SAML 2.0 is an XML-based protocol. It uses security tokens containing assertions to pass information about an end-user between a SAML authority and a SAML consumer. A SAML authority is an identity provider (IDP) and a SAML consumer is a service provider (SP).
Enterprise applications that have SAML2 based SSO infrastructures sometimes need to consume OAuth-protected resources through APIs. However, these apps prefer to use the existing trust relationship with the IDP, even if the OAuth authorization server is entirely different from the IDP. The API Manager leverages this trust relationship by exchanging the SAML2.0 token to an OAuth token with the authorization server. It acts as the OAuth authorization server.
The diagram below depicts the above with WSO2 Identity Server (version 4.5.0 onwards) as the IDP.
The steps of the above diagram are explained below:
Step : User initiates a login call to an enterprise application
- As the application is a SAML SP, it redirects the user to the SAML2.0 IDP to log in.
- The user provides credentials at the IDP and is redirected back to the SP with a SAML2.0 token signed by the IDP.
- The SP verifies the token and logs the user to the application.
- The SAML 2.0 token is stored in the user's session by the SP.
- The enterprise application (SP) wants to access an OAuth2 protected API resource through WSO2 API Manager.
- The application makes a request to the API Manager to exchange the SAML2 bearer token for an OAuth2.0 access token.
- The API Manager validates the assertion and returns the access token.
Step : User does API invocations through the API Manager by setting it as an Authorization header with the returned OAuth2 access token.
Let's configure the token exchange.
Configuring the token exchange
Before you begin, make sure you have the following:
- A valid user account in the API Store.
- A valid consumer key and consumer secret. Initially, these keys must be generated through the management console by clicking the Generate link on My Subscriptions page.
- A running API Gateway instance.
- If the Key Manager is on a different server than the API Gateway, change the server URL (host and ports) of the Key Manager accordingly in the
<APIKeyManager><ServerURL>element of the
- A valid SAML2 assertion. You can do this using the Identity Server as the Identity Server can act as a SAML2 SSO IDP. See Configuring SAML2 Single-Sign-On Across Different WSO2 Products in the Identity Server documentation for more information.
We use WSO2 Identity Server 5.0.0 as the IDP to get a SAML token and the API Manager as the OAuth server.
Log in to the API Manager's management console (https://localhost:9443/carbon) using admin/admin credentials and select Add under Identity Providers menu in the Main menu.
- Provide the following values to configure the IDP:
- Under Basic Information
- Identity Provider Name: Enter a unique name for IDP
Identity Provider Public Certificate: The certificate used to sign the SAML assertion. Export the public certificate of WSO2 IS and import it here.
Alternatively, you can create a self-signed certificate and then export it as a .cer file using the following commands:
- Alias: Give the name of the alias if the Identity Provider identifies this token endpoint by an alias. E.g., https://localhost:9443/oauth2/token
Under Federated Authenticators -> SAML2 Web SSO Configuration
Enable SAML2 Web SSO: true
Identity Provider Entity Id: The SAML2 issuer name specified when generating the assertion token, which contains the unique identifier of the IDP. You give this name when configuring the SP.
- Service Provider Entity Id: Issuer name given when configuring the SP
- SSO URL: Enter the IDP's SAML2 Web SSO URL value. E.g., https://localhost:9444/samlsso/ if you have offset the default port, which is 9443.
- Under Basic Information
- Log in to the management console of the Identity Server and select Add under Service Providers menu in the Main menu.
- Choose to edit the service provider that you just registered and select SAML2 Web SSO Configuration.
- Provide the following values to configure the SP:
- Issuer: Give any name
- Assertion Consumer URL: The URL to which the IDP sends the SAML response. E.g., https://localhost:9443/store/jagg/jaggery_acs.jag.
- Enable Response Signing: true
- Enable Assertion Signing: true
- Enable Audience Restriction: true
- Audience: URL of the token API. E.g., https://localhost:9443/oauth2/token.
Let's see how to get a signed SAML2 token (encoded assertion value) when authenticating against a SAML2 IDP. With the authentication request, you pass attributes such as the SAML2 issuer name, token endpoint and the restricted audience. In this guide, we use a command-line client program developed by WSO2 to create the 64-bit, URL-encoded SAML assertion.
- Download the client program from here and unzip the
Execute the following command inside that
SAML2AssertionCreatordirectory. It generates a SAML token.
Here's an example command with the issuer name as TestSP:
You now have a SAML2 assertion.
Execute the following command to get the OAuth Access token. You can generate a consumer key and consumer secret pair by clicking the Generate link on My Subscriptions page of the API Publisher.
Invoking the Token API to generate tokens
- Combine the consumer key and consumer secret keys as
consumer-key:consumer-secret. Encode the combined string using base64 ( Here's an example consumer key and secret combination:
Let's create a SAML2 assertion using the same command-line client that you used in the previous section.
- Download the command-line too from here and extract the ZIP file.
Go to the extracted folder using the command line and execute the following command. We assume that both the client and the API Gateway run on the same server. Therefore, the Token API URL is https://localhost:8243/token.
The arguments are as follows:
- The saml:Issuer (a unique identifier of the identity provider) value
- The saml:Subject -> saml:NameId value
- The value of saml:Subject -> saml:SubjectConfirmation -> saml:SubjectConfirmationData.Recipient
- The fourth argument can take multiple values separated by commas. They are added to the saml:AudienceRestriction element of the token. Each value is added as a saml:Audience element within saml:AudienceRestriction.
- Pointer to the Java Key Store (JKS) file to be used for credentials
- The JKS password
- The alias of the public certificate
- The password of the private key that is used for signing
This commend returns a SAML2 assertion XML string and a base64-URL encoded assertion XML string.
Access the Token API using a REST client such as curl. For example, the following Curl command generates an access token and a refresh token. You can use the refresh token at the time a