Configuring Microsoft ADFS for Oracle Fusion Expenses Mobile Single Sign-On

Size: px

Start display at page:

Download "Configuring Microsoft ADFS for Oracle Fusion Expenses Mobile Single Sign-On"

Julian Hutchinson
5 years ago
Views:

1 Configuring Microsoft ADFS for Oracle Fusion Expenses Mobile Single Sign-On To enable single sign-on for Fusion Expenses mobile application, you must perform the following steps on your ADFS server. The setup is performed to configure the ADFS server to generate a SAML assertion that is accepted by the Fusion cloud server. After you perform the following steps, you must notify Cloud Operations by logging a service request to complete the necessary steps on your cloud servers. Prerequisite Your cloud server is enabled for single sign-on for your Fusion Cloud desktop applications and you have verified that single sign-on is working correctly. Setup Steps The STS must be configured to accept a token request containing the following from the mobile Expenses application and provide a response. Token type is SAML 1.0 or above Key Type is Bearer Applies to a specific end point reference The setup steps are as follows: 1. Verify that the endpoint for SAML assertion service (UsernameMixed) is enabled. This endpoint is for UsernameToken with transport protection (SSL). Oracle Corporation Page 1

ADFS -> Service -> Endponts 2. Register the Relying Party Trust for expenses mobile service (https://<financials domain>/finexmsharedcommon/expensemobileservice).

2 ADFS -> Service -> Endponts 2. Register the Relying Party Trust for expenses mobile service ( domain>/finexmsharedcommon/expensemobileservice). Your financials domain name can be obtained from the URL that you see on the browser when you access the Expenses work area. Navigate to Trust Relationship and right click. Select Add Relying Party Trust. Under Select Data Source, select the option Enter data about relying party manually. Under Choose Profile, select ADFS 2.0 Profile. Under Configure Identifiers, enter Relying party trust identifier as follows: e. Click Add. The identifier is constructed as follows: o o Your financials domain name can be obtained from the URL that you see on the browser when you access the Expenses work area. Port number must be 443. For example, the URL can be as follows. Under Choose Issuance Authorization Rules, select the option Permit all users to access this relying party. Oracle Corporation Page 2

3 Screenshot for Step 2 are given below. Step 2 - ADFS -> Relying Party Trust -> Add Relying Party Trust Oracle Corporation Page 3

4 Step 2 - Relying Party Trust Wizard Oracle Corporation Page 4

5 Step 2 - Relying Party Trust -> Select Data Source Oracle Corporation Page 5

6 Step 2 Relying Party Trust Display Name Oracle Corporation Page 6

7 Step 2 Choose Profile Oracle Corporation Page 7

8 Step 2 Configure URL Oracle Corporation Page 8

9 Step 2 Configure Identifiers -> (Enter URL) Oracle Corporation Page 9

10 Step 2 Configure Identifiers -> Add Oracle Corporation Page 10

11 Step 2 Choose Issuance Authorization Rules Oracle Corporation Page 11

12 Step 2 Ready to add to trust Oracle Corporation Page 12

13 Step 2 Finish 3. Configure the claim rules for the relying party trust. When finishing the relying party trust creation, select Open Claim Rules option to navigate to the Claim Rules popup. o o o Under Select Rule Type, select the option Send LDAP Attribute as Claims. Under Configure Claim Rule, select Attribute Store. Under Configure Claim Rule, map LDAP Attribute Name SAM-Account-Name to outgoing claim type Name ID. Screenshots for Step 3 are shown below. Oracle Corporation Page 13

14 Step 3 Edit Claim Rule Oracle Corporation Page 14

15 Step 3 Choose Rule Type Oracle Corporation Page 15

16 Step 3 Configure Claim Rule Oracle Corporation Page 16

17 Step 3 Newly Created Claim Rule 4. Export the STS token signing certificate o o o Navigate to Service -> Certificates. Select Export. This invokes the export wizard. Choose format as Base-64 encoded X.509 (.CER) Choose the name of the file that you want to export. Oracle Corporation Page 17

18 Step 4 Export certificate Oracle Corporation Page 18

19 Step 4 Export Wizard Oracle Corporation Page 19

20 Step 4 Export File Format Oracle Corporation Page 20

21 Step 4 File Name for Export 5. Log a service request with Oracle Support to upload the exported certificate to Fusion Expenses Cloud. Oracle Corporation Page 21

Microsoft ADFS Configuration

Microsoft ADFS Configuration Side 1 af 12 1 Information 1.1 ADFS KMD Secure ISMS supports ADFS for integration with Microsoft Active Directory by implementing WS-Federation and SAML 2. The integration