, the session is marked as expired. Expired sessions are removed from server memory. Read more about Session Lifetime
Read more