Bridging federation protocols with OIF

I just wrapped up a project for a customer with a slightly odd federation use case.

On the one side was an IdP that could generate SAML assertions.
On the other side was an app that could only accept either a username+password or an OpenID.

We bridged the gap with OIF and a bit of config.

In broad strokes heres what you do...

• Install OIF
• Setup OIF as OpenID OP
• Setup OIF as a SAML Service Provider

For SP initiated:
You need to Configure OIF to use the Federation SSO proxy authn engine.

When the user reaches the OpenID enabled app the app will send the user to OIF. OIF will see that it needs to send the user to the SAML IdP and will redirect them there. The user goes to the SAML IdP, logs in and then comes back with SAML assertion. OIF consumes the assertion and generates an OpenID identity and redirects the user back to the OpenID Relying Party.

For IdP initiated:
You need to setup an SP Integration Module (abbreviated to SPIM).

The user stars out at the SAML IdP which generates a SAML assertion and sends to OIF. OIF validates the SAML Assertion and invokes the SPIM. The SPIM kicks the user into the OpenID flow and they get redirected on to the OpenID RP.

It's all actually pretty straightforward once you understand what's going on.

Updated dead simple certificate authority

Back in April I posted a shell script I wrote to implement a dead simple Certificate Authority for testing purposes. I recently revisited that script because I needed JKS files in addition to the PEM format files it created.

Without further ado my new and improved script is available right after the break.

How to reset your WLS super user password

Occasionally, we get into situations where we do not have the Weblogic super user (usually username = weblogic) password.  For myself, this sometimes happens when I'm using a VM that someone else created where they didn't properly document all the account info.  A more serious situation is if an organization actually somehow loses this information for their real deployments.

Recently, our friend Atul Kumar made a good post on how to reset the WebLogic super user account.  I think this is valuable information that everyone should have on hand: http://onlineappsdba.com/index.php/2011/08/02/how-to-reset-lost-oracle-weblogic-password-for-fusion-middleware-applications/

Who said IAM isn't funny

So, let's face it.  Us security/IAM guys are usually a fairly sober bunch.  Maybe we are even a little too serious at times, but that is what "they" pay us to be.  Still, it's good to be able to find humor in our work.  So, with that in mind, I thought I would share this excellent video produced by our crack Oracle IAM product marketing team:

http://www.oracle.com/go/?&Src=7319991&Act=331&pcode=WWMK11053701MPP023

Exception when using an OIF Business Process Plug-in

If you write a Business Processing plug-in for Oracle Identity Federation (OIF) and follow the installation instructions in the documentation you may encounter NoClassDefFoundError looking for org.apache.commons.codec.DecoderException. Here's what that exception looks like:

java.lang.RuntimeException: javax.servlet.ServletException: java.lang.NoClassDefFoundError: org/apache/commons/codec/DecoderException
        at oracle.security.fed.controller.ApplicationController.processServletRequest(Unknown Source)
        at oracle.security.fed.controller.web.servlet.FederationServlet.doGet(Unknown Source)
        at oracle.security.fed.controller.web.servlet.FederationServlet.doPost(Unknown Source)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:727)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:820)
        Truncated. see log file for complete stacktrace
Caused By: javax.servlet.ServletException: java.lang.NoClassDefFoundError: org/apache/commons/codec/DecoderException
        at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:341)
        at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:183)
        at weblogic.servlet.internal.RequestDispatcherImpl.invokeServlet(RequestDispatcherImpl.java:523)
        at weblogic.servlet.internal.RequestDispatcherImpl.forward(RequestDispatcherImpl.java:253)
        at oracle.security.fed.controller.web.flow.URLContextTarget.perform(Unknown Source)
        Truncated. see log file for complete stacktrace
Caused By: java.lang.NoClassDefFoundError: org/apache/commons/codec/DecoderException

This is easily fixed - just copy Oracle/Middleware/user_projects/domains/IDMDomain/servers/wls_oif1/tmp/_WL_user/oif-libs/i78h77/APP-INF/lib/commons-codec-1.2.jar to the same lib directory as your plug-in and other jars listed in the docs. PS: don't forget to copy the updated files in when you apply a patch!