This documentation is for WSO2 Stratos 2.0.0. View the latest Apache Stratos documentation.
Configuring identity.xml - Stratos 2.0.0 - WSO2 Documentation
||
Skip to end of metadata
Go to start of metadata

Users can change the default configurations by editing the <PRODUCT_HOME>/repository/conf/identity.xml file using the information given below.

Click on the table and use the left and right arrow keys to scroll horizontally. 

XML Elements 

XML elementAttributeDescriptionData typeDefault valueMandatory/OptionalSample
<Server>      
 xmlns     
_<JDBCPersistenceManager> Identity related data source configuration.    
__<DataSource>      
____<Name> Include a data source name (jndiConfigName) from the set of data sources defined in master-datasources.xml.StringN/AMandatory<Name>jdbc/WSO2CarbonDB</Name>
___<SkipDBSchemaCreation> If the identity database is created from another place and if it is required to skip schema initialization during the server start up, set the property to "true".BooleanFALSEOptional<SkipDBSchemaCreation>false</SkipDBSchemaCreation>
_<OpenID> OpenID related configurations.    
__<OpenIDServerUrl> This is the URL that the OpenID server (servlet) is running in.StringN/AMandatory<OpenIDServerUrl>https://localhost:9443/openidserver</OpenIDServerUrl>
__<OpenIDUserPattern> URL of the pattern that can be configured for the user's OpenID.StringN/AMandatory<OpenIDUserPattern>https://localhost:9443/openid/</OpenIDUserPattern>
__<OpenIDSkipUserConsent> Set to false if the users must be prompted for approval.BooleanFALSEOptional<OpenIDSkipUserConsent>false</OpenIDSkipUserConsent>
__<OpenIDRememberMeExpiry> Expiry time of the OpenID RememberMe token in minutes.Int0 MinutesOptional<OpenIDRememberMeExpiry>7200</OpenIDRememberMeExpiry>
__<UseMultifactorAuthentication> Multifactor authentication configuration.BooleanFALSEOptional<UseMultifactorAuthentication>false</UseMultifactorAuthentication>
__<DisableOpenIDDumbMode> To enable or disable OpenID dumb mode.BooleanFALSEOptional<DisableOpenIDDumbMode>false</DisableOpenIDDumbMode>
__<SessionTimeout> OpenID session timeout in seconds.Int36000 SecondsOptional<SessionTimeout>36000</SessionTimeout>
__<AcceptSAMLSSOLogin> Skips authentication if the valid SAML2 Web SSO browser session is available.BooleanFALSEOptional<AcceptSAMLSSOLogin>false</AcceptSAMLSSOLogin>
__<ClaimsRetrieverImplClass> User claim retrieving module for OpenID.   <ClaimsRetrieverImplClass>org.wso2.carbon.identity.provider.openid.claims.DefaultClaimsRetriever</ClaimsRetrieverImplClass>
_<OAuth> OAuth related configurations.    
__<AuthorizationCodeDefaultValidityPeriod> Default validity period for Authorization Code in seconds.Int300 SecondsOptional<AuthorizationCodeDefaultValidityPeriod>300</AuthorizationCodeDefaultValidityPeriod>
__<AccessTokenDefaultValidityPeriod> Default validity period for Access Token in seconds.Int3600 SecondsOptional<AccessTokenDefaultValidityPeriod>3600</AccessTokenDefaultValidityPeriod>
__<TimestampSkew> Timestamp skew in seconds.Int300 SecondsOptional<TimestampSkew>300</TimestampSkew>
__<EnableOAuthCache> Enable OAuth caching. This cache has the replication support.BooleanTRUEOptional<EnableOAuthCache>true</EnableOAuthCache>
__<TokenPersistencePreprocessor> Configure the security measures needed to be done prior to storing the token in the database, such as hashing, encrypting, etc.Stringorg.wso2.carbon.identity.oauth.preprocessor.PlainTokenPersistencePreprocessorOptional<TokenPersistencePreprocessor>org.wso2.carbon.identity.oauth.preprocessor.PlainTextTokenPersistencePreprocessor</TokenPersistencePreprocessor>
__<SupportedResponseTypes> Supported OAuth2.0 respose types.
String values with Comma separated

token, code
Optional<SupportedResponseTypes>token,code</SupportedResponseTypes>
__<SupportedGrantTypes> Supported OAuth2.0 grant types.String values with Comma separatedauthorization_code,password,refresh_token,client_credentials,urn:ietf:params:oauth:grant-type:saml2-bearerOptional<SupportedGrantTypes>authorization_code,password,refresh_token,client_credentials,urn:ietf:params:oauth:grant-type:saml2-bearer</SupportedGrantTypes>
__<OAuthCallbackHandlers>      
____<OAuthCallbackHandler> OAuth callback handler module class name.StringN/AMandatory<OAuthCallbackHandler class="org.wso2.carbon.identity.oauth.callback.DefaultCallbackHandler"/>
__<EnableAssertions> Assertions can be used to embed parameters into the access token.    
______<UserName> This enables you to add the user name as an additional parameter if you require it.BooleanFALSEOptional<UserName>false</UserName>
__<EnableAccessTokenPartitioning> This should be set to true when using multiple user stores and keys should be saved into different tables according to the user store. By default, all the application keys are saved into the same table. UserName Assertion should be 'true' to use this.BooleanFALSEOptional<EnableAccessTokenPartitioning>false</EnableAccessTokenPartitioning>
__<AccessTokenPartitioningDomains> This includes the user store domain names and mapping to the new table name. E.g., if you provide 'A:foo.com', foo.com should be the user store domain name and 'A' represents the relavant mapping of the token store table, i.e., tokens will be added to a table called IDN_OAUTH2_ACCESS_TOKEN_A.String values with Comma separatedN/AOptional 
__<AuthorizationContextTokenGeneration>      
_____<Enabled> 
This mentions whether token generation is enabled or not.
BooleanFALSEOptional<Enabled>false</Enabled>
_____<TokenGeneratorImplClass> Token generation class name.Stringorg.wso2.carbon.identity.oauth2.token.JWTTokenGeneratorOptional<TokenGeneratorImplClass>org.wso2.carbon.identity.oauth2.authcontext.JWTTokenGenerator</TokenGeneratorImplClass>
_____<ClaimsRetrieverImplClass> Claim retrieving class name for generating a token. org.wso2.carbon.identity.oauth2.token.DefaultClaimsRetrieverOptional<ClaimsRetrieverImplClass>org.wso2.carbon.identity.oauth2.authcontext.DefaultClaimsRetriever</ClaimsRetrieverImplClass><AuthorizationContextTTL>15</AuthorizationContextTTL>
_____<ConsumerDialectURI> Claim Dialect URI that is used for claim retrieving. http://wso2.org/claimsOptional<ConsumerDialectURI>http://wso2.org/claims</ConsumerDialectURI>
_____<SignatureAlgorithm> Signature algorithm used for sign the token. SHA256withRSAOptional<SignatureAlgorithm>SHA256withRSA</SignatureAlgorithm>
_____<AuthorizationContextTTL> Token time to live value.Long15 MinutesOptional<AuthorizationContextTTL>15</AuthorizationContextTTL>
__<SAML2Grant> Configuration related to SAML2 Grant type.    
__<OpenIDConnect>      
_____<IDTokenBuilder> IDToken generator implementation class name.Stringorg.wso2.carbon.identity.openidconnect.DefaultIDTokenBuilderOptional<IDTokenBuilder>org.wso2.carbon.identity.openidconnect.DefaultIDTokenBuilder</IDTokenBuilder>
_____<IDTokenIssuerID> The value of TokenIssuerID of the IDToken. This is a unique value and should be changed according to the deployment values.StringOIDCAuthzServerOptional<IDTokenIssuerID>https://localhost:9443/oauth2endpoints/token</IDTokenIssuerID>
_____<IDTokenSubjectClaim> This is the claim used as the subject of the IDToken. You can use
different claims such
as http://wso2.org/claims/emailaddress.
Stringhttp://wso2.org/claims/fullnameOptional<IDTokenSubjectClaim>http://wso2.org/claims/givenname</IDTokenSubjectClaim>
_____<IDTokenCustomClaimsCallBackHandler> Claim callback implementation class name. This is used to return custom claims with the IDToken.Stringorg.wso2.carbon.identity.openidconnect.SAMLAssertionClaimsCallbackOptional<IDTokenCustomClaimsCallBackHandler>org.wso2.carbon.identity.openidconnect.SAMLAssertionClaimsCallback</IDTokenCustomClaimsCallBackHandler>
_____<IDTokenExpiration> The expiration value of the IDToken in seconds.Int300 SecondsOptional<IDTokenExpiration>3600</IDTokenExpiration>
_____<UserInfoEndpointClaimDialect> Defines which claim dialect should be returned from the User Endpoint.Stringhttp://wso2.org/claims/fullnameOptional<UserInfoEndpointClaimDialect>http://wso2.org/claims</UserInfoEndpointClaimDialect>
_____<UserInfoEndpointClaimRetriever> Defines the implemenation name of the class which builds the claims for the user info endpoint's response.Stringorg.wso2.carbon.identity.oauth.endpoint.user.impl.UserInfoUserStoreClaimRetrieverOptional<UserInfoEndpointClaimRetriever>org.wso2.carbon.identity.oauth.endpoint.user.impl.UserInfoUserStoreClaimRetriever</UserInfoEndpointClaimRetriever>
_____<UserInfoEndpointRequestValidator> Implemenation name of the class that validates the user info request against the specification.Stringorg.wso2.carbon.identity.oauth.endpoint.user.impl.UserInforRequestDefaultValidatorOptional<UserInfoEndpointRequestValidator>org.wso2.carbon.identity.oauth.endpoint.user.impl.UserInforRequestDefaultValidator</UserInfoEndpointRequestValidator>
_____<UserInfoEndpointAccessTokenValidator> Implementation name of the class that validates the access token.Stringorg.wso2.carbon.identity.oauth.endpoint.user.impl.UserInfoISAccessTokenValidatorOptional<UserInfoEndpointAccessTokenValidator>org.wso2.carbon.identity.oauth.endpoint.user.impl.UserInfoISAccessTokenValidator</UserInfoEndpointAccessTokenValidator>
_____<UserInfoEndpointResponseBuilder> Implementation name of the class that builds the user info request.Stringorg.wso2.carbon.identity.oauth.endpoint.user.impl.UserInfoJSONResponseBuilderOptional<UserInfoEndpointResponseBuilder>org.wso2.carbon.identity.oauth.endpoint.user.impl.UserInfoJSONResponseBuilder</UserInfoEndpointResponseBuilder>
_____<SkipUserConsent> Set to false if the users must be prompted for approval.BooleanFALSEOptional<SkipUserConsent>false</SkipUserConsent>
__<MultifactorAuthentication>      
___<XMPPSettings> XMPP setting for multifactor authentication.    
____<XMPPConfig>      
______<XMPPProvider> XMPP provider name.StringN/AMandatory<XMPPProvider>gtalk</XMPPProvider>
______<XMPPServer> XMPP server name.StringN/AMandatory<XMPPServer>talk.google.com</XMPPServer>
______<XMPPPort> XMPP server's port.IntN/AMandatory<XMPPPort>5222</XMPPPort>
______<XMPPExt> XMPP domain.StringN/AMandatory<XMPPExt>gmail.com</XMPPExt>
______<XMPPUserName> User name for login to XMPP server.StringN/AMandatory<XMPPUserName>multifactor1@gmail.com</XMPPUserName>
______<XMPPPassword> Password for login to XMPP server.StringN/AMandatory<XMPPPassword>wso2carbon</XMPPPassword>
__<SSOService>      
______<IdentityProviderURL> Unique identifier for IDP. This would be passed as Issuer in SAML2 response.StringN/AMandatory<IdentityProviderURL>https://localhost:9443/samlsso</IdentityProviderURL>
______<SingleLogoutRetryCount> Number of retries that must be done if a single logout request is not received from the SP.Int5Optional<SingleLogoutRetryCount>5</SingleLogoutRetryCount>
______<SingleLogoutRetryInterval> Interval between two re-tries.Int60 SecondsOptional<SingleLogoutRetryInterval>60000</SingleLogoutRetryInterval>
______<TenantPartitioningEnabled> This would add the tenant domain as parameter into the ACS URL.BooleanFALSEOptional<TenantPartitioningEnabled>false</TenantPartitioningEnabled>
______<SessionTimeout> Remember me session timeout in seconds.Int36000 SecondsOptional<SessionTimeout>36000</SessionTimeout>
______<AttributesClaimDialect> Claim Dialect URI that is used for claim retrieving.String
http://wso2.org/claims
Optional<AttributesClaimDialect>http://wso2.org/claims</AttributesClaimDialect>
______<AcceptOpenIDLogin> Skips authentication if the valid OpenID login session is available.BooleanFALSEOptional<AcceptOpenIDLogin>false</AcceptOpenIDLogin>
______<ClaimsRetrieverImplClass> Claim retrieving class name for generating a token.StringN/AMandatory<ClaimsRetrieverImplClass>org.wso2.carbon.identity.sso.saml.builders.claims.DefaultClaimsRetriever</ClaimsRetrieverImplClass>
______<SAMLResponseValidityPeriod> SAML Token validity period in minutes.Int5 MinutesOptional<SAMLResponseValidityPeriod>5</SAMLResponseValidityPeriod>
______<UseAuthenticatedUserDomainCrypto> When set to true, this is useful in tenant mode setup with older versions of API Manager. This indicates that the SAML2 SSO SAML Response must be signed using the authenticated user's tenant keystore.BooleanFALSE  
__<EntitlementSettings>      
____<ThirftBasedEntitlementConfig> Thrift transport configurations for entitlement service.    
______<EnableThriftService> Enable thrift transport.BooleanFALSEOptional<EnableThriftService>true</EnableThriftService>
_______<ReceivePort> Thrift listening port.IntN/AMandatory<ReceivePort>${Ports.ThriftEntitlementReceivePort}</ReceivePort>
_______<ClientTimeout> Thrift session time out in seconds.IntN/AMandatory<ClientTimeout>10000</ClientTimeout>
_______<KeyStore> Thrift key store configurations used for SSL.    
__________<Location> Key store locationStringN/AMandatory<Location>${carbon.home}/repository/resources/security/wso2carbon.jks</Location>
___________<Password> Key store passwordStringN/AMandatory<Password>wso2carbon</Password>
__<SCIMAuthenticators>      
____<Authenticator> Defines implementations of SCIM authenticator.Stringorg.wso2.carbon.identity.scim.provider.auth.BasicAuthHandler and org.wso2.carbon.identity.scim.provider.auth.OAuthHandlerOptionalAuthenticator class="org.wso2.carbon.identity.scim.provider.auth.BasicAuthHandler">
______<Property> Configuration properties of each autenticator implementation.StringN/AOptional<Property name="Priority">5</Property>

  • No labels