How To secure your OSB services (Propagate SAML Token)

To day I would like to share my knowledge, Reading and Finding about

How To Secure a OSB service using SAML Token or What are the Steps to Secure a OSB service using a SAML Token (Also the below steps can be used for SAML token Propagation) :

Now in order to find how to secure OSB  there is a sites / videos that can help us:

• Watch this video for easy understand of how to secure OSB service. This an oracle produced Video. The link provided here is only part 1 out of 3 Parts. As always, youtube provides the links to the relevant videos once you watch the first part. 
• The same can be found in this slide pack.

Before reading this blog further please view / review the above reference artefacts so that you have the basic Knowledge / context.

In order to achieve our goal there are few bits missing in the above referenced artefacts.

In order to secure a OSB service, you will need two product / parts:

1. OWSM  policies. -- this is clearly articulated in the referenced artefacts above.
2. Configuration of the Weblogic Server (For the identity Provider) - This is missed out in the above reference artefact.

Note: This blog is not to pinpoint any documentation defects in the reference artefacts, please consider this blog as an additional reference material.

In order to configure the security provider or authentication provider in weblogic server, please follow this documentation:


Document: Oracle® Fusion Middleware Securing Oracle WebLogic Server 11g Release 1 (10.3.6)
Section Relevant to us would be: Configuring LDAP Authentication Providers

And one last thing that would vary for us from the reference artefacts is that the following OWSM policies need to be used instead of the policies stated in the above referenced artefacts:

oracle/wss10_saml_token_service_policy – Proxy Service

oracle/wss10_saml_token_client_policy – Business Service.

Hope all the above references were of help. Please feel free to leave you comments.

Siteminder sso cookie does not clear once the App is logged out.

The issue:

If you have setup siteminder sso with oracle fusion middleware.
The fusion middleware application comes with Oracle B2B and Worklist application.Once a user login though sso in these application,the logout button dosent work or complets the loop.
We need a way to clear the siteminder sso cookie once the logout button is clicked.
Please suggest a way to make this customization in the apps.


The solution:

The solution seems to be configuring in SiteMinder: configure the logout URL in the app as a SiteMinder logout URL

Steps are as:

1) Find the URL of the logout action in the app (from the docs, by hovering over it, or by tracing the HTTP traffic)
2) Open the SiteMinder Web Agent configuration (either in the SiteMinder console or in the local WebAgent config file) and add a LogOffUri setting to reflect the above URI. Note: this is a URI not a URL. So remove the http://hostname portion.

if you are not the siteminder administrator, You can pass this info to the SiteMinder administrator and they should know exactly what it means.