What is the difference between OIMAuthenticator & OIMSignatureAutenticator in weblogic providers type?

Hello everybody,

Today I would like to discuss the authenticator provider for IDM.

Basically , let's start answering  then main question. The difference comes from OIMSignatureAuthenticator being used in situations where a digital signature can be inspected instead of a password - which is useful in some specific integrations. Such as Quartz Scheduler integration with  OIM as: OAM with OIM or SiteMinder with OIM.

So, it allows Weblogic Server and its provider to participate, for example, in SSO solution for Web service applications. It validates assertions by checking the signature and validates, if needed, the certificate for trust based on data configured for a specific partner.

Trying to clarify a bit more with one simple example:

Use-case:

All authentication either via browser (http/https) or non-http, such as Design Console login or t3/t3s route, must be handled by Siteminder SSO. Only signature authentication will be handled by Oracle Identity Manager.

This way you will allow only integration products to use signature as part of the authentication process, all others will be controlled by your SSO product , in my example SiteMinder.

So, into WLS(Home >Summary of Security Realms >myrealm >Providers ) your authemtication chain will be like this:

SiteminderIdentityAsserter

DefaultAuthenticator                       SUFFICIENT

OIMSignatureAuthenticator                  SUFFICIENT

SiteminderAuthenticationProvider           SUFFICIENT

DefaultIdentityAsserter                    SUFFICIENT

References:

1-Oracle® Fusion Middleware Administrator's Guide for Oracle Identity Manager-11g Release 2 (11.1.2)-doc: E27149-04

Link: http://docs.oracle.com/cd/E27559_01/admin.1112/e27149/ssoint.htm

Definitions from WLS Console:

OIMSignatureAuthenticator

Provider that performs signature based authentication thru the Oracle Identity Manager relational database

OIM Authenticator or OIM Authenticator Provider

Provider that performs authentication thru the Oracle Identity Manager relational database

I hope this helps,

Thiago Leoncio.

SSO with OAM & OIF 11G Architecture sample

Hi Folks,

   Today I would like to show you some diagram that I did to explain how 'OIF works' with OAM in order to provide SSO solution for different federations. Note: OIF is used only for authentication purpose here and no role information is exchanged nor authorization explanation is provided in this example.

Wait, before this example I would like to answer the first question that comes in my mind:

What is the purpose of OIF and what is the main difference between OIF and OAM?

OIF is a Oracle SSO solution for use different LDAP repositories. Companies authenticating their employees into different LDAP servers instead of regular one, configured by OAM solution.

The main difference between OIF and OAM is:
OIF is SSO solution for federation purposes. Used to allow authentication that comes from a different place.
OAM is SSO solution for a single company that does not need a different LDAP authentication than what it has into their IDM server.

So,

1) Into this 'real world' (fig 1), we have OAM(configured with AuthProvider as OIF) and then it calls the URL that OAM has its IDP configured. So, instead of cookies here, user will have a trust relationship between 2 different federations(usually I call as different companies for easy understanding).
1.1)Also you can see that login page can be ldap authentication that is related of that URL. It means that the first company(who received a request) don't handle this second part. It only receives the first request from user and 'ask' OAM who is the authentication schema and who is the authentication provider for this URL.

 Fig1: the OAM Authn Scheme FAAuthScheme will be modified to use OIF/SP instead of collecting user creds via a login page and validating those against, for example, the regular OID Server that is installed with first federation(again: company who receives the first request).


2) As a generic explanation this is the way OIF goes:

I hope this explanation helps and let me know if you have any further question please,
Thiago Leoncio.