Oracle Access Manager (OAM) Federation During Single Sign-On The Identity Provider (IdP) Sends The Group Attributes In A Comma Separated Format And Not In Separate SAML Statements Format (Doc ID 2757982.1)

Last updated on MAY 10, 2024

Applies to:

Symptoms

During Single Sign-On The Identity Provider (IDP) Sends The Group Attributes In A Comma Separated Format And Not In Separate SAML Statements Format Causing Authentication to Fail

• Oracle Access Manager (OAM) is the Identity Provider (IdP)
• Weblogic is the Service Provider (SP)
• Integration works fine when groups are passed as separate values as part of SAML assertion
• The issue is only seen when a User belongs to multiple groups and as part of the User Profile

Background

When a User belongs to multiple groups and as part of the User Profile while using Federation, user Attribute needs to be specified
$user.Groups is the Attribute to be specified for the User Profile to have the User Groups to be reflected
Weblogic as the Service Provider (SP) requires the Group attributes in separate SAML statements instead of comma separated

What is being sent in the SAML assertion ...

Cause

My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.