This documentation is for WSO2 Identity Server 5.5.0 . View documentation for the latest release.

All docs This doc

Versions Compared


  • This line was added.
  • This line was removed.
  • Formatting was changed.


  1. Set up the playground sample. For instructions on how to set up the playground sample, see Basic Client Profile with Playground.
  2. Follow the steps below to configure a public certificate for the service provider:
    1. Execute the following command from the <IS_HOME>/repository/resources/security directory to create a new keystore:

      Code Block
      keytool -genkey -alias wso2carbon -keyalg RSA -keysize 2048 -keystore testkeystore.jks -dname "CN=*,OU=test,O=test,L=MPL,ST=MPL,C=FR" -storepass wso2carbon -keypass wso2carbon -validity 10950
    2. Execute the following command to export the public key of the new keystore to a file, named with the client-id of the OAuth application.

      Code Block
      	keytool -export -alias wso2carbon -file testPublicCert.crt -keystore testkeystore.jks

      This prompts for the keystore password.

    3. Enter wso2carbon as the password. 

    4. Execute the following command to retrieve the certificate in X509 format:

      Code Block
      keytool -printcert -rfc -file testPublicCert.crt

      You will see the public certificate in X509 format on the terminal. 

    5. Copy the content of the certificate.

    6.  On the Management Console, go to Service Providers -> List, and Edit the service provider that you created when setting up the playground sample.
    7. Paste the certificate content that you copied as the Application Certificate of the service provider.
    8.  Click Update.
  3. Follow the steps below to configure claims:
    1. Add two new external claims as follows for the dialect. For detailed instructions on how to add a new claim mapping to a claim dialect, see Adding Claim Mapping.


      Here, customClaim1 and customClaim2 are selected as claim URIs because those are not configured as requested claims in the OIDC scope. For the purpose of testing, these claims are mapped to existing and local claims. If necessary you can create two new local claims for this purpose.

    2. When you add the claims, be sure to select Support by default if you want the the claims to prompt during user registration. Follow the steps below to set challenge Question1 and challenge Question2 to prompt during user registration:
      1. On the management console, click List under Claims, This displays the Claims screen with the Available claim dialects
      2. Click under Available claim dialects
      3. Edit challengeQuestion1, select Support by default. and then click Update.
      4. Edit challengeQuestion2, select Support by default. and then click Update.
    3. Edit the service provider that you created above, expand Claim Configuration, and then add the following as Requested Claims:

      Note: If a user has already consented once to the requested claims that are configured on the service provider, any further changes/additions to the requested claims will not apply. If you are facing this issue, do one of the following.

      • Mark the claims given above as Mandatory Claims. This will ensure that the user will be prompted once again to provide consent for the newly added/changed claims.
      • Log in to the end-user dashboard, revoke the consent reciept for the application, and then attempt to log in to the application again. Now you will be prompted to provide consent for all requested claims, including the newly added/changed claims. For more information on revoking/accepting user consent, see Configuring consent for services.
    4. Click Update.
  4. Create a new user with the name tom, and enter values for the email, country, challenge Question1 as well as challenge Question 2 in the user profile. For detailed instructions on creating a user and customizing a user's profile, see Configuring Users.
  5. Anchor

     Create a JWT with the following payload and sign(RSA256) it with the private key of the keystore created in step 2. (You can use for this)

    Code Block
      "client_id": "<client-id>",
      "sub": "<client-id>",
      "aud": [
      "claims": {
        "userinfo": {
          "given_name": {
            "essential": true
          "nickname": null,
          "email": {
            "essential": true
          "customClaim2": {
            "essential": true
        "id_token": {
          "gender": null,
          "birthdate": {
            "essential": true
          "customClaim1": {
            "essential": true
      "iss": "<client-id>",
      "exp": 1516786878,
      "iat": 1516783278,
      "jti": "1003"

    This creates a signed request object.