SAML 2.0 is an XML-based protocol. It uses security tokens containing assertions to pass information about an end-user between a SAML authority and a SAML consumer. A SAML authority is an identity provider (IDP) and a SAML consumer is a service provider (SP).
Enterprise applications that have SAML2 based SSO infrastructures sometimes need to consume OAuth-protected resources through APIs. However, these apps prefer to use the existing trust relationship with the IDP, even if the OAuth authorization server is entirely different from the IDP. The API Cloud leverages this trust relationship by exchanging the SAML2.0 token to an OAuth token with the authorization server. It acts as the OAuth authorization server.
...
Let's configure the token exchange.
Configuring the token exchange
| Note |
|---|
Before you begin, make sure you have the following:
|
To configure the token, contact WSO2 API Cloud Support via a support request or chat and follow the steps below.
- Provide the following values to configure the IDP:
Under- Basic Information
Identity Provider Public Certificate: The certificate used to sign the SAML assertion. Export the public certificate of WSO2 IS and import it here.
- Alias: Give the name of the alias if the Identity Provider identifies this token endpoint by an alias. E.g., https://keymanager.api.cloud.wso2.com/oauth2/token.
Under Federated Authenticators -> SAML2 Web SSO Configuration
Identity Provider Entity Id: The SAML2 issuer name specified when generating the assertion token, which contains the unique identifier of the IDP
. You give this name when configuring the SP.
- Service Provider Entity Id: Issuer name given when configuring the SP
- SSO URL: Enter the IDP's SAML2 Web SSO URL value. E.g., https://localhost:9444/samlsso/ if you have offset the default port, which is 9443.
Invoking the Token API to generate tokens
...