Can anyone explain what "multi-tenant" means with respect to OAM and OIF?

Question

Hi,
I noticed that OAM 11gR2 has several additional authentication modules and schemes out-of-the-box for "MT" or multi-tenant. I've actually tried them, but am not clear exactly what their purpose is?
As a test, I configured the FederationMT module and FederationMTScheme to protect a test resource in OAM, and then when I access the resource, I first get a page with one field for username and a "Sign In" button. After I enter a user name, it goes to a form login page and I can log into the OIF IdP, and that's about it. I guess that I don't see what this accomplishes?
If anyone is familiar with this, please advise.
Thanks,
Jim

Answer 1

Hi,
Thanks for the metalink article. I've read that, and I can understand what the article is describing, but I'm not 100% clear how that relates to the configuration parameters in the FederationMTPlugin. The article talks about a mapping file, but I don't see something like that for configuring the TenantDismbiguationPlugin?
The first step in FederationMTScheme plugin is a TenantDisambiguationPlugin, which takes two parameters:
KEY_IDENTITY_STORE_REF
KEY_FEDERATED_TENANTS (a comma-separated list of "some things")
The steps/orchestration for the FederationMTPlugin has:
Initial Step: FedUserAuthenticationPlugin
TenantDisambiguationPlugin OnSuccess: FedAuthenticationPlugin OnFailure: UserIdentificationPlugin
UserIdentificationPlugin OnSuccess: UserAuthenticationPlugin OnFailure: failure
UserAuthenticationPlugin OnSuccess: success OnFailure: failure
FedAuthnRequestPlugin OnSuccess: success OnFailure: FedUserAuthentication
FedUserAuthenticationPlugin OnSuccess: success OnFailure: TenantAmbiguationPlugin
[The OnError results for all steps are failure, so I haven't shown them.]
So, the first step is the FedUserAuthenticationPlugin (AssertionProcessing), and if that fails, the next step is the TenantDisambiguationPlugin.
I guess all of my questions are around what that TenantAmbiguationPlugin does, and how it works?
I'm guessing that what you enter on the 1st webpage, which asks for a Tenant, is matched against the comma-separated list that is in the plugins "KEY_FEDERATED_TENANTS" parameter.
Is that correct?
But:
a) What happens if there is a match of what you entered vs. what's in the "KEY_FEDERATED_TENANTS" list?
b) What happens if there is NOT a match of what you entered vs. what's in the "KEY_FEDERATED_TENANTS" list?
That article you mentioned calls for a mapping file, that maps what is entered (the tenant) to a user identity store, but where is that in the TenantDisambiguationPlugin's parameters? The only other parameter for that plugin is the "KEY_IDENTITY_STORE_REF" parameter.
Having said that, I described the steps and step orchestration in the FederationMTPlugin above. If the TenantDisambiguationPlugin is suppose to somehow map what's entered to a user identity store name, then, with respect to the FederationMTPlugin, is that mapped user identity store used for the UI and UA steps (i.e., as the "KEY_IDENTITY_STORE_REF" for the UI and UA steps)?
Thanks for your help with this. Oracle's documentation certainly merits some improvement :(...
Jim