Open Federation

FAQ Open Federation

  1. What is Open Federation?
  2. What industry standards are provided by Open Federation?
  3. What are the branches of the Open Federation source code?
  4. What are the samples included with Open Federation?
  5. What are the web archive (WAR) files included with Open Federation?
  6. What is fmadm.zip?
  7. How do you set up and run the Liberty ID-FF sample?
  8. How do you setup and run the Liberty ID-WSF sample?
  9. How do you turn on signing using SAML v1.x?
  10. How do you turn on signing using the Liberty ID-FF?
  11. How do you setup a keystore?
  12. How do you setup single sign-on using SAML v1.x and the fmadm command line interface?
  13. How do you set up single sign-on using the Liberty ID-FF and the fmadm command line interface?
  14. How do you setup single sign-on using SAML v2 and the fmadm command line interface?
  15. How do you turn on signing and encryption using SAML v2?
  16. How do you setup authentication using the Authentication Web Service?
  17. How do you setup the Discovery Service to issue X509, Bearer, and SAML tokens?

Q: What is Open Federation?

Open Federation is an open source project based on the identity federation and web services framework developed for Sun JavaTM System Access Manager and Sun Java System Federation Manager. Open Federation provides an extensible framework to support these features. Check the Open Federation Architecture and Use Case documents for an overview of the Open Federation framework and how it can be used.

Q: What industry standards are implemented by Open Federation?

  • Liberty Alliance Project Identity Federation Framework (Liberty ID-FF) v.1.1 and v.1.2 (including identity provider and service provider extended profiles)
  • Liberty Alliance Project Identity Web Services Framework (Liberty ID-WSF) v.1.0 and v.1.1
  • Organization for the Advancement of Structured Information Standards (OASIS) Security Assertion Markup Language (SAML) v.1.0 and v.1.1
  • OASIS SAML v.2.0 (Operational modes: IdP and SP Complete)

The following will be supported in future releases:

  • Liberty ID-WSF v.2.0
  • WS-Federation Passive Requestor Profile
  • Web Services Interoperability (WS-I) Basic Security Profile (BSP)

Q: What are the branches of the Open Federation source code?

There are two branches to the Open Federation source code:

  1. The library branch provides the basic framework for identity federation and its associated web services. The code provides an extensible and pluggable infrastructure for integrating the functionality with existing systems. The library source code is dependent on the OpenSSO shared branch for building.

  2. The openfm branch provides an implementation of the framework in the library branch. It delivers a single WAR deployable on any J2EE web container as well as easy to setup samples for getting the system up and running.

Q: What are the samples included with Open Federation?

There are two samples included in the WAR generated from the openfm branch source code:

  1. The Liberty ID-FF sample demonstrates the interactions involved when federating one user between two instances of Open Federation.

  2. The Liberty ID-WSF sample demonstrates the interactions between a web service client (WSC) and a web service provider (WSP). Specifically, it demonstrates how to query and modify the discovery service, and how to query and modify the Personal Profile service. Additionally, policy driven interactions can be configured to access Personal Profile service attributes using this sample.

Q: What are the WAR files included with Open Federation?

These are the Open Federation WAR files:

  • openfm.war is the Open Federation WAR.

  • openfm-samples.war is the Open Federation WAR including server side samples. This WAR is a super set of openfm.war.

  • openfm-clientsamples.war is the Open Federation sample client WAR. The WAR contains client application packages. openfm.war or openfm-samples.war must be deployed in order to deploy openfm-clientsamples.war.

Q: What is fmadm.zip?

fmadm.zip is the command line interface included with Open Federation. In order to use this application, unzip the file and follow the instructions in the README. fmadm.zip can be downloaded from https://opensso.dev.java.net/public/use/index.html. The nightly code is available at http://download.java.net/general/opensso/nightly. After building it, fmadm.zip is available in the webserver_root/products/federation/openfm/built/dist/ directory. Running famadm --help will display information on the interface.

Be sure to install this interface before beginning any procedures in which fmadm is needed.

Q: How do you set up and run the Liberty ID-FF sample?

There are two parts to deploy and run the Liberty ID-FF sample. Make sure you complete the procedures documented in both of the following sections:

How do you set up the Liberty ID-FF sample?

To set up the Liberty ID-FF sample, you need access to two running instances of Open Federation. You will configure an instance of the openfm-samples.war on each. openfm-samples.war contains Open Federation and the Liberty ID-FF sample.

  • machine-IDP will be configured as the identity provider.

  • machine-SP will be configured as the service provider.

BEFORE YOU BEGIN

If machine-IDP and machine-SP are running on the same physical machine but using two web containers running on different ports, make sure of the following:
  • Each instance of the sample WAR is deployed using a different URI.
  • The default cookie name of one of the instances is changed. For example, you can edit AMConfig.properties on machine-IDP so that the value of com.iplanet.am.cookie.name is a non-default one. Save the file and restart the web container to complete the process.

Following is the procedure to deploy the Liberty ID-FF sample WAR. How do you run the Liberty ID-FF sample? describes how to run it.

  1. Download the openfm-samples.war or build the WAR from the workspace.

  2. Deploy openfm-samples.war on machine-IDP.

    This instance will be configured as the identity provider.

  3. Access the configurator page on machine-IDP at:

    machine-IDP_protocol://machine-IDP_host:machine-IDP_port/machine-IDP_deploy_uri

    Enter the appropriate values to configure this hosted instance as the identity provider.

    Host Name Host name for for machine-IDP
    Port Number Port number for for machine-IDP
    Protocol Protocol used by machine-IDP (for example, http or https)
    Deployment URI Deployment URI for machine-IDP web application (for example, /idp)
    Administrator Password Password of administrator of machine-IDP (by default, amadmin)
    Administrator Password (confirm) Reenter the password of administrator of machine-IDP (by default, amadmin)
    Configuration Directory Path to the directory that contains the configuration files used by machine-IDP
    Cookie Domain Cookie domain for machine-IDP
    Platform Locale Locale used by machine-IDP (for example, en_US)

  4. Deploy openfm-samples.war on machine-SP.

    This instance will be configured as the service provider.

  5. Access the configurator page on machine-SP at:

    machine-SP_protocol://machine-SP_host:machine-SP_port/machine-SP_deploy_uri

    Enter the appropriate values to configure this hosted instance as the service provider.

    Host Name Host name for for machine-SP
    Port Number Port number for for machine-SP
    Protocol Protocol used by machine-SP (for example, http or https)
    Deployment URI Deployment URI for machine-SP web application (for example, /sp)
    Administrator Password Password of administrator of machine-SP (by default, amadmin)
    Administrator Password (confirm) Reenter the password of administrator of machine-SP (by default, amadmin)
    Configuration Directory Path to the directory that contains the configuration files used by machine-SP
    Cookie Domain Cookie domain for machine-SP
    Platform Locale Locale used by machine-SP (for example, en_US)

  6. Access the sample's configure.jsp on machine-IDP at:

    machine-IDP_protocol://machine-IDP_host:machine-IDP_port/machine-IDP_deploy_uri/samples/idff/idp/configure.jsp

    Enter values for the following fields regarding the remote service provider and click Configure when finished.

    Protocol Protocol used by machine-SP (for example, http or https)
    Host Host name for for machine-SP
    Port Port number for for machine-SP
    Deployment URI Deployment URI for machine-SP (for example, /sp)

    Following these configurations machine-IDP is configured as the hosted identity provider available at:

    machine-IDP_protocol://machine-IDP_host:machine-IDP_port/machine-IDP_deploy_uri

    and

    machine-SP is configured as the remote service provider available at:

    machine-SP_protocol://machine-SP_host:machine-SP_port/machine-SP_deploy_uri

    Additionally, a circle of trust named sampleidffcot has been created and the two providers are assigned as members.

  7. Access the sample's configure.jsp on machine-SP at:

    machine-SP_protocol://machine-SP_host:machine-SP_port/machine-SP_deploy_uri/samples/idff/sp/configure.jsp

    Enter values for the following fields regarding the remote identity provider and click Configure when finished.

    Protocol Protocol used by machine-IDP (for example, http or https)
    Host Host name for for machine-IDP
    Port Port number for for machine-IDP
    Deployment URI Deployment URI for machine-IDP (for example, /idp)

    Following the configuration machine-SP is configured as the hosted service provider available at:

    machine-SP_protocol://machine-SP_host:machine-SP_port/machine-SP_deploy_uri

    and

    machine-IDP is configured as the remote identity provider available at:

    machine-IDP_protocol://machine-IDP_host:machine-IDP_port/machine-IDP_deploy_uri

    Additionally, a circle of trust named sampleidffcot has been created and the two providers are assigned as members.

  8. Access the OpenSSO login page on machine-IDP at:

    machine-IDP_protocol://machine-IDP_host:machine-IDP_port/machine-IDP_deploy_uri/UI/Login

  9. Login as the top level administrator (amadmin, by default), create a user named idpuser and logout.

  10. Access the OpenSSO login page on machine-SP at:

    machine-SP_protocol://machine-SP_host:machine-SP_port/machine-SP_deploy_uri/UI/Login

  11. Login as the top level administrator (amadmin, by default), create a user named spuser and logout.

  12. Continue the procedure described in How do you run the Liberty ID-FF sample?

How do you run the Liberty ID-FF sample?

Assuming you have completed the procedure documented in How do you set up the Liberty ID-FF sample?, you have two deployed instances of Open Federation. On each is deployed an instance of the sample WAR. The following procedure describes how to federate the user accounts that had been created previously.

  1. Access the OpenSSO login page on machine-SP at:

    machine-SP_protocol://machine-SP_host:machine-SP_port/machine-SP_deploy_uri/UI/Login

    and login as spuser.

  2. Access the sample's service provider home page on machine-SP at:

    machine-SP_protocol://machine-SP_host:machine-SP_port/machine-SP_deploy_uri/samples/idff/sp/index.jsp

  3. Click the Federate link.

  4. Choose machine-IDP from the provided list and click Submit.

    You will be directed to the login page on machine-IDP.

  5. Login to machine-IDP as idpuser.

    You will be redirected back to machine-SP.

  6. Click Continue.

    You will be redirected back to the service provider home page. This is your confirmation that federation between spuser and idpuser has been established.

    7. OPTIONAL CONFIGURATION

    At this point, you can configure machine-SP to create a name identifier for the purpose of communicating with machine-IDP:

    1. Click Register Name Identifier on the service provider home page.

    2. Select machine-IDP from the IDP list.

    3. Click Submit.

      A page is displayed.

    4. Click Continue on the displayed page to return to the service provider home page.

      Returning to the service provider home page is confirmation that a name identifier has been created.

  7. Click Logout on the service provider home page.

    A message is displayed that the user has been successfully logged out.

  8. Click Continue on the service provider home page.

    This will begin the single sign-on process by redirecting you to the login page on machine-IDP.

  9. Login to machine-IDP as idpuser.

    Assuming successful single sign-on, a user token will be created on machine-SP and you will be returned to the service provider home page.

  10. Click Terminate Federation on the service provider home page.

    This will begin the process to terminate federation.

  11. Choose machine-IDP from the provided list and click Submit.

    A message is displayed that federation has been terminated.

  12. Click Continue.

    Returning to the service provider home page is confirmation that federation between idpuser and spuser has been terminated. You may click Federate to begin federation again.

    13. NOTE

    The sample's identity provider home page allows for the same operations on the identity provider side. Access the identity provider home page at:

    machine-IDP_protocol://machine-IDP_host:machine-IDP_port/machine-IDP_deploy_uri/samples/idff/idp/index.jsp and follow the procedure as documented.

Q: How do you set up and run the Liberty ID-WSF sample?

There are two parts to deploy and run the Liberty ID-WSF sample. Make sure you complete the procedures documented in the following sections:

How do you setup the Liberty ID-WSF sample?

To setup the Liberty ID-WSF sample, you need access to two instances of Open Federation and one instance of Open Federation client instance.

  • machine-A will be configured as the identity provider, discovery service, and Personal Profile service.

  • machine-B will be configured as the service provider and a web service client.

  • OPTIONAL: machine-C can be configured as a web service client. More information can be found in the procedure.

You will configure an instance of openfm-samples.war on both machine-A and machine-B and an instance of openfm-clientsamples.war on machine-B (or machine-C). openfm-clientsamples.war contains the web service client sample and the client SDK jars.

BEFORE YOU BEGIN

If machine-A and machine-B are running on the same physical machine but using two web containers running on different ports, make sure of the following:
  • Each instance of the sample WAR is deployed with a different URI.
  • The default cookie name of one of the instances is changed. For example, you can edit AMConfig.properties on machine-A so that the value of com.iplanet.am.cookie.name is a non-default one. Save the file and restart the web container to complete the process.

Following is the procedure to set up the Liberty ID-WSF sample. How do you run the Liberty ID-WSF sample? describes how to run it.

  1. Deploy the openfm-samples.war on machine-A and configure the Liberty ID-FF sample to run as an identity provider.

    See How do you set up the Liberty ID-FF sample? for details.

  2. Deploy the openfm-samples.war on machine-B and configure the Liberty ID-FF sample to run as a service provider.

    See How do you set up the Liberty ID-FF sample? for details.

  3. Create a user account on machine-A and a user account on machine-B.

  4. Federate the two accounts and accomplish single sign-on.

    See How do you run the Liberty ID-FF sample? for details.

  5. Deploy the openfm-clientsamples.war on machine-B.

    If you want to deploy openfm-clientsamples.war on machine-C, you need to create a configuration directory on machine-C and copy AMConfig.properties and FederationConfig.properties from the configuration directory on machine-B to the configuration directory on machine-C.

    NOTE

    If you choose the three server configuration, you will be asked for the path to the machine-C configuration directory in the next step. A configuration directory is configured on any machine when the openfm-samples.war is deployed. openfm-clientsamples.war does not create a configuration directory.

  6. Access the sample's configure.jsp on machine-B (or machine-C if using the three server configuration) at:

    machine-B_protocol://machine-B_host:machine-B_port/machine-B_deploy_uri/wsc/configure.jsp

  7. Enter values for the following fields regarding machine-B (or machine-C if using the three server configuration) and click Configure when finished.

    IDP Protocol Protocol used by the web container on which machine-A is deployed (for example, http or https)
    IDP Host Host name for machine-A
    IDP Port Port number for the machine-A web container (for example, 8080)
    IDP Deployment URI Deployment URI for the deployed sample WAR on machine-A (for example, /idp)
    Configuration Directory Name of machine-B configuration directory (or configuration directory created on machine-C). For example, /wsc/config.

How do you run the Liberty ID-WSF sample?

Assuming you have completed How do you set up the Liberty ID-WSF sample?, access the following URL in a browser and follow the link to execute the sample:

machine-B_protocol://machine-B_hostname:port/deployment_uri/wsc/index.jsp

The following procedures are optional setups:

1. How do you enable interactions for querying and modifying the Personal Profile service?

  1. Run the following commands to turn on policy evaluation for all queries to, and modifications of, the Personal Profile service:

    • famadm set-attr-defs -s sunIdentityServerLibertyPPService -u amadmin -f admin_password_file_name -t Global -a "sunIdentityServerPPisQueryPolicyEvalRequired=true"
    • famadm set-attr-defs -s sunIdentityServerLibertyPPService -u amadmin -f admin_password_file_name -t Global -a "sunIdentityServerPPisModifyPolicyEvalRequired=true"

  2. Create a policy for the Personal Profile service with the following procedure:

    1. Access the OpenSSO login page on machine-A at:

      machine-A_protocol://machine-A_host:machine-A_port/machine-A_deploy_uri/UI/Login

      and login as the top-level administrator (by default, amadmin).

    2. Click the top-level realm opensso.

    3. Click the Policies tab.

    4. Click New Policy.

    5. Enter a name for the policy as a value for Name.

    6. Click New... under Rules.

    7. Select Liberty Personal Profile Service (with resource name) and click Next.

    8. Enter a rule name as a value for Name.

    9. Enter * (an asterisk) as the value of Resource Name.

    10. Select the MODIFY and QUERY action boxes.

    11. Select interactForConsent in both drop down menus under Value and click Finish.

    12. Click New... under Subjects.

    13. Select Authenticated Users and click Next.

    14. Enter the name of the user created for the identity provider in Name and click Finish.

    15. Click OK to save this policy.

    Completing this procedure ensures that only authenticated users are allowed access to the Personal Profile service.

2. How do you enable name ID encryption in the session context of a discovery bootstrap?

  1. Set up a keystore.

    This needs to be done on both machine-A and machine-B. If machine-C is different from machine-B, copy keystore.jks, .keypass and .storepass from machine-B to machine-C and update FederationConfig.properties on machine-C accordingly. See How do you setup a keystore?.

  2. Use the following procedure to set up machine-A as the identity provider:

    1. Run the following command to set the default attribute values for the discovery service:

      famadm set-attr-defs -s sunIdentityServerDiscoveryService -u amadmin -f admin_password_file_name -t Global -a "sunIdentityServerDiscoProviderID=machine-A_protocol://machine-A_host:machine-A_port/machine-A_deploy_uri"

    2. Run the following command to set the default attribute values for name ID encryption:

      famadm set-attr-defs -s sunIdentityServerDiscoveryService -u amadmin -f admin_password_file_name -t Global -a "sunIdentityServerBootstrappingEncryptNIinSessionContext=true"

    3. Run the following command to display the default attribute values for bootstrapping:

      famadm get-attr-defs -s sunIdentityServerDiscoveryService -u amadmin -f admin_password_file_name -t Global -a sunIdentityServerBootstrappingDiscoEntry

    4. From the previous step's output, save the entire line beginning with sunIdentityServerBootstrappingDiscoEntry= to a file.

      In this case, we will call the file datafile.

    5. Change the datafile you just created as follows:

      • Replace

        <ProviderID>machine-A_protocol://machine-A_host:machine-A_port/machine-A_deploy_uri/Liberty/disco</ProviderID>

        with

        <ProviderID>machine-A_protocol://machine-A_host:machine-A_port/machine-A_deploy_uri</ProviderID>

      • Replace

        <SecurityMechID>urn:liberty:security:2003-08:null:null</SecurityMechID>

        with

        <SecurityMechID>urn:liberty:security:2003-08:null:SAML</SecurityMechID>

      • Replace

        </ResourceOffering></DiscoEntry>

        with

        </ResourceOffering><AuthorizeRequester xmlns="urn:liberty:disco:2003-08"/></DiscoEntry>

    6. Run the following command to set the default attribute values for the discovery service in datafile:

      famadm set-attr-defs -s sunIdentityServerDiscoveryService -u amadmin -f admin_password_file_name -t Global -D datafile

    7. Edit the values of the following properties in the FederationConfig.properties file located in the configuration directory on machine-A as follows:

      • com.sun.identity.liberty.ws.ta.certalias=test

      • com.sun.identity.liberty.ws.trustedca.certaliases=test

      • com.sun.identity.liberty.ws.wsc.certalias=test

      test is the sample value.

    8. Run the following command to delete the identity provider metadata:

      famadm delete-entity -y machine-A_entityid -u amadmin -f admin_password_file_name -c metadata_spec

      where

      machine-A_entityid The provider's entity ID in the format: machine-A_protocol://machine-A_host:machine-A_port/machine-A_deploy_uri
      For example, http://happy.red.sun.com:80/openfm
      metadata_spec Either idff or saml2; in this case, idff.

    9. Run the following command to delete the service provider metadata:

      famadm delete-entity -y machine-B_entityid -u amadmin -f admin_password_file_name -c metadata_spec

      where

      machine-B_entityid The provider's entity ID in the format: machine-A_protocol://machine-A_host:machine-A_port/machine-A_deploy_uri
      For example, http://sad.red.sun.com:80/openfm
      metadata_spec Either idff or saml2; in this case, idff.

    10. Run the following command to create a metadata file for the identity provider:

      famadm create-metadata-templ -u amadmin -f admin_password_file_name -y machine-A_entityid -m standard_metadata -x extended_metadata -i idpMetaAlias -b idpSCertAlias -g idpeCertAlias -c metadata_spec

      where

      machine-A_entityid The provider's entity ID in the format: machine-A_protocol://machine-A_host:machine-A_port/machine-A_deploy_uri
      For example, http://happy.red.sun.com:80/openfm
      standard_metadata Path to, and name of, the standard metadata XML file
      extended_metadata Path to, and name of, the extended metadata XML file
      idpMetaAlias Specify a metaAlias for the identity provider being created.
      idpSCertAlias Specify a signing certificate alias for the identity provider being created.
      idpeCertAlias Specify an encryption certificate alias for the identity provider being created.
      metadata_spec Either idff or saml2; in this case, idff.

    11. Change the value of the enableNameIDEncryption attribute in the extended metadata file just created to true.

    12. Run the following command to import the standard and extended metadata files into the circle of trust previously created:

      famadm import-entity -u amadmin -f admin_password_file_name -m standard_metadata -x extended_metadata -t cot_name -c metadata_spec

      where

      standard_metadata Path to, and name of, the standard metadata XML file
      extended_metadata Path to, and name of, the extended metadata XML file
      cot_name The name of the circle into which the files are being imported; in this case, sampleidffcot.
      metadata_spec Either idff or saml2; in this case, idff.

    13. Copy the standard metadata file (created during the service provider procedure documented in the next step) from machine-B to the /tmp directory on this machine.

    14. Run the following command to import the standard metadata file just copied from machine-B:

      famadm import-entity -u amadmin -f admin_password_file_name -m standard_metadata -t cot_name -c metadata_spec

      where

      standard_metadata Path to, and name of, the standard metadata XML file
      cot_name The name of the circle into which the files are being imported; in this case, sampleidffcot.
      metadata_spec Either idff or saml2; in this case, idff.

  3. Use the following procedure to set up machine-B as the service provider:

    1. Run the following command to delete the sample identity provider entity:

      famadm delete-entity -y sample_idp_entityid -u amadmin -f admin_password_file_name -c metadata_spec

    2. Run the following command to delete the sample service provider entity:

      famadm delete-entity -y sample_sp_entityid -u amadmin -f admin_password_file_name -c metadata_spec

    3. Run the following command to create a metadata file for the service provider:

      famadm create-metadata-templ -u amadmin -f admin_password_file_name -y machine-B_entityid -m standard_metadata -x extended_metadata -s spMetaAlias -a spSCertAlias -r speCertAlias -c metadata_spec

      where

      machine-B_entityid The provider's entity ID in the format: machine-B_protocol://machine-B_host:machine-B_port/machine-B_deploy_uri
      For example, http://sad.red.sun.com:80/openfm
      standard_metadata Path to, and name of, the standard metadata XML file
      extended_metadata Path to, and name of, the extended metadata XML file
      spMetaAlias Specify a metaAlias for the service provider being created.
      spSCertAlias Specify a signing certificate alias for the identity provider being created.
      speCertAlias Specify an encryption certificate alias for the identity provider being created.
      metadata_spec Either idff or saml2; in this case, idff.

    4. Run the following command to import the metadata file just created:

      famadm import-entity -u amadmin -f admin_password_file_name -m standard_metadata -x extended_metadata -t cot_name -c metadata_spec

      where

      standard_metadata Path to, and name of, the standard metadata XML file
      extended_metadata Path to, and name of, the extended metadata XML file
      cot_name Name of the circle to which the metadata is being imported; in this case, sampleidffcot.
      metadata_spec Either idff or saml2; in this case, idff.

    5. Copy the standard metadata file (created during the identity provider procedure documented in the previous step) from machine-A to the /tmp directory on this machine.

    6. Run the following command to import the sample identity provider entity into the circle of trust:

      famadm import-entity -u amadmin -f admin_password_file_name -m standard_metadata -t cot_name -c metadata_spec

      where

      standard_metadata Path to, and name of, the standard metadata XML file
      cot_name Name of the circle to which the metadata is being imported; in this case, sampleidffcot.
      metadata_spec Either idff or saml2; in this case, idff.

  4. Restart web containers on all three machines and you have enabled name ID encryption in the session context of a discovery bootstrap.

Q: How do you turn on signing using SAML v1.x?

When used, the SAML POST Profile automatically turns on signing. The following procedure illustrates how to turn on signing using the SAML v1.x SAML Artifact Profile.

  1. Run the following command to turn on signing for all SAML responses:

    famadm set-attr-defs -s iPlanetAMSAMLService -t global -u amadmin -f admin_password_file_name --attributevalues iplanet-am-saml-signresponse=true -d

  2. Run the following command to turn on signing for all SAML requests:

    famadm set-attr-defs -s iPlanetAMSAMLService -t global -u amadmin -f admin_password_file_name --attributevalues iplanet-am-saml-signrequest=true -d

  3. Run the following command to turn on signing for all SAML assertions:

    famadm set-attr-defs -s iPlanetAMSAMLService -t global -u amadmin -f admin_password_file_name --attributevalues iplanet-am-saml-signassertion=true -d

Q: How do you turn on signing using the Liberty ID-FF?

If all of the following points are true, Liberty ID-FF signing is enabled. If not, follow the procedures below to make the necessary modifications and then restart the web containers.

  • A keystore is set up on the hosted provider. See How do you setup a keystore? for the procedure.

  • The signingCertAlias and KeyDescriptor attributes in the hosted provider's standard metadata XML file are set properly.

    To verify this:

    1. Run the following command on the hosted provider to export the metadata XML files.

      famadm export-entity -y hosted_entity_id -u amadmin -f admin_password_file_name -m standard_metadata -x extended_metadata -c metadata_spec

      where

      hosted_entityid The provider's entity ID in the format: protocol://host:port/deploy_uri
      For example, http://happy.red.sun.com:80/openfm
      standard_metadata The standard metadata file being exported.
      extended_metadata The extended metadata file being exported.
      metadata_spec Either idff or saml2; in this case, idff.

      If a value is set for signingCertAlias in extended_metadata and KeyDescriptor in standard_metadata, you are finished. If there is no value set, continue to the next step.

    2. Re-generate the hosted provider's metadata with the security information as follows:

      • For a hosted identity provider, run the following command:

        famadm create-metadata-templ -y idp_entity_id -u amadmin -f admin_password_file_name -m standard_metadata -x extended_metadata -i idpMetaAlias -b idpSCertAlias -c metadata_spec

      • For a hosted service provider, run the following command:

        famadm create-metadata-templ -y sp_entity_id -u amadmin -f admin_password_file_name -m standard_metadata -x extended_metadata -s spMetaAlias -a spSCertAlias -c metadata_spec

        • You may modify the extended metadata attributes (for example, providerHomePageURL) as needed.

    3. Run the following command on the hosted provider to delete the metadata XML files.

      famadm delete-entity -y hosted_entity_id -u amadmin -f admin_password_file_name -e realm -c metadata_spec

    4. Run the following command on the hosted provider to load the modified metadata XML files.

      famadm import-entity -u amadmin -f admin_password_file_name -m standard_metadata -x extended_metadata -t cot_name -c metadata_spec

  • The value of the com.sun.identity.federation.services.signingOn attribute in the FederationConfig.properties is set to true.

  • The KeyDescriptor attribute in the remote provider's standard metadata XML file is set properly.

    To verify this:

    1. Run the following command on the hosted provider to export the remote provider's standard metadata XML file.

      famadm export-entity -y remote_entity_id -u amadmin -f admin_password_file_name -m remote_standard_metadata -x remote_extended_metadata -c metadata_spec

    2. Search the XML file(s) for the KeyDescriptor attribute and make sure it contains a value.

      If none exists, get the updated standard metadata XML file from the remote provider using the following procedure:

      1. Run the following command to delete the remote provider metadata from the hosted provider machine.

        famadm delete-entity -y remote_entity_id -u amadmin -f admin_password_file_name -e realm -c metadata_spec

      2. Run the following command to import the updated remote provider metadata (retrieved from the remote provider machine) to the hosted provider machine.

        famadm import-entity -u amadmin -f admin_password_file_name -m new_remote_standard_metadata -t circle-of-trust_name -c metadata_spec

        3. where

        new_remote_standard_metadata The standard metadata file to which a value for KeyDescriptor was added.
        remote_extended_metadata The extended metadata file that was previously exported.

      NOTE

      If the remote provider is running on an instance of Sun Java System Federation Manager, the standard metadata (including the KeyDescriptor attribute) can be obtained by running the following command on the machine in which the remote provider is hosted.

      famadm export-entity -y remote_entity_id -u amadmin -f admin_password_file_name -m remote_standard_metadata -x remote_extended_metadata -c metadata_spec

  • Optional: To enable signing of authentication requests on a hosted service provider, verify (or modify, if applicable) the hosted service provider's standard metadata using the following procedure:

    1. Run the following command to export the standard and extended metadata from the hosted service provider:

      famadm export-entity -y hosted_entity_id -u amadmin -f admin_password_file_name -m hosted_standard_metadata -x hosted_extended_metadata -c metadata_spec

    2. Make sure the value of the AuthnRequestsSigned attribute in the hosted_standard_metadata is set to true.

      If not set the value correctly and proceed.

    3. Run the following command to delete the hosted provider's metadata:

      famadm delete-entity -y hosted_entity_id -u amadmin -f admin_password_file_name -e realm -c metadata_spec

    4. Run the following command to import the hosted provider's updated metadata:

      famadm import-entity -u amadmin -f admin_password_file_name -m hosted_standard_metadata -x hosted_extended_metadata -c metadata_spec

Q: How do you setup a keystore?

The following procedure illustrates how to setup a keystore using the keytool command line interface which is part of the Java Development Kit (JDK).

  1. Run the following command:

    JDK Home/bin/keytool -genkey -keyalg rsa -alias test -dname "cn=sun-unix,ou=SUN Java System Access Manager,o=Sun, c=US" -keypass 11111111 -keystore /keystore.jks -storepass 11111111

  2. Access the encode.jsp file on the instance to encrypt the keystore password:

    server_protocol://server_host:server_port/server_deploy_uri/encode.jsp

    openfm.war or openfm-samples.war must be deployed for access to encode.jsp.

  3. Enter the text password and click Encode.

    For example, 11111111 becomes AQICQS+KlLm9oNd2l98bnkd7TraHI/cv8B1p.

  4. Create a new file named .storepass and paste the encrypted password for the keystore in it.

    In this case, we paste AQICQS+KlLm9oNd2l98bnkd7TraHI/cv8B1p into .storepass.

  5. Create a new file named .keypass and paste the encrypted password for the private key in it.

    In this case, we again paste AQICQS+KlLm9oNd2l98bnkd7TraHI/cv8B1p into .keypass.

  6. Edit the values of the following properties in the FederationConfig.properties file located in the configuration directory.

    • com.sun.identity.saml.xmlsig.keystore= path_to_directory/keystore.jks

      This defines the name and location of the keystore.

    • com.sun.identity.saml.xmlsig.storepass= path_to_directory/.storepass

      This defines the name and location of .storepass.

    • com.sun.identity.saml.xmlsig.keypass= path_to_directory/.keypass

      This defines the location of .keypass.

    • com.sun.identity.saml.xmlsig.certalias= test

      This defines the default sample certificate alias.

Q: How do you setup single sign-on using SAML 1.x and the fmadm command line interface?

To accomplish single sign-on using SAML 1.x, follow this procedure on the instances of Open Federation that will serve as the SAML producer and the SAML consumer.

  1. Run the following command on the remote site to get the site ID:

    famadm get-attr-defs -s iPlanetAMSAMLService -t global -u amadmin -f admin_password_file_name -a iplanet-am-saml-siteid-issuername-list

    The output of this command is

    iplanet-am-saml-siteid-issuername-list=instanceID=http://host.exampleA.com:58080|siteid=VhqieajnHbbNX1usZkmnQLTxNeQ=|issuerName=host.exampleA.com:58080

    The site ID is the value of the siteid property, VhqieajnHbbNX1usZkmnQLTxNeQ=.

  2. Configure a trusted partner entry for the remote site in the hosted site's SAML Service using the following procedure:

    1. Display any existing trusted partners by running the following command:

      famadm get-attr-defs -s iPlanetAMSAMLService -t global -u amadmin -f admin_password_file_name -a iplanet-am-saml-partner-urls

      The output will be

      iplanet-am-saml-partner-urls=

    2. Put the remote partner's information in a new file called, for this procedure, partner.txt.

      The file will contain the following attributes and corresponding values:

      • target=partner_hostname
      • sourceid=remote_siteid_from_previous_step
      • samlurl=protocol://partner_hostname:partner_port/uri/SAMLAwareServlet
      • soapurl=protocol://partner_hostname:partner_port/uri/SAMLSOAPReceiver
      • posturl=protocol://partner_hostname:partner_port/uri/SAMLPOSTProfileServlet
      • issuer=partner_hostname:partner_port
      • hostlist=partner_hostname

      For example: 

      iplanet-am-saml-partner-urls=target=provider.com|sourceid=VhqieajnHbbNX1usZkmnQLTxNeQ=|samlurl=http://host.exampleA.com:58080/amserver/SAMLAwareServlet|
soapurl=http://host.exampleA.com:58080/amserver/SAMLSOAPReceiver|posturl=http://host.exampleA.com:58080/amserver/SAMLPOSTProfileServlet|
issuer=host.exampleA.com:58080|hostlist=host.exampleA.com

      Other keys that can also be used for iplanet-am-saml-partner-urls include:

      • Version
      • Certalias
      • AuthType
      • authuser
      • authpassword
      • AttributeMapper
      • PartnerAccountMapper
      • SiteAttributeMapper
      • ActionMapper
      • nameidentifiermapper

      NOTE

      These keys are case insensitive. Refer to the Sun Java System Access Manager 7.1 Federation and SAML Guide for details.
    3. Import the file you just created using the following command:

      famadm add-attr-defs -s iPlanetAMSAMLService -t global -u amadmin -f admin_password_file_name --datafile ./partner.txt

    4. To verify that the file was imported correctly, run the following command on the hosted site to display the information:

      famadm get-attr-defs -s iPlanetAMSAMLService -t global -u amadmin -f admin_password_file_name -a iplanet-am-saml-partner-urls

      In this case, the output will be: 

      iplanet-am-saml-partner-urls=target=iplanet.com|sourceid=VhqieajnHbbNX1usZkmnQLTxNeQ=|samlurl=http://host.exampleA.com:58080/amserver/SAMLAwareServlet|
soapurl=http://host.exampleA.com:58080/amserver/SAMLSOAPReceiver|posturl=http://host.exampleA.com:58080/amserver/SAMLPOSTProfileServlet|
issuer=host.exampleA.com:58080|hostlist=host.exampleA.com

  3. Restart the hosted site's web container.

  4. To access the SAML Artifact Profile or the SAML POST Profile, login to the SAML source site and:

    1. Access the SAML Artifact Profile at this URL:

      protocol://hostname:port/uri/SAMLAwareServlet?TARGET=target_protocol://target_hostname:target_port/target_uri/UI/Login

      You will be redirected to the target site without authentication.

    2. Access the SAML POST Profile at this URL:

      protocol://hostname:port/uri/SAMLPOSTProfileServlet?TARGET=target_protocol://target_hostname:target_port/target_uri/UI/Login

      You will be redirected to the target site without authentication.

      NOTE

      You must setup a keystore before accessing the SAML POST Profile. See How do you setup a keystore? for the procedure.

Q: How do you set up single sign-on using the Liberty ID-FF and the fmadm command line interface?

To set up single sign-on using the Liberty ID-FF and the famadm command line interface, repeat the following procedure on both the identity provider instance and the service provider instance of Open Federation.

  1. Run the following command to create a circle of trust.

    famadm create-cot -t cot_name -u amadmin -f admin_password_file_name -e realm -c metadata_spec

    where

    cot_name The name of the circle being created.
    realm The realm into which the circle will be put.
    metadata_spec Either idff or saml2; in this case, idff.

  2. Use one of the following procedures to generate the standard and extended metadata files for a hosted identity provider or a hosted service provider.

    • To generate metadata for a hosted identity provider run the command that matches the status of your keystore:

      1. Run the following command if a keystore has already been set up:

        famadm create-metadata-templ -y idp_entity_id -u amadmin -f admin_password_file_name -m hosted_standard_metadata -x hosted_extended_metadata -i idpMetaAlias -b idpSCertAlias -c metadata_spec

        where

        idp_entity_id The provider's entity ID in the format: protocol://host:port/deploy_uri
        For example, http://happy.red.sun.com:80/openfm
        hosted_standard_metadata Path to, and name of, the standard metadata XML file
        hosted_extended_metadata Path to, and name of, the extended metadata XML file
        idpMetaAlias Specify a metaAlias for the hosted identity provider to be created.
        idpSCertAlias Specify a signing certificate alias for the hosted identity provider to be created.
        metadata_spec Either idff or saml2; in this case, idff.

      2. Run the following command if a keystore has NOT been set up:

        famadm create-metadata-templ -y idp_entity_id -u amadmin -f admin_password_file_name -m hosted_standard_metadata -x hosted_extended_metadata -i idpMetaAlias -c metadata_spec

    • To generate metadata for a hosted service provider run the command that matches the status of your keystore:

      1. Run the following command if a keystore has already been set up:

        famadm create-metadata-templ -y sp_entity_id -u amadmin -f admin_password_file_name -m hosted_standard_metadata -x hosted_extended_metadata -i spMetaAlias -b spSCertAlias -c metadata_spec

        where

        sp_entity_id The provider's entity ID in the format: protocol://mhost:port/deploy_uri
        For example, http://happy.red.sun.com:80/openfm
        hosted_standard_metadata Path to, and name of, the standard metadata XML file
        hosted_extended_metadata Path to, and name of, the extended metadata XML file
        spMetaAlias Specify a metaAlias for the hosted identity provider to be created.
        spSCertAlias Specify a signing certificate alias for the hosted identity provider to be created.
        metadata_spec Either idff or saml2; in this case, idff.

      2. Run the following command if a keystore has NOT been set up:

        famadm create-metadata-templ -y sp_entity_id -u amadmin -f admin_password_file_name -m hosted_standard_metadata -x hosted_extended_metadata -i spMetaAlias -c metadata_spec

  3. Use the procedures in the previous step to get the metadata for the remote provider.

    If the hosted provider is an identity provider, the remote provider will be a service provider. Conversely, if the hosted provider is a service provider, the remote provider will be an identity provider.

    NOTE

    If the remote provider is hosted on Sun Java System Federation Manager, you can run the command documented previously on the remote machine and copy the generated standard metadata file to the hosted machine.

  4. Run the following command to load hosted metadata.

    famadm import-entity -u amadmin -f admin_password_file_name -m hosted_standard_metadata -x hosted_extended_metadata -t cot_name -c metadata_spec

    The value of cot_name is the name of the circle of trust created in the first step.

  5. Run the following command to load remote metadata.

    famadm import-entity -u amadmin -f admin_password_file_name -m remote_standard_metadata -t cot_name -c metadata_spec

    The value of cot_name is the name of the circle of trust created in the first step.

  6. Restart the web container(s).

Q: How do you setup single sign-on using SAML v2 and the fmadm command line interface?

To accomplish single sign-on using SAML v2, follow this procedure on the instances of Open Federation that will serve as the identity provider and the service provider.

BEFORE YOU BEGIN

Decide which instance you are configuring as the service provider and as the identity provider.
  1. Create the service provider metadata files.

    1. Run the following command on the service provider instance to create the service provider metadata files.

      famadm create-metadata-templ -y sp_entity_id -u amadmin -f admin_password_file_name -m sp_standard_metadata -x sp_extended_metadata -s sp_meta_alias

    2. Edit the default values of any attributes in the sp_extended_metadata to reflect your deployment, if required.

      For example, attribute mappers might need to be changed.

  2. Create the identity provider metadata files.

    1. Run the following command on the identity provider instance to create the Identity Provider metadata file.

      famadm create-metadata-templ -y idp_entity_id -u amadmin -f admin_password_file_name -m idp_standard_metadata -x idp_extended_metadata -i idp_meta_alias

    2. Edit the default values of any attributes in the idp_extended_metadata to reflect your deployment, if required.

      For example, attribute mappers might need to be changed.

  3. Import the metadata files into the service provider instance.

    1. Run the following command on the service provider instance to create a circle of trust.

      famadm create-cot -t cot_name -u amadmin -f admin_password_file_name

    2. Run the following command to import the service provider metadata files into the circle just created.

      famadm import-entity -u amadmin -f admin_password_file_name -m sp_standard_metadata -x sp_extended_metadata -t cot_name

    3. Copy the standard identity provider metadata file from the identity provider instance to the service provider instance.

    4. Run the following command to import the identity provider metadata files to the service provider instance.

      famadm import-entity -u amadmin -f admin_password_file_name -m idp_standard_metadata -t cot_name

    5. Run the following command to verify that the files have been imported successfully.

      famadm list-cot-members -u amadmin -f admin_password_file_name -t cot_name

      This will display all members of the named circle of trust. In this case, the hosted service provider and remote identity provider are listed. You can also export the metadata files for verification using the following command:

      famadm export-entity -u amadmin -f admin_password_file_name -y provider_entityid -m provider_standard_metadata -x provider_extended_metadata

    6. Restart the Web Container.

  4. Import the metadata files into the identity provider instance.

    1. Run the following command on the identity provider instance to create a circle of trust.

      famadm create-cot -t cot_name -u amadmin -f admin_password_file_name

    2. Run the following command to import the identity provider metadata files.

      famadm import-entity -u amadmin -f admin_password_file_name -m idp_standard_metadata -x idp_extended_metadata -t cot_name

    3. Copy the standard service provider metadata file from the service provider instance to the identity provider instance.

    4. Run the following command to import the service provider metadata files to the identity provider instance.

      famadm import-entity -u amadmin -f admin_password_file_name -m sp_standard_metadata -t cot_name

    5. Run the following command to verify that the files have been imported successfully.

      famadm list-cot-members -u amadmin -f admin_password_file_name -t cot_name

      This will display all members of the named circle of trust. In this case, the remote service provider and hosted identity provider are listed. You can also export the metadata files, using the following command, for verification:

      famadm export-entity -u amadmin -f admin_password_file_name -y provider_entityid -m provider_standard_metadata -x provider_extended_metadata

    6. Restart the web container.

  5. Verify single sign-on using one of the following URLs:

    • To initiate single sign-on from the Service Provider, access the following URL:

      sp_protocol://sp_host:sp_port/sp_deploy_URI/spssoinit?metaAlias=spMetaAlias&idpEntityID=idp_entityID

    • To initiate single sign-on from the Identity Provider, access the following URL:

      sp_protocol://idp_host:idp_port/idp_deploy_URI/idpssoinit?metaAlias=idpMetaAlias&spEntityID=sp_entityID

    Initially, you will need to authenticate to both the service provider and the identity provider site to establish federation. After that, you will be redirected to the remote partner site without re-authentication.

Q: How do you turn on signing and encryption using SAML v2?

The following procedure illustrates how you turn on signing and encryption using SAML v2.

BEFORE YOU BEGIN

Setup a keystore using the keytool command line interface on the machines acting as service provider and identity provider. See How do you setup a keystore? for details.

After setting up the keystore, import the applicable signing and encryption certificates into it, again, using the keytool command line interface.

  1. Run the following command on the service provider machine to regenerate the service provider metadata (including the newly added signing and encryption key information).

    famadm create-metadata-templ -y sp_entityid -u amadmin -f admin_password_file_name -m sp_standard_metadata -x sp_extended_metadata -s sp_metaAlias -a sp_certalias -r sp_enc_alias

  2. Run the following command on the identity provider machine to regenerate the identity provider metadata (including the newly added signing and encryption key information).

    famadm create-metadata-templ -y idp_entityid -u amadmin -f admin_password_file_name -m idp_standard_metadata -x idp_extended_metadata -i idp_metaAlias -b idp_certalias -g idp_enc_alias

  3. Modify the values of the following attributes in the appropriate file to enable signing and encryption.

    • Identity Provider Standard Metadata Configuration File Attribute

      • wantAuthnRequestsSigned

    • Service Provider Standard Metadata Configuration File Attributes

      • AuthnRequestsSigned

      • WantAssertionsSigned

    • Identity Provider Extended Metadata Configuration File Attributes

      • wantNameIDEncrypted

      • wantArtifactResolveSigned

      • WantLogoutRequestSigned

      • WantLogoutResponseSigned

      • WantMNIRequestSigned

      • WantMNIResponseSigned

    • Service Provider Extended Metadata Configuration File Attributes

      • wantAttributeEncrypted

      • wantAssertionEncrypted

      • wantNameIDEncrypted

      • wantArtifactResponseSigned

      • WantLogoutRequestSigned

      • WantLogoutResponseSigned

      • WantMNIRequestSigned

      • WantMNIResponseSigned

    NOTE

    To use the SAML POST profile, signing must be enabled. It is enabled automatically when using the SAML Artifact profile.

  4. Use the following procedure to remove the old metadata from, and import the new metadata to, the service provider machine:

    1. Run the following command to remove the old hosted service provider metadata:

      famadm delete-entity -y sp_entityid -u amadmin -f admin_password_file_name

    2. Run the following command to remove the old remote identity provider metadata:

      famadm delete-entity -y idp_entityid -u amadmin -f admin_password_file_name

    3. Run the following command to import the new hosted service provider metadata:

      famadm import-entity -u amadmin -f admin_password_file_name -m sp_standard_metadata -x sp_extended_metadata -t cot_name

    4. Copy the new standard and extended metadata files from the remote identity provider machine to the hosted service provider machine.

    5. Change the hosted="1" attribute to hosted="0" in the extended metadata file that was just copied from the remote identity provider to the service provider side.

    6. Run the following command to import the newly modified remote identity provider metadata:

      famadm import-entity -u amadmin -f admin_password_file_name -m idp_standard_metadata -x idp_extended_metadata -t cot_name

  5. Use the following procedure to remove the old metadata from, and import the new metadata to, the identity provider machine:

    1. Run the following command to remove the old hosted identity provider metadata:

      famadm delete-entity -y idp_entityid -u amadmin -f admin_password_file_name

    2. Run the following command to remove the old remote service provider metadata:

      famadm delete-entity -y sp_entityid -u amadmin -f admin_password_file_name

    3. Run the following command to import the new hosted identity provider metadata:

      famadm import-entity -u amadmin -f admin_password_file_name -m idp_standard_metadata -x idp_extended_metadata -t cot_name

    4. Copy the new standard and extended metadata files from the remote service provider machine to the hosted identity provider machine.

    5. Change the hosted="1" attribute to hosted="0" in the extended metadata file that was just copied from the remote service provider to the identity provider side.

    6. Run the following command to import the newly modified remote service provider metadata:

      famadm import-entity -u amadmin -f admin_password_file_name -m sp_standard_metadata -x sp_extended_metadata -t cot_name

  6. Restart the web containers hosting both providers.

  7. Verify single sign-on using one of the following URLs:

    • To initiate single sign-on from the service provider, access the following URL:

      sp_protocol://sp_host:sp_port/sp_deploy_URI/spssoinit?metaAlias=spMetaAlias&idpEntityID=idp_entityID

    • To initiate single sign-on from the identity provider, access the following URL:

      idp_protocol://idp_host:idp_port/idp_deploy_URI/idpssoinit?metaAlias=idpMetaAlias&spEntityID=sp_entityID

    Initially, you will need to authenticate to both the service provider and the identity provider site to establish federation. After that, you will be redirected to the remote partner site without re-authentication.

Q: How do you setup authentication using the Authentication Web Service?

The following procedure illustrates how to setup for authentication using the Authentication Web Service.

  1. Run the following command to get the current value for the defined Authentication Web Service attribute:

    famadm get-attr-defs -s sunIdentityServerAuthnService -u amadmin -f admin_password_file_name -t Global -a MechanismHandlerList

  2. From the previous command's output, save the entire line beginning with MechanismHandlerList= to a file.

    In this case, we will call the file datafile.

  3. Edit datafile to change the existing handler class or add a new one.

    The syntax of the value of the MechanismHandlerList attribute is key=mechanism_name|class=handler_class_for_mechanism_specified_in_key. You can change this value by modifying the existing line or adding a new one.

  4. Run the following command to change the value of MechanismHandlerList:

    famadm set-attr-defs -s sunIdentityServerAuthnService -u amadmin -f admin_password_file_name -t Global -D datafile

Q: How do you setup the Discovery Service to issue X509, Bearer, and SAML tokens?

The following procedure illustrates how to configure the Discovery Service to issue x509, Bearer, and SAML tokens.

BEFORE YOU BEGIN

Setup an identity provider, a service provider, and a keystore on each by following the procedures documented in How do you set up and run the Liberty ID-FF sample? and How do you setup a keystore?, respectively.

  1. On the identity provider machine:

    1. Run the following command to get the current value for the defined Discovery Service attribute:

      famadm get-attr-defs -s sunIdentityServerDiscoveryService -u amadmin -f admin_password_file_name -t Global -a sunIdentityServerBootstrappingDiscoEntry

    2. From the previous step's output, save the entire line beginning with sunIdentityServerBootstrappingDiscoEntry= to a file.

      In this case, we will call the file datafile.

    3. Edit datafile to setup for the specific token:

      • For SAML tokens, replace the following:

        <SecurityMechID>urn:liberty:security:2003-08:null:null</SecurityMechID>

        with

        <SecurityMechID>urn:liberty:security:2003-08:null:SAML</SecurityMechID>

        and

        </ResourceOffering></DiscoEntry>

        with

        </ResourceOffering><AuthorizeRequester xmlns="urn:liberty:disco:2003-08"/></DiscoEntry>

      • For X509 tokens, replace the following:

        <SecurityMechID>urn:liberty:security:2003-08:null:null</SecurityMechID>

        with

        <SecurityMechID>urn:liberty:security:2003-08:null:X509</SecurityMechID>

      • For Bearer tokens, replace the following:

        <SecurityMechID>urn:liberty:security:2003-08:null:null</SecurityMechID>

        with

        <SecurityMechID>urn:liberty:security:2004-04:null:Bearer</SecurityMechID>

        and

        </ResourceOffering></DiscoEntry>

        with

        </ResourceOffering><AuthenticateRequester xmlns="urn:liberty:disco:2003-08"/><GenerateBearerToken xmlns="urn:liberty:disco:2004-04"/></DiscoEntry>

    4. Run the following command (using as datafile input) to change the values of the attributes:

      famadm set-attr-defs -s sunIdentityServerDiscoveryService -u amadmin -f admin_password_file_name -t Global -D datafile

    5. Edit the following properties in FederationConfig.properties to reflect the correct aliases:

      • com.sun.identity.liberty.ws.ta.certalias

      • com.sun.identity.liberty.ws.trustedca.certaliases

      • com.sun.identity.liberty.ws.wsc.certalias

    6. Run the following command to delete the identity provider:

      famadm delete-entity -y idp_entityid -u amadmin -f admin_password_file_name -c metadata_spec

      where

      idp_entityid The provider's entity ID in the format: protocol://host:port/deploy_uri
      For example, http://happy.red.sun.com:80/openfm
      metadata_spec Either idff or saml2; in this case, idff.

    7. Run the following command to delete the remote service provider:

      famadm delete-entity -y remote_sp_entityid -u amadmin -f admin_password_file_name -c metadata_spec

      where

      remote_sp_entityid The provider's entity ID in the format: protocol://host:port/deploy_uri
      For example, http://happy.red.sun.com:80/openfm
      metadata_spec Either idff or saml2; in this case, idff.

    8. Run the following command to create new standard and extended metadata files for the identity provider:

      famadm create-metadata-templ -u amadmin -f admin_password_file_name -y idp_entityid -m standard_metadata -x extended_metadata -i idpMetaAlias -b idpSCertAlias -c metadata_spec

      where

      idp_entityid The provider's entity ID in the format: protocol://host:port/deploy_uri
      For example, http://happy.red.sun.com:80/openfm
      standard_metadata Path to, and name of, the standard metadata XML file
      extended_metadata Path to, and name of, the extended metadata XML file
      idpMetaAlias Specify a metaAlias for the identity provider being created.
      idpSCertAlias Specify a signing certificate alias for the identity provider being created.
      cot_name The name of the circle into which the files are being imported; in this case, sampleidffcot.
      metadata_spec Either idff or saml2; in this case, idff.

    9. Run the following command to import the new metadata files into the defined circle:

      famadm import-entity -u amadmin -f admin_password_file_name -m standard_metadata -x extended_metadata -t cot_name -c metadata_spec

      where

      standard_metadata Path to, and name of, the standard metadata XML file
      extended_metadata Path to, and name of, the extended metadata XML file
      cot_name The name of the circle into which the files are being imported; in this case, sampleidffcot.
      metadata_spec Either idff or saml2; in this case, idff.

    10. Copy the standard metadata file from the service provider (created during the service provider procedure documented in the next step) to the /tmp directory on this machine.

      See On the service provider machine below.

    11. Run the following command to import the standard metadata file for the service provider into the defined circle:

      famadm import-entity -u amadmin -f admin_password_file_name -m standard_metadata -t cot_name -c metadata_spec

      12. where

      standard_metadata Path to, and name of, the standard metadata XML file
      cot_name The name of the circle into which the files are being imported; in this case, sampleidffcot.
      metadata_spec Either idff or saml2; in this case, idff.

    12. Restart the web container.

  2. On the service provider machine:

    1. Run the following command to delete the service provider:

      famadm delete-entity -y sp_entityid -u amadmin -f admin_password_file_name -c metadata_spec

    2. Run the following command to delete the remote identity provider:

      famadm delete-entity -y idp_entityid -u amadmin -f admin_password_file_name -c metadata_spec

    3. Run the following command to create new standard and extended metadata files for the service provider:

      famadm create-metadata-templ -u amadmin -f admin_password_file_name -y sp_entityid -m standard_metadata -x extended_metadata -s spMetaAlias -a spSCertAlias -c metadata_spec

    4. Run the following command to import the new metadata files into the defined circle:

      famadm import-entity -u amadmin -f admin_password_file_name -m standard_metadata -x extended_metadata -t cot_name -c metadata_spec

    5. Copy the standard metadata file from the identity provider (created during the identity provider procedure documented in the previous step) to the /tmp directory on this machine.

      See On the identity provider machine below.

    6. Run the following command to import the new standard metadata file for the identity provider into the defined entity:

      famadm import-entity -u amadmin -f admin_password_file_name -m standard_metadata -t cot_name -c metadata_spec

    7. Edit the com.sun.identity.liberty.ws.wsc.certalias property in FederationConfig.properties to reflect the correct certificate alias.

      The certificate alias will be used to generate X509 tokens for the web service client.

    8. Restart the web container.