SlideShare a Scribd company logo
1 of 60
Download to read offline
Extending the Oracle Single Sign On (SSO) Server Kurt Van Meerbeeck AXI NV/BV [email_address] www.axi.be www.axi.nl session 389
Extending Oracle SSO Server ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Extending Oracle SSO Server ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Presenting the case ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Presenting the case Database tier Citrix Farm COM+ servers Fax Brokers Backoffice App ,[object Object],[object Object],Company A Company C
Presenting the case Database tier COM+ servers Private Network Portima Brokers Company A Company n Company B Broker App Broker App Broker App Broker App Third party app (PORTIMA) Authentication using Office ID & suboffice ID ,[object Object],[object Object]
Presenting the case ,[object Object],[object Object],[object Object],[object Object],[object Object]
Presenting the case ,[object Object],LAN Backoffice  user INTERNET broker PORTIMA broker private network internet
Presenting the case ,[object Object],LAN Backoffice  user ,[object Object],[object Object],[object Object],[object Object],PORTIMA broker private network (http) Internet (https) Username+password Office ID/Suboffice ID Portima Authentication server Map portima ID to oracle ID
The challenge ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],internet private LAN
The challenge ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Yeah well ... and I WANT A PORSCHE
Extending Oracle SSO Server ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
A small recap ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
A small recap ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Understanding the SSO Architectuur ,[object Object],[object Object],[object Object],[object Object],PLSQL API in case of Oracle Portal
SSO workflow – not yet authenticated INFRA.axi.be MID.axi.be apache Mod_osso Mod_oc4j Mod_plsql J2ee apache Mod_osso Mod_oc4j Mod_plsql J2ee Oc4j_security oca OID LDAP IASDB http://my.company.com ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
SSO workflow – not yet authenticated INFRA.axi.be MID.axi.be apache Mod_osso Mod_oc4j Mod_plsql J2ee apache Mod_osso Mod_oc4j Mod_plsql J2ee Oc4j_security oca OID LDAP IASDB http://my.company.com NameVirtualHost *:80 <VirtualHost *:80> ServerName my.company.com Port 80 # Include the configuration files  # needed for mod_osso OssoConfigFile /OH/my_comp_osso.conf </VirtualHost> infra.axi.be/pls/orasso/orasso.wwsso_app_admin.ls_login?Site2pstoreToken=<y>  Partner cookie available ? SSO cookie ? -> Generate Redirect to logon page http://infra.axi.be/sso/jsp/login.jsp $OH/sso/policy.properties
SSO workflow – not yet authenticated INFRA.axi.be MID.axi.be apache Mod_osso Mod_oc4j Mod_plsql J2ee apache Mod_osso Mod_oc4j Mod_plsql J2ee Oc4j_security oca OID LDAP IASDB http://my.company.com
SSO workflow – not yet authenticated INFRA.axi.be MID.axi.be apache Mod_osso Mod_oc4j Mod_plsql J2ee apache Mod_osso Mod_oc4j Mod_plsql J2ee Oc4j_security oca OID LDAP IASDB http://my.company.com ,[object Object],[object Object],[object Object],[object Object],Check credentials in LDAP/OID ,[object Object],[object Object],[object Object],[object Object],Generate Partner cookie Generate redirect to the original URL  (sitetoken)
SSO workflow – already authenticated INFRA.axi.be MID.axi.be apache Mod_osso Mod_oc4j Mod_plsql J2ee apache Mod_osso Mod_oc4j Mod_plsql J2ee Oc4j_security oca OID LDAP IASDB http://my.company.com ,[object Object],[object Object],[object Object]
SSO workflow – already authenticated INFRA.axi.be MID.axi.be apache Mod_osso Mod_oc4j Mod_plsql J2ee apache Mod_osso Mod_oc4j Mod_plsql J2ee Oc4j_security oca OID LDAP IASDB http://my.company.com ,[object Object],[object Object],[object Object],[object Object],http://my.other-company.com Redirect to infra.axi.be/pls/orasso/orasso.wwsso_app_admin.ls_login?Site2pstoreToken=<y>  ,[object Object],[object Object],[object Object],[object Object],[object Object],Mod_osso deobfuscates the site-token Redirects to original URL
SSO workflow - recap ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
SSO plugins  ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
SSO plugins  ,[object Object],[object Object],[object Object],[object Object],[object Object]
SSO plugins ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
SSO plugins – object model ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],IPASAuthInterface SSOServerAuth Custom Plugin SSOX509CertAuth SSOKerbeAuth implements extends
SSO plugins – object model ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],IPASAuthInterface SSOServerAuth Custom Plugin SSOX509CertAuth SSOKerbeAuth implements extends
SSO plugins – object model ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],IPASAuthInterface SSOServerAuth Custom Plugin SSOX509CertAuth SSOKerbeAuth implements extends
SSO plugins  ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Extending Oracle SSO Server ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
SSO custom logon screen INFRA.axi.be MID.axi.be apache J2ee SSO PLUGIN OID LDAP IASDB http://my.company.com apache J2ee OID LDAP PLSQL using OWA_UTIL $OH/sso/policy.properties http://infra.axi.be/pls/login_page   Plsql Login_page What site do you want to enter ? ORASSO.WWSSO_UTL.unbake_site2pstore_token -> my.company.com  Generate a different logon screen
SSO custom logon screen apache Plsql Login_proxy INFRA.axi.be MID.axi.be apache J2ee SSO PLUGIN OID LDAP IASDB J2ee OID LDAP Plsql Login_page ,[object Object],[object Object],[object Object],[object Object],[object Object]
SSO custom login ,[object Object],[object Object],[object Object],LAN Backoffice  user ,[object Object],[object Object],[object Object],[object Object],PORTIMA broker private network (http) Internet (https) Username+password Office ID/Suboffice ID Portima Authentication server Map portima ID to oracle ID
Public Key Infrastructure ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Public Key Infrastructure ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Public Key Infrastructure Chain of trust PKI equivalent Root CA Ex. GlobalSign, Verisign United Nations company CA Ex. AXI CA Belgium, Netherlands ... Registration Authority (RA) City hall, police office, court house ,[object Object],[object Object],[object Object],Driver’s license  Passport
Public Key Infrastructure Chain of trust Valid ? (CRL) Example of authenticatie United Nations US Belgium Me and my passport The nice officer at JFK  And his passport
Public Key Infrastructure Chain of trust Valid ? (CRL) Example of authenticatie United Nations US Belgium Flanders region Walloon region If Belgium splits in the Flanders region and Walloon Region I will be screwed if the  United Nations do not recognize them
Public Key Infrastructure - eID ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],SPECIMEN
Public Key Infrastructure - eID ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],From a visual point of view, the information shown will be the same as on the present identity card:
Public Key Infrastructure - eID From an electronic point of view, the data on the chip is the same as the information printed on the card, plus: ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Public Key Infrastructure - eID
Public Key Infrastructure - eID
SSO integration with PKI apache Plsql Login_proxy INFRA.axi.be MID.axi.be apache J2ee SSO OCA OID LDAP IASDB J2ee OID LDAP Plsql Login_page Client certificate (OCA, eID) (private/public key in keystore) Root certificate Government CA Oracle CA Server Certificate Server Certificate Root Certificate Root  Certificate SSL SSL
SSO integration with PKI – SSL terminator apache Plsql Login_proxy INFRA.axi.be MID.axi.be apache J2ee SSO OCA OID LDAP IASDB J2ee OID LDAP Plsql Login_page HTTPS SSL Terminator Accelerator HTTP HTTP OCSP LDAP Download CRL Government CA’s (eID) LDAP Download CRL OCA
[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],SSO integration with PKI – SSL terminator
[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],SSO integration with PKI – SSL terminator
SSO integration with PKI – workflow apache Plsql Login_proxy INFRA.axi.be MID.axi.be apache J2ee SSO OCA OID LDAP IASDB J2ee OID LDAP Plsql Login_page HTTPS SSL Terminator Accelerator HTTP HTTP OCSP LDAP Download CRL Government CA’s (eID) LDAP Download CRL OCA OCA Digital certificate My.company.com Login.company.com ProxyPass /forms/  http://MID.axi.be:7782/forms/ ProxyPass /osso_login_success http://MID.axi.be:7782/osso_login_success ProxyPass /login/ http://INFRA.axi.be:7780/ ProxyPassReverse /forms/  http://MID.axi.be:7782/ ProxyPassReverse /sso/  http://INFRA.axi.be:7780/ ProxyHTMLURLMap  http://INFRA.axi.be:7780 /login <Location /sso/> SSLVerifyClient require RequestHeader set SUBJECT &quot;%{SSL_CLIENT_S_DN}e&quot; </location>
SSO integration with PKI – workflow apache Plsql Login_proxy INFRA.axi.be MID.axi.be apache J2ee SSO OCA OID LDAP IASDB J2ee OID LDAP Plsql Login_page HTTPS SSL Terminator Accelerator HTTP HTTP OCSP LDAP Download CRL Government CA’s (eID) LDAP Download CRL OCA My.company.com Login.company.com Only need to enter SSO password Map certificate subject to SSO username
SSO integration with PKI – workflow apache Plsql Login_proxy INFRA.axi.be MID.axi.be apache J2ee SSO OCA OID LDAP IASDB J2ee OID LDAP Plsql Login_page HTTPS SSL Terminator Accelerator HTTP HTTP OCSP LDAP Download CRL Government CA’s (eID) LDAP Download CRL OCA OCA Digital certificate
SSO custom login ,[object Object],[object Object],[object Object],[object Object],LAN Backoffice  user ,[object Object],[object Object],[object Object],[object Object],PORTIMA broker private network (http) Internet (https) Username+password Office ID/Suboffice ID Portima Authentication server Map portima ID to oracle ID
SSO integration with PKI – workflow apache Plsql Login_proxy INFRA.axi.be MID.axi.be apache J2ee SSO OCA OID LDAP IASDB J2ee OID LDAP Plsql Login_page HTTPS SSL Terminator Accelerator HTTP HTTP OCSP LDAP Download CRL Government CA’s (eID) LDAP Download CRL OCA eID Digital certificate My.company.com Login.company.com ProxyPass /forms/  http://MID.axi.be:7782/forms/ ProxyPass /osso_login_success http://MID.axi.be:7782/osso_login_success ProxyPass /login/ http://INFRA.axi.be:7780/ ProxyPassReverse /forms/  http://MID.axi.be:7782/ ProxyPassReverse /sso/  http://INFRA.axi.be:7780/ ProxyHTMLURLMap  http://INFRA.axi.be:7780 /login <Location /sso/> SSLVerifyClient require RequestHeader set SUBJECT &quot;%{SSL_CLIENT_S_DN}e&quot; </location>
SSO integration with PKI – workflow apache Plsql Login_proxy INFRA.axi.be MID.axi.be apache J2ee SSO OCA OID LDAP IASDB J2ee OID LDAP Plsql Login_page HTTPS SSL Terminator Accelerator HTTP HTTP OCSP LDAP Download CRL Government CA’s (eID) LDAP Download CRL OCA eID Digital certificate My.company.com Login.company.com <Location /sso/> SSLVerifyClient require RequestHeader set SUBJECT &quot;%{SSL_CLIENT_S_DN}e&quot; </location>
SSO custom login ,[object Object],[object Object],[object Object],[object Object],LAN Backoffice  user ,[object Object],[object Object],[object Object],[object Object],PORTIMA broker private network (http) Internet (https) Username+password Office ID/Suboffice ID Portima Authentication server Map portima ID to oracle ID
DIY federated authentication - workflow Plsql Login_page apache Apache 2.x RP Plsql Login_proxy INFRA.axi.be MID.axi.be apache J2ee SSO PLUGIN OID LDAP IASDB J2ee OID LDAP Portima Authentication server My.private-company.com Login.private-company.com Officeid/suboffice password
DIY federated authentication - workflow Plsql Login_page apache Apache 2.x RP Plsql Login_proxy INFRA.axi.be MID.axi.be apache J2ee SSO PLUGIN OID LDAP IASDB J2ee OID LDAP Portima Authentication server My.private-company.com Login.private-company.com Officeid/suboffice password Replaced with SAML v2  Federated Authentication In 2008 (integrated with Oracle SSO)
Architecture HTTP/S HTTP CA LB (linux vips ldirector) INFRA MID CRL HTTP HTTP SSL/RP (apache2) RP (apache2)
Solved problem ... And more ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Questions [email_address]

More Related Content

What's hot

Java EE 7 (Lyon JUG & Alpes JUG - March 2014)
Java EE 7 (Lyon JUG & Alpes JUG  - March 2014)Java EE 7 (Lyon JUG & Alpes JUG  - March 2014)
Java EE 7 (Lyon JUG & Alpes JUG - March 2014)David Delabassee
 
Hacking Oracle From Web Apps 1 9
Hacking Oracle From Web Apps 1 9Hacking Oracle From Web Apps 1 9
Hacking Oracle From Web Apps 1 9sumsid1234
 
GlassFish & Java EE Business Update @ CEJUG
GlassFish & Java EE Business Update @ CEJUGGlassFish & Java EE Business Update @ CEJUG
GlassFish & Java EE Business Update @ CEJUGArun Gupta
 
Building HTML5 WebSocket Apps in Java at JavaOne Latin America 2012
Building HTML5 WebSocket Apps in Java at JavaOne Latin America 2012Building HTML5 WebSocket Apps in Java at JavaOne Latin America 2012
Building HTML5 WebSocket Apps in Java at JavaOne Latin America 2012Arun Gupta
 
SSO With APEX and ADFS the weblogic way
SSO With APEX and ADFS the weblogic waySSO With APEX and ADFS the weblogic way
SSO With APEX and ADFS the weblogic waymakker_nl
 
Spring 3.1: a Walking Tour
Spring 3.1: a Walking TourSpring 3.1: a Walking Tour
Spring 3.1: a Walking TourJoshua Long
 
Running your Java EE 6 applications in the Cloud
Running your Java EE 6 applications in the CloudRunning your Java EE 6 applications in the Cloud
Running your Java EE 6 applications in the CloudArun Gupta
 
JavaOne Shanghai 2013 - Servlet 3.1 (JSR 340)
JavaOne Shanghai 2013 - Servlet 3.1 (JSR 340)JavaOne Shanghai 2013 - Servlet 3.1 (JSR 340)
JavaOne Shanghai 2013 - Servlet 3.1 (JSR 340)Shing Wai Chan
 
Introducing WebLogic 12c OTN Tour 2012
Introducing WebLogic 12c OTN Tour 2012Introducing WebLogic 12c OTN Tour 2012
Introducing WebLogic 12c OTN Tour 2012Bruno Borges
 
Java EE 7 et ensuite pourquoi pas JavaScript sur le serveur!
Java EE 7 et ensuite pourquoi pas JavaScript sur le serveur! Java EE 7 et ensuite pourquoi pas JavaScript sur le serveur!
Java EE 7 et ensuite pourquoi pas JavaScript sur le serveur! David Delabassee
 
SOA OSB suite cluster installation
SOA OSB suite cluster installationSOA OSB suite cluster installation
SOA OSB suite cluster installationRakesh Gujjarlapudi
 
Java API for WebSocket 1.0: Java EE 7 and GlassFish
Java API for WebSocket 1.0: Java EE 7 and GlassFishJava API for WebSocket 1.0: Java EE 7 and GlassFish
Java API for WebSocket 1.0: Java EE 7 and GlassFishArun Gupta
 
Implementing Oracle Identity Management Using External Authentication Plug-In
Implementing Oracle Identity Management Using External Authentication Plug-InImplementing Oracle Identity Management Using External Authentication Plug-In
Implementing Oracle Identity Management Using External Authentication Plug-InDinesh Gupta
 
Oracle SOA enterprise repositories Technical Overview
Oracle SOA enterprise repositories Technical OverviewOracle SOA enterprise repositories Technical Overview
Oracle SOA enterprise repositories Technical OverviewBiswanath Swain
 
Finally, EE Security API JSR 375
Finally, EE Security API JSR 375Finally, EE Security API JSR 375
Finally, EE Security API JSR 375Alex Kosowski
 
Single Sign-On for APEX apps (Important: latest version on edocr!)
Single Sign-On for APEX apps (Important: latest version on edocr!)Single Sign-On for APEX apps (Important: latest version on edocr!)
Single Sign-On for APEX apps (Important: latest version on edocr!)Niels de Bruijn
 

What's hot (19)

Java EE 7 (Lyon JUG & Alpes JUG - March 2014)
Java EE 7 (Lyon JUG & Alpes JUG  - March 2014)Java EE 7 (Lyon JUG & Alpes JUG  - March 2014)
Java EE 7 (Lyon JUG & Alpes JUG - March 2014)
 
Hacking Oracle From Web Apps 1 9
Hacking Oracle From Web Apps 1 9Hacking Oracle From Web Apps 1 9
Hacking Oracle From Web Apps 1 9
 
GlassFish & Java EE Business Update @ CEJUG
GlassFish & Java EE Business Update @ CEJUGGlassFish & Java EE Business Update @ CEJUG
GlassFish & Java EE Business Update @ CEJUG
 
Building HTML5 WebSocket Apps in Java at JavaOne Latin America 2012
Building HTML5 WebSocket Apps in Java at JavaOne Latin America 2012Building HTML5 WebSocket Apps in Java at JavaOne Latin America 2012
Building HTML5 WebSocket Apps in Java at JavaOne Latin America 2012
 
SSO With APEX and ADFS the weblogic way
SSO With APEX and ADFS the weblogic waySSO With APEX and ADFS the weblogic way
SSO With APEX and ADFS the weblogic way
 
Spring 3.1: a Walking Tour
Spring 3.1: a Walking TourSpring 3.1: a Walking Tour
Spring 3.1: a Walking Tour
 
Running your Java EE 6 applications in the Cloud
Running your Java EE 6 applications in the CloudRunning your Java EE 6 applications in the Cloud
Running your Java EE 6 applications in the Cloud
 
JavaOne Shanghai 2013 - Servlet 3.1 (JSR 340)
JavaOne Shanghai 2013 - Servlet 3.1 (JSR 340)JavaOne Shanghai 2013 - Servlet 3.1 (JSR 340)
JavaOne Shanghai 2013 - Servlet 3.1 (JSR 340)
 
Introducing WebLogic 12c OTN Tour 2012
Introducing WebLogic 12c OTN Tour 2012Introducing WebLogic 12c OTN Tour 2012
Introducing WebLogic 12c OTN Tour 2012
 
Java EE 7 et ensuite pourquoi pas JavaScript sur le serveur!
Java EE 7 et ensuite pourquoi pas JavaScript sur le serveur! Java EE 7 et ensuite pourquoi pas JavaScript sur le serveur!
Java EE 7 et ensuite pourquoi pas JavaScript sur le serveur!
 
SOA OSB suite cluster installation
SOA OSB suite cluster installationSOA OSB suite cluster installation
SOA OSB suite cluster installation
 
Saml in cloud
Saml in cloudSaml in cloud
Saml in cloud
 
Java API for WebSocket 1.0: Java EE 7 and GlassFish
Java API for WebSocket 1.0: Java EE 7 and GlassFishJava API for WebSocket 1.0: Java EE 7 and GlassFish
Java API for WebSocket 1.0: Java EE 7 and GlassFish
 
Implementing Oracle Identity Management Using External Authentication Plug-In
Implementing Oracle Identity Management Using External Authentication Plug-InImplementing Oracle Identity Management Using External Authentication Plug-In
Implementing Oracle Identity Management Using External Authentication Plug-In
 
Oracle SOA enterprise repositories Technical Overview
Oracle SOA enterprise repositories Technical OverviewOracle SOA enterprise repositories Technical Overview
Oracle SOA enterprise repositories Technical Overview
 
Java EE 7 overview
Java EE 7 overviewJava EE 7 overview
Java EE 7 overview
 
Finally, EE Security API JSR 375
Finally, EE Security API JSR 375Finally, EE Security API JSR 375
Finally, EE Security API JSR 375
 
Single Sign-On for APEX apps (Important: latest version on edocr!)
Single Sign-On for APEX apps (Important: latest version on edocr!)Single Sign-On for APEX apps (Important: latest version on edocr!)
Single Sign-On for APEX apps (Important: latest version on edocr!)
 
Frans Rosén Keynote at BSides Ahmedabad
Frans Rosén Keynote at BSides AhmedabadFrans Rosén Keynote at BSides Ahmedabad
Frans Rosén Keynote at BSides Ahmedabad
 

Similar to Extending Oracle SSO

Dave Carroll Application Services Salesforce
Dave Carroll Application Services SalesforceDave Carroll Application Services Salesforce
Dave Carroll Application Services Salesforcedeimos
 
SharePoint in the Extranet Joel Oleson
SharePoint in the Extranet Joel OlesonSharePoint in the Extranet Joel Oleson
SharePoint in the Extranet Joel Olesonwebhostingguy
 
Identity in ASP.NET Core
Identity in ASP.NET CoreIdentity in ASP.NET Core
Identity in ASP.NET Coreondrejbalas
 
PHP on Windows and on Azure
PHP on Windows and on AzurePHP on Windows and on Azure
PHP on Windows and on AzureMaarten Balliauw
 
Application Services On The Web Sales Forcecom
Application Services On The Web Sales ForcecomApplication Services On The Web Sales Forcecom
Application Services On The Web Sales ForcecomQConLondon2008
 
CTU June 2011 - Windows Azure App Fabric
CTU June 2011 - Windows Azure App FabricCTU June 2011 - Windows Azure App Fabric
CTU June 2011 - Windows Azure App FabricSpiffy
 
2. Day 2 - Identify and SSO
2. Day 2 -  Identify and SSO2. Day 2 -  Identify and SSO
2. Day 2 - Identify and SSOHuy Pham
 
Claims Based Identity In Share Point 2010
Claims  Based  Identity In  Share Point 2010Claims  Based  Identity In  Share Point 2010
Claims Based Identity In Share Point 2010Steve Sofian
 
Cloud Native Identity with SPIFFE
Cloud Native Identity with SPIFFECloud Native Identity with SPIFFE
Cloud Native Identity with SPIFFEPrabath Siriwardena
 
RoR Workshop - Web applications hacking - Ruby on Rails example
RoR Workshop - Web applications hacking - Ruby on Rails exampleRoR Workshop - Web applications hacking - Ruby on Rails example
RoR Workshop - Web applications hacking - Ruby on Rails exampleRailwaymen
 
Office 365 APIs for your Applications
Office 365 APIs for your ApplicationsOffice 365 APIs for your Applications
Office 365 APIs for your ApplicationsRuhani Arora
 
Workshop KrakYourNet2016 - Web applications hacking Ruby on Rails example
Workshop KrakYourNet2016 - Web applications hacking Ruby on Rails example Workshop KrakYourNet2016 - Web applications hacking Ruby on Rails example
Workshop KrakYourNet2016 - Web applications hacking Ruby on Rails example Anna Klepacka
 
CIS14: Enterprise Identity APIs
CIS14: Enterprise Identity APIsCIS14: Enterprise Identity APIs
CIS14: Enterprise Identity APIsCloudIDSummit
 
SharePoint Fest Chicago 2015 - Anatomy of configuring provider hosted add-in...
SharePoint Fest Chicago 2015  - Anatomy of configuring provider hosted add-in...SharePoint Fest Chicago 2015  - Anatomy of configuring provider hosted add-in...
SharePoint Fest Chicago 2015 - Anatomy of configuring provider hosted add-in...Nik Patel
 
Single Sign-On for APEX applications based on Kerberos (Important: latest ver...
Single Sign-On for APEX applications based on Kerberos (Important: latest ver...Single Sign-On for APEX applications based on Kerberos (Important: latest ver...
Single Sign-On for APEX applications based on Kerberos (Important: latest ver...Niels de Bruijn
 
Building a WiFi Hotspot with NodeJS: Cisco Meraki - ExCap API
Building a WiFi Hotspot with NodeJS: Cisco Meraki - ExCap APIBuilding a WiFi Hotspot with NodeJS: Cisco Meraki - ExCap API
Building a WiFi Hotspot with NodeJS: Cisco Meraki - ExCap APICisco DevNet
 
Configuring kerberos based sso in weblogic
Configuring kerberos based sso in weblogicConfiguring kerberos based sso in weblogic
Configuring kerberos based sso in weblogicHarihara sarma
 
Implementation of ssl injava
Implementation of ssl injavaImplementation of ssl injava
Implementation of ssl injavatanujagrawal
 
Adobe PDF and LiveCycle ES Security
Adobe PDF and LiveCycle ES SecurityAdobe PDF and LiveCycle ES Security
Adobe PDF and LiveCycle ES Securityguest2a5a03
 

Similar to Extending Oracle SSO (20)

Dave Carroll Application Services Salesforce
Dave Carroll Application Services SalesforceDave Carroll Application Services Salesforce
Dave Carroll Application Services Salesforce
 
SharePoint in the Extranet Joel Oleson
SharePoint in the Extranet Joel OlesonSharePoint in the Extranet Joel Oleson
SharePoint in the Extranet Joel Oleson
 
Identity in ASP.NET Core
Identity in ASP.NET CoreIdentity in ASP.NET Core
Identity in ASP.NET Core
 
PHP on Windows and on Azure
PHP on Windows and on AzurePHP on Windows and on Azure
PHP on Windows and on Azure
 
Bh Win 03 Rileybollefer
Bh Win 03 RileybolleferBh Win 03 Rileybollefer
Bh Win 03 Rileybollefer
 
Application Services On The Web Sales Forcecom
Application Services On The Web Sales ForcecomApplication Services On The Web Sales Forcecom
Application Services On The Web Sales Forcecom
 
CTU June 2011 - Windows Azure App Fabric
CTU June 2011 - Windows Azure App FabricCTU June 2011 - Windows Azure App Fabric
CTU June 2011 - Windows Azure App Fabric
 
2. Day 2 - Identify and SSO
2. Day 2 -  Identify and SSO2. Day 2 -  Identify and SSO
2. Day 2 - Identify and SSO
 
Claims Based Identity In Share Point 2010
Claims  Based  Identity In  Share Point 2010Claims  Based  Identity In  Share Point 2010
Claims Based Identity In Share Point 2010
 
Cloud Native Identity with SPIFFE
Cloud Native Identity with SPIFFECloud Native Identity with SPIFFE
Cloud Native Identity with SPIFFE
 
RoR Workshop - Web applications hacking - Ruby on Rails example
RoR Workshop - Web applications hacking - Ruby on Rails exampleRoR Workshop - Web applications hacking - Ruby on Rails example
RoR Workshop - Web applications hacking - Ruby on Rails example
 
Office 365 APIs for your Applications
Office 365 APIs for your ApplicationsOffice 365 APIs for your Applications
Office 365 APIs for your Applications
 
Workshop KrakYourNet2016 - Web applications hacking Ruby on Rails example
Workshop KrakYourNet2016 - Web applications hacking Ruby on Rails example Workshop KrakYourNet2016 - Web applications hacking Ruby on Rails example
Workshop KrakYourNet2016 - Web applications hacking Ruby on Rails example
 
CIS14: Enterprise Identity APIs
CIS14: Enterprise Identity APIsCIS14: Enterprise Identity APIs
CIS14: Enterprise Identity APIs
 
SharePoint Fest Chicago 2015 - Anatomy of configuring provider hosted add-in...
SharePoint Fest Chicago 2015  - Anatomy of configuring provider hosted add-in...SharePoint Fest Chicago 2015  - Anatomy of configuring provider hosted add-in...
SharePoint Fest Chicago 2015 - Anatomy of configuring provider hosted add-in...
 
Single Sign-On for APEX applications based on Kerberos (Important: latest ver...
Single Sign-On for APEX applications based on Kerberos (Important: latest ver...Single Sign-On for APEX applications based on Kerberos (Important: latest ver...
Single Sign-On for APEX applications based on Kerberos (Important: latest ver...
 
Building a WiFi Hotspot with NodeJS: Cisco Meraki - ExCap API
Building a WiFi Hotspot with NodeJS: Cisco Meraki - ExCap APIBuilding a WiFi Hotspot with NodeJS: Cisco Meraki - ExCap API
Building a WiFi Hotspot with NodeJS: Cisco Meraki - ExCap API
 
Configuring kerberos based sso in weblogic
Configuring kerberos based sso in weblogicConfiguring kerberos based sso in weblogic
Configuring kerberos based sso in weblogic
 
Implementation of ssl injava
Implementation of ssl injavaImplementation of ssl injava
Implementation of ssl injava
 
Adobe PDF and LiveCycle ES Security
Adobe PDF and LiveCycle ES SecurityAdobe PDF and LiveCycle ES Security
Adobe PDF and LiveCycle ES Security
 

Recently uploaded

UiPath Studio Web workshop series - Day 1
UiPath Studio Web workshop series  - Day 1UiPath Studio Web workshop series  - Day 1
UiPath Studio Web workshop series - Day 1DianaGray10
 
Webinar: The Art of Prioritizing Your Product Roadmap by AWS Sr PM - Tech
Webinar: The Art of Prioritizing Your Product Roadmap by AWS Sr PM - TechWebinar: The Art of Prioritizing Your Product Roadmap by AWS Sr PM - Tech
Webinar: The Art of Prioritizing Your Product Roadmap by AWS Sr PM - TechProduct School
 
AI Workshops at Computers In Libraries 2024
AI Workshops at Computers In Libraries 2024AI Workshops at Computers In Libraries 2024
AI Workshops at Computers In Libraries 2024Brian Pichman
 
From the origin to the future of Open Source model and business
From the origin to the future of  Open Source model and businessFrom the origin to the future of  Open Source model and business
From the origin to the future of Open Source model and businessFrancesco Corti
 
The Importance of Indoor Air Quality (English)
The Importance of Indoor Air Quality (English)The Importance of Indoor Air Quality (English)
The Importance of Indoor Air Quality (English)IES VE
 
Flow Control | Block Size | ST Min | First Frame
Flow Control | Block Size | ST Min | First FrameFlow Control | Block Size | ST Min | First Frame
Flow Control | Block Size | ST Min | First FrameKapil Thakar
 
UiPath Studio Web workshop series - Day 2
UiPath Studio Web workshop series - Day 2UiPath Studio Web workshop series - Day 2
UiPath Studio Web workshop series - Day 2DianaGray10
 
Scenario Library et REX Discover industry- and role- based scenarios
Scenario Library et REX Discover industry- and role- based scenariosScenario Library et REX Discover industry- and role- based scenarios
Scenario Library et REX Discover industry- and role- based scenariosErol GIRAUDY
 
Where developers are challenged, what developers want and where DevEx is going
Where developers are challenged, what developers want and where DevEx is goingWhere developers are challenged, what developers want and where DevEx is going
Where developers are challenged, what developers want and where DevEx is goingFrancesco Corti
 
2024.03.12 Cost drivers of cultivated meat production.pdf
2024.03.12 Cost drivers of cultivated meat production.pdf2024.03.12 Cost drivers of cultivated meat production.pdf
2024.03.12 Cost drivers of cultivated meat production.pdfThe Good Food Institute
 
Design and Modeling for MySQL SCALE 21X Pasadena, CA Mar 2024
Design and Modeling for MySQL SCALE 21X Pasadena, CA Mar 2024Design and Modeling for MySQL SCALE 21X Pasadena, CA Mar 2024
Design and Modeling for MySQL SCALE 21X Pasadena, CA Mar 2024Alkin Tezuysal
 
CyberSecurity - Computers In Libraries 2024
CyberSecurity - Computers In Libraries 2024CyberSecurity - Computers In Libraries 2024
CyberSecurity - Computers In Libraries 2024Brian Pichman
 
Explore the UiPath Community and ways you can benefit on your journey to auto...
Explore the UiPath Community and ways you can benefit on your journey to auto...Explore the UiPath Community and ways you can benefit on your journey to auto...
Explore the UiPath Community and ways you can benefit on your journey to auto...DianaGray10
 
How to release an Open Source Dataweave Library
How to release an Open Source Dataweave LibraryHow to release an Open Source Dataweave Library
How to release an Open Source Dataweave Libraryshyamraj55
 
The New Cloud World Order Is FinOps (Slideshow)
The New Cloud World Order Is FinOps (Slideshow)The New Cloud World Order Is FinOps (Slideshow)
The New Cloud World Order Is FinOps (Slideshow)codyslingerland1
 
March Patch Tuesday
March Patch TuesdayMarch Patch Tuesday
March Patch TuesdayIvanti
 
LF Energy Webinar - Unveiling OpenEEMeter 4.0
LF Energy Webinar - Unveiling OpenEEMeter 4.0LF Energy Webinar - Unveiling OpenEEMeter 4.0
LF Energy Webinar - Unveiling OpenEEMeter 4.0DanBrown980551
 
Oracle Database 23c Security New Features.pptx
Oracle Database 23c Security New Features.pptxOracle Database 23c Security New Features.pptx
Oracle Database 23c Security New Features.pptxSatishbabu Gunukula
 
My key hands-on projects in Quantum, and QAI
My key hands-on projects in Quantum, and QAIMy key hands-on projects in Quantum, and QAI
My key hands-on projects in Quantum, and QAIVijayananda Mohire
 

Recently uploaded (20)

UiPath Studio Web workshop series - Day 1
UiPath Studio Web workshop series  - Day 1UiPath Studio Web workshop series  - Day 1
UiPath Studio Web workshop series - Day 1
 
Webinar: The Art of Prioritizing Your Product Roadmap by AWS Sr PM - Tech
Webinar: The Art of Prioritizing Your Product Roadmap by AWS Sr PM - TechWebinar: The Art of Prioritizing Your Product Roadmap by AWS Sr PM - Tech
Webinar: The Art of Prioritizing Your Product Roadmap by AWS Sr PM - Tech
 
AI Workshops at Computers In Libraries 2024
AI Workshops at Computers In Libraries 2024AI Workshops at Computers In Libraries 2024
AI Workshops at Computers In Libraries 2024
 
From the origin to the future of Open Source model and business
From the origin to the future of  Open Source model and businessFrom the origin to the future of  Open Source model and business
From the origin to the future of Open Source model and business
 
The Importance of Indoor Air Quality (English)
The Importance of Indoor Air Quality (English)The Importance of Indoor Air Quality (English)
The Importance of Indoor Air Quality (English)
 
Flow Control | Block Size | ST Min | First Frame
Flow Control | Block Size | ST Min | First FrameFlow Control | Block Size | ST Min | First Frame
Flow Control | Block Size | ST Min | First Frame
 
UiPath Studio Web workshop series - Day 2
UiPath Studio Web workshop series - Day 2UiPath Studio Web workshop series - Day 2
UiPath Studio Web workshop series - Day 2
 
Scenario Library et REX Discover industry- and role- based scenarios
Scenario Library et REX Discover industry- and role- based scenariosScenario Library et REX Discover industry- and role- based scenarios
Scenario Library et REX Discover industry- and role- based scenarios
 
Where developers are challenged, what developers want and where DevEx is going
Where developers are challenged, what developers want and where DevEx is goingWhere developers are challenged, what developers want and where DevEx is going
Where developers are challenged, what developers want and where DevEx is going
 
2024.03.12 Cost drivers of cultivated meat production.pdf
2024.03.12 Cost drivers of cultivated meat production.pdf2024.03.12 Cost drivers of cultivated meat production.pdf
2024.03.12 Cost drivers of cultivated meat production.pdf
 
Design and Modeling for MySQL SCALE 21X Pasadena, CA Mar 2024
Design and Modeling for MySQL SCALE 21X Pasadena, CA Mar 2024Design and Modeling for MySQL SCALE 21X Pasadena, CA Mar 2024
Design and Modeling for MySQL SCALE 21X Pasadena, CA Mar 2024
 
CyberSecurity - Computers In Libraries 2024
CyberSecurity - Computers In Libraries 2024CyberSecurity - Computers In Libraries 2024
CyberSecurity - Computers In Libraries 2024
 
Explore the UiPath Community and ways you can benefit on your journey to auto...
Explore the UiPath Community and ways you can benefit on your journey to auto...Explore the UiPath Community and ways you can benefit on your journey to auto...
Explore the UiPath Community and ways you can benefit on your journey to auto...
 
How to release an Open Source Dataweave Library
How to release an Open Source Dataweave LibraryHow to release an Open Source Dataweave Library
How to release an Open Source Dataweave Library
 
The New Cloud World Order Is FinOps (Slideshow)
The New Cloud World Order Is FinOps (Slideshow)The New Cloud World Order Is FinOps (Slideshow)
The New Cloud World Order Is FinOps (Slideshow)
 
March Patch Tuesday
March Patch TuesdayMarch Patch Tuesday
March Patch Tuesday
 
LF Energy Webinar - Unveiling OpenEEMeter 4.0
LF Energy Webinar - Unveiling OpenEEMeter 4.0LF Energy Webinar - Unveiling OpenEEMeter 4.0
LF Energy Webinar - Unveiling OpenEEMeter 4.0
 
SheDev 2024
SheDev 2024SheDev 2024
SheDev 2024
 
Oracle Database 23c Security New Features.pptx
Oracle Database 23c Security New Features.pptxOracle Database 23c Security New Features.pptx
Oracle Database 23c Security New Features.pptx
 
My key hands-on projects in Quantum, and QAI
My key hands-on projects in Quantum, and QAIMy key hands-on projects in Quantum, and QAI
My key hands-on projects in Quantum, and QAI
 

Extending Oracle SSO

  • 1. Extending the Oracle Single Sign On (SSO) Server Kurt Van Meerbeeck AXI NV/BV [email_address] www.axi.be www.axi.nl session 389
  • 2.
  • 3.
  • 4.
  • 5.
  • 6.
  • 7.
  • 8.
  • 9.
  • 10.
  • 11.
  • 12. Yeah well ... and I WANT A PORSCHE
  • 13.
  • 14.
  • 15.
  • 16.
  • 17.
  • 18. SSO workflow – not yet authenticated INFRA.axi.be MID.axi.be apache Mod_osso Mod_oc4j Mod_plsql J2ee apache Mod_osso Mod_oc4j Mod_plsql J2ee Oc4j_security oca OID LDAP IASDB http://my.company.com NameVirtualHost *:80 <VirtualHost *:80> ServerName my.company.com Port 80 # Include the configuration files # needed for mod_osso OssoConfigFile /OH/my_comp_osso.conf </VirtualHost> infra.axi.be/pls/orasso/orasso.wwsso_app_admin.ls_login?Site2pstoreToken=<y> Partner cookie available ? SSO cookie ? -> Generate Redirect to logon page http://infra.axi.be/sso/jsp/login.jsp $OH/sso/policy.properties
  • 19. SSO workflow – not yet authenticated INFRA.axi.be MID.axi.be apache Mod_osso Mod_oc4j Mod_plsql J2ee apache Mod_osso Mod_oc4j Mod_plsql J2ee Oc4j_security oca OID LDAP IASDB http://my.company.com
  • 20.
  • 21.
  • 22.
  • 23.
  • 24.
  • 25.
  • 26.
  • 27.
  • 28.
  • 29.
  • 30.
  • 31.
  • 32. SSO custom logon screen INFRA.axi.be MID.axi.be apache J2ee SSO PLUGIN OID LDAP IASDB http://my.company.com apache J2ee OID LDAP PLSQL using OWA_UTIL $OH/sso/policy.properties http://infra.axi.be/pls/login_page Plsql Login_page What site do you want to enter ? ORASSO.WWSSO_UTL.unbake_site2pstore_token -> my.company.com Generate a different logon screen
  • 33.
  • 34.
  • 35.
  • 36.
  • 37.
  • 38. Public Key Infrastructure Chain of trust Valid ? (CRL) Example of authenticatie United Nations US Belgium Me and my passport The nice officer at JFK And his passport
  • 39. Public Key Infrastructure Chain of trust Valid ? (CRL) Example of authenticatie United Nations US Belgium Flanders region Walloon region If Belgium splits in the Flanders region and Walloon Region I will be screwed if the United Nations do not recognize them
  • 40.
  • 41.
  • 42.
  • 45. SSO integration with PKI apache Plsql Login_proxy INFRA.axi.be MID.axi.be apache J2ee SSO OCA OID LDAP IASDB J2ee OID LDAP Plsql Login_page Client certificate (OCA, eID) (private/public key in keystore) Root certificate Government CA Oracle CA Server Certificate Server Certificate Root Certificate Root Certificate SSL SSL
  • 46. SSO integration with PKI – SSL terminator apache Plsql Login_proxy INFRA.axi.be MID.axi.be apache J2ee SSO OCA OID LDAP IASDB J2ee OID LDAP Plsql Login_page HTTPS SSL Terminator Accelerator HTTP HTTP OCSP LDAP Download CRL Government CA’s (eID) LDAP Download CRL OCA
  • 47.
  • 48.
  • 49. SSO integration with PKI – workflow apache Plsql Login_proxy INFRA.axi.be MID.axi.be apache J2ee SSO OCA OID LDAP IASDB J2ee OID LDAP Plsql Login_page HTTPS SSL Terminator Accelerator HTTP HTTP OCSP LDAP Download CRL Government CA’s (eID) LDAP Download CRL OCA OCA Digital certificate My.company.com Login.company.com ProxyPass /forms/ http://MID.axi.be:7782/forms/ ProxyPass /osso_login_success http://MID.axi.be:7782/osso_login_success ProxyPass /login/ http://INFRA.axi.be:7780/ ProxyPassReverse /forms/ http://MID.axi.be:7782/ ProxyPassReverse /sso/ http://INFRA.axi.be:7780/ ProxyHTMLURLMap http://INFRA.axi.be:7780 /login <Location /sso/> SSLVerifyClient require RequestHeader set SUBJECT &quot;%{SSL_CLIENT_S_DN}e&quot; </location>
  • 50. SSO integration with PKI – workflow apache Plsql Login_proxy INFRA.axi.be MID.axi.be apache J2ee SSO OCA OID LDAP IASDB J2ee OID LDAP Plsql Login_page HTTPS SSL Terminator Accelerator HTTP HTTP OCSP LDAP Download CRL Government CA’s (eID) LDAP Download CRL OCA My.company.com Login.company.com Only need to enter SSO password Map certificate subject to SSO username
  • 51. SSO integration with PKI – workflow apache Plsql Login_proxy INFRA.axi.be MID.axi.be apache J2ee SSO OCA OID LDAP IASDB J2ee OID LDAP Plsql Login_page HTTPS SSL Terminator Accelerator HTTP HTTP OCSP LDAP Download CRL Government CA’s (eID) LDAP Download CRL OCA OCA Digital certificate
  • 52.
  • 53. SSO integration with PKI – workflow apache Plsql Login_proxy INFRA.axi.be MID.axi.be apache J2ee SSO OCA OID LDAP IASDB J2ee OID LDAP Plsql Login_page HTTPS SSL Terminator Accelerator HTTP HTTP OCSP LDAP Download CRL Government CA’s (eID) LDAP Download CRL OCA eID Digital certificate My.company.com Login.company.com ProxyPass /forms/ http://MID.axi.be:7782/forms/ ProxyPass /osso_login_success http://MID.axi.be:7782/osso_login_success ProxyPass /login/ http://INFRA.axi.be:7780/ ProxyPassReverse /forms/ http://MID.axi.be:7782/ ProxyPassReverse /sso/ http://INFRA.axi.be:7780/ ProxyHTMLURLMap http://INFRA.axi.be:7780 /login <Location /sso/> SSLVerifyClient require RequestHeader set SUBJECT &quot;%{SSL_CLIENT_S_DN}e&quot; </location>
  • 54. SSO integration with PKI – workflow apache Plsql Login_proxy INFRA.axi.be MID.axi.be apache J2ee SSO OCA OID LDAP IASDB J2ee OID LDAP Plsql Login_page HTTPS SSL Terminator Accelerator HTTP HTTP OCSP LDAP Download CRL Government CA’s (eID) LDAP Download CRL OCA eID Digital certificate My.company.com Login.company.com <Location /sso/> SSLVerifyClient require RequestHeader set SUBJECT &quot;%{SSL_CLIENT_S_DN}e&quot; </location>
  • 55.
  • 56. DIY federated authentication - workflow Plsql Login_page apache Apache 2.x RP Plsql Login_proxy INFRA.axi.be MID.axi.be apache J2ee SSO PLUGIN OID LDAP IASDB J2ee OID LDAP Portima Authentication server My.private-company.com Login.private-company.com Officeid/suboffice password
  • 57. DIY federated authentication - workflow Plsql Login_page apache Apache 2.x RP Plsql Login_proxy INFRA.axi.be MID.axi.be apache J2ee SSO PLUGIN OID LDAP IASDB J2ee OID LDAP Portima Authentication server My.private-company.com Login.private-company.com Officeid/suboffice password Replaced with SAML v2 Federated Authentication In 2008 (integrated with Oracle SSO)
  • 58. Architecture HTTP/S HTTP CA LB (linux vips ldirector) INFRA MID CRL HTTP HTTP SSL/RP (apache2) RP (apache2)
  • 59.