#codingexercise
Int GetCountUnique (int [] A)
{
if (A == null) return 0;
return A.CountUnique();
}
To complete our post on the Oracle 11G identity access management service, we next look at Identity federation. Identity federation is required when there is a need for single sign on beyond a single internet domain. It consists of federation services that utilizes both AuthN modules and Service provider modules. The language for talking to Identity federation has been SAML which is an industry standard.  SAML is an open framework for sharing security information on the internet through XML documents. SAML provides a standard way to transfer cookie information across multiple internet domains. Thus its a way to implement SSO. A SAML assertion can be used with web services security frameworks such as WS-Security. This identity federation service is also interoperable with CardSpace.  By using proprietary directories or database or SAML assertions with internet directories, it can federate identity. In addition , it offers auditing, logging and monitoring. The OpenSSO implements security token service and supports web services trust language.  Trust in this case, is usually established with WS-Trust and exchanging SOAP/WS-Security messages. Since trust is represented as tokens, there is a service to manage the issuing of tokens. This service issues, renews, cancels and validates security tokens, allows customers to write their own plugins and provides a WS-Trust based API for client and application access. The tokens issued are ones that can be authenticated via username, x.509, SAML and Kerberos.
Next we discuss Entitlement Server which is a fine grained authorization engine that externalizes, simplifies and unifies the entitlement policies. It offers a sophisticated delegated administration model to create modify or report on the entitlement policies.  The administration server is layered above the authorization engine. While the administration server concerns itself with resource management, policy lifecycle, and policy distribution, the authorization engine is the policy framework or decision kernel that works with a publisher subscriber model.
The administration server acts as the policy administration point.
The security modules that implement the PDP communicates with the authorization server and the one that implements the PEP communicates with the authorization engine. The engine may talk to one or more attribute authorities and policy store.
The Adaptive Access Manager provides real time fraud detection, multifactor authentication and unique authentication strengthening.  These are implemented as two modules - one is the authenticator and the other is the risk manager. The Authentication security protects against malware attacks. The risk manager looks at various risk factors simultaneously.
Information Rights management manages the contents produced by the subject. If a user signs into one application and writes one document and signs into another place and writes another,  then they are secured by the IRM. Typically they are sealed and encrypted.
Governance of all of the above services can be facilitated with a common user interface.