This documentation is for WSO2 Identity Server 5.1.0 . View documentation for the latest release.

Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

  1. Start the  identity provider IS  and access the Management Console.
  2. Navigate to the Main menu to access the Identity menu. Click Add under Service Providers.
  3. Fill in the Service Provider Name and provide a brief Description of the service provider. For the purposes of this scenario, enter the Service Provider Name as ServiceProviderSP_IS.
  4. Click Register to add the service provider.
  5. Expand the Inbound Authentication and SAML2 Web SSO Configuration sections and click Configure.
  6. Do the following configurations.

    Configurations to be doneDescription

    IssuertravelocitySP

    This must be the same as the value you enter for the Service Provider Entity Id when configuring the identity provider in the service provider IS .

    Assertion Consumer URL­: https://localhost:9443/commonauthThis is the URL to which the browser should be redirected to after the authentication is successful. This is the Assertion Consumer Service (ACS) URL of the service provider. The identity provider redirects the SAML2 response to this URL. However, if the SAML2 request is signed and SAML2 request contains the ACS URL, the Identity Server will honor the ACS URL of the SAML2 request. It should be defined in this format: https://(host-name):(port)/commonauth.
    Use fully qualified username in the NameIDA fully qualified username is basically the username with the user store domain. In short, the username must be in the following format: {user store domain}{user name}.
    Enable Single LogoutWhen single logout is enabled, the identity provider sends logout requests to all service providers. Basically, the identity provider acts according to the single logout profile.
  7. Click Register to save your changes.

...

Tip

Tip: When studying the above configurations, you can identify the Service Provider Entity Id in the following code snippet.

Code Block
languagexml
<property>
	<Name>SPEntityId</Name>
	<Value>travelocitySP</Value>
</property>

Here, travelocitySP must be the same value as the value configured as the Issuer in the identity provider IS.

About certificates: The following is a sample command if the identity provider is WSO2 Identity Server where you can export the public certificate in PEM format.

keytool -exportcert -alias wso2carbon -keypass wso2carbon -keystore wso2carbon.jks -storepass wso2carbon -rfc -file ispublic_crt.pem

Then, you can open the certificate file with a notepad so you see the certificate value. Copy this certificate value and put in the file within the <Certificate> tag.

Please note that above is only if the identity provider is the WSO2 Identity Server. If the identity provider is a third party IDP, then you can get the certificate in PEM format and read the value. You need to copy the entire content of the PEM file and place it between the <Certificate> tags.

Adding the service provider in the service provider IS

...

  1. Create new tenants in the  service provider IS .

    Note

    Note: You cannot provide access to the service provider and identity provider for a specific tenant domain. This is accessible to all the tenants configured.

  2. Open the <TOMCAT_HOME>/webapps/travelocity.com/WEB­INF/classes/travelocity.properties file.

    Expand
    titleClick here to see the full contents of the travelocity.properties file.
    Code Block
    EnableSAMLSSOLogin=true
    EnableOpenIDLogin=true
    EnableSAML2Grant=false
    #This is the URL of the page that is used to choose the login scheme
    #such as SAML SSO or OpenID. This Url will not be processed by the
    #SSOAgentFilter
    LoginUrl=index.jsp
    
    #Url to do send SAMLSSO AuthnRequest
    SAMLSSOUrl=samlsso
    
    #Url to do send SAML2 Grant OAuth2 Request
    SAML2GrantUrl=token
    
    #Url to send OpenID Authentication Request
    OpenIDUrl=openid
    
    #A unique identifier for this SAML 2.0 Service Provider application
    SAML.IssuerID=travelocity.com
    
    #SAML.Request.Query.Param=&tenantDomain=tenant.domain#The URL of the SAML 2.0 Assertion Consumer
    SAML.ConsumerUrl=http://localhost:8080/travelocity.com/home.jsp
    
    #The URL of the SAML 2.0 Identity Provider
    SAML.IdPUrl=https://localhost:9443/samlsso
    
    #This is the attribute name under which the authenticated session information
    #of SAML SSO and OpenID are stored
    SSOAgentSessionBeanName=SSOAgentSessionBean
    
    #Identifier given for the Service Provider for SAML 2.0 attributes
    #exchange
    #SAML.AttributeConsumingServiceIndex=1701087467
    
    #Specify if SingleLogout is enabled/disabled
    SAML.EnableSLO=true
    
    #This is the URL that is used for SLO
    SAML.LogoutUrl=logout
    
    #Specify if SAMLResponse element is signed
    SAML.EnableResponseSigning=false
    
    #Specify if SAMLAssertion element is signed
    SAML.EnableAssertionSigning=false
    
    #Specify if SAMLAssertion element is encrypted
    SAML.EnableAssertionEncryption=false
    
    #Specify if AuthnRequests and LogoutRequests should be signed
    SAML.EnableRequestSigning=false
    
    #Specify if force authentication enabled
    SAML.EnableForceAuthentication=false
    
    #Custom credentials class
    SAML.SSOAgentCredentialImplClass=org.wso2.carbon.identity.sso.agent.saml.SSOAgentKeyStoreCredential
    
    #KeyStore to cryptographic credentials
    #KeyStore=/home/johann/Desktop/wso2is­4.1.0/repository/resources/security/wso2carbon.jks
    
    #Password of the KeyStore for SAML and OpenID
    KeyStorePassword=wso2carbon
    
    #Alias of the IdP's public certificate
    SAML.IdPCertAlias=wso2carbon#Alias of the SP's private key
    SAML.PrivateKeyAlias=wso2carbon
    
    #Private key password to retrieve the private key used to sign
    #AuthnRequest and LogoutRequest messages
    SAML.PrivateKeyPassword=wso2carbon
    
    #OAuth2 token endpoint URL
    SAML.OAuth2TokenEndpoint=https://localhost:9443/oauth2/token
    
    #OAuth2 Client ID
    SAML.OAuth2ClientID=Qn5DQHCYfshxeZh6R9SL1HM2lsMa
    
    #OAuth2 Client Secret
    SAML.OAuth2ClientSecret=cbkAs1gajdwPAMbrSR54hPAIcz0a
    
    #OpenId Provider Url
    OpenID.OpenIdProviderUrl=https://localhost:9443/openid/
    
    #openid.return_to parameter
    OpenID.ReturnToUrl=http://localhost:8080/travelocity.com/home.jsp
    
    #This is the request parameter name under which to find the
    #openid.claimed_id value to send OpenID authentication request
    OpenID.ClaimedIDParameterName=claimed_id
    
    #Custom OpenID AttributesRequestor class
    OpenID.AttributesRequestorImplClass=SampleAttributesRequestor
    
    #Additional request parameters
    #SAML.Request.Query.Param=&forceAuth=true
  3. In the travelocity.properties file, locate and uncomment the following value. Replace the tenant domain (tenant.domain) with your newly created tenant domain.

    Code Block
    #SAML.Request.Query.Param=&tenantDomain=tenant.domain
    Tip

    Tip: You can uncomment values in this file by removing the “#”.

  4. If you made any changes to the port offset, you must ensure that this change is reflected in the port value of the following property.

    Code Block
    SAML.IdPUrl=https://localhost:9443/samlsso
  5. Restart Apache Tomcat and access the travelocity application. You will be able to log in using the identity provider credentials regardless of the tenant domain you are using. Access the travelocity application using the following: http://localhost:8080/travelocity.com/index.jsp 


Panel
titleRelated links

The following links provide additional information that may be relevant when attempting the instructions in this topic.