Total Pageviews
Monday, March 21, 2022
OAM 12c as Federation Proxy unable to forward SP request to IDP
Application sending request to SP <----> OAM 12c(as a federation proxy) <----> IDP(forgerock)
issue is when application is sending the request to OAM, it was unable to forward the request to IDP for authentication.
actions we took
1. Run commands to enable OAM as a federation proxy.
2. Integrated OAM with another IDP
3. Run commands to forward requests coming from Application to external IDP.
4. User trying to login to Application and request is going to Federation Proxy(OAM) but it is not being forwarded to External IDP.
5. OAM was not forwarding request to the External IDP, it was on OAM login screen instead of IDP login screen.
Solution:
Issue was IDP authentication scheme(IDPFederationScheme) was not showing up on OAM. We have to run commands to add this scheme.
wlst> domainRuntime()
wlst> listPartnerProfileAuthnMethods("sp-partner-profile", "sp")
You will not see IDPFederationScheme
Make sure it does not list IDPFederationScheme
wlst> addSPPartnerProfileAuthnMethod("sp-partner-profile", "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport", IDPFederationScheme)
wlst> listPartnerProfileAuthnMethods("sp-partner-profile", "sp")
Make sure it now lists IDPFederationScheme
Subscribe to:
Post Comments (Atom)
No comments:
Post a Comment