Page Comparison

The authenticationendpoint contains the authentication URLs used in authentication flow. You can either host the authenticationendpoint webapp on the WSO2 Identity Server, or choose to host it on a separate server. You may want to host it separately for the purpose of having custom theming and branding. This section describes how you can host the authentication endpoint on a different server outside the WSO2 Identity Server  (e.g., in a different Tomcat Server). 

Moving the authenticationendpoint from WSO2IS and hosting it on a separate web server

...

1. Download and install WSO2 IS and apache-tomcat into your local machine. Let’s consider IS installation as <IS_HOME> and tomcat installation as <TOMCAT_HOME>

2. Get the sample setup scripts from the following location: https://github.com/ayshsandu/samples/tree/master/is_samples/is_5.3.0/hosting-endpoints.

3. Open <TOMCAT_HOME>/conf/server.xml file and enable the https connector on 8443 port.

   Code Block
   language xml
   <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol" maxThreads="150" SSLEnabled="true" scheme="https" secure="true" clientAuth="want" sslProtocol="TLS" sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2" keystoreFile="$IS_HOME/repository/resources/security/wso2carbon.jks" keystorePass="wso2carbon" truststoreFile="$IS_HOME/repository/resources/security/client-truststore.jks" truststorePass="wso2carbon"/>

   Note

   For this sample, we configured the same keystore and truststore in WSO2IS as the keystore and truststore in tomcat. In an actual environment, you may create a new keystore and truststore for tomcat and point to it. When using separate keystores and truststores, you need to import tomcat keystore’s public cert in to: < IS_HOME>/repository/resources/security/client-truststore.jks and, public cert of < IS_HOME>/repository/resources/security/wso2carbon.jks into tomcat’s truststore

4. Open <TOMCAT_HOME>/bin/catalina.sh and add following JAVA_OPTS.

   Code Block
   language xml
   JAVA_OPTS="$JAVA_OPTS --Djavax.net.ssl.keyStore=$IS_HOME/repository/resources/security/wso2carbon.jks -Djavax.net.ssl.keyStorePassword=wso2carbon" JAVA_OPTS="$JAVA_OPTS -Djavax.net.ssl.trustStore=$IS_HOME/repository/resources/security/client-truststore.jks -Djavax.net.ssl.trustStorePassword=wso2carbon"

5. Run setup-authentication.sh obtained from step 2 and follow the instructions.
6. Once the script is complete, then the authentication endpoint is set up in the given <TOMCAT_HOME>/webapps location.

7. Uncomment following section in <TOMCAT_HOME>/webapps/authenticationendpoint/WEB-INF/web.xml file and point to identity server URLs.

   Code Block
   language xml
   …... <context-param> <param-name>IdentityManagementEndpointContextURL</param-name> <param-value>https://localhost:9443/accountrecoveryendpoint</param-value> </context-param> <context-param> <param-name>AccountRecoveryRESTEndpointURL</param-name> <param-value>https://localhost:9443/t/tenant-domain/api/identity/user/v0.9/</param-value> </context-param> ….. <context-param> <param-name>IdentityServerEndpointContextURL</param-name> <param-value>https://localhost:9443</param-value> </context-param> …...

8. Change the following configuration in <IS_HOME>/repository/conf/identity/application-authentication.xml file.

   Code Block
   language xml
   <AuthenticationEndpointURL>https://localhost:8443/authenticationendpoint/login.do</AuthenticationEndpointURL> <AuthenticationEndpointRetryURL>https://localhost:8443/authenticationendpoint/retry.do</AuthenticationEndpointRetryURL> <AuthenticationEndpointMissingClaimsURL>https://localhost:8443/authenticationendpoint/claims.do</AuthenticationEndpointMissingClaimsURL>

9. Change the following configuration in <IS_HOME>/repository/conf/identity/identity.xml file to point to the authentication endpoint hosted outside the wso2 WSO2 server.

   Code Block
   language xml
   .. <OpenID> ... <OpenIDLoginUrl>https://localhost:8443/authenticationendpoint/openid_login.do</OpenIDLoginUrl> … </OpenID> … <OAuth> …. <OAuth2ConsentPage>https://localhost:8443/authenticationendpoint/oauth2_authz.do</OAuth2ConsentPage> <OAuth2ErrorPage>https://localhost:8443/authenticationendpoint/oauth2_error.do</OAuth2ErrorPage> <OIDCConsentPage>https://localhost:8443/authenticationendpoint/oauth2_consent.do</OIDCConsentPage> <OIDCLogoutConsentPage>https://localhost:8443/authenticationendpoint/oauth2_logout_consent.do</OIDCLogoutConsentPage> <OIDCLogoutPage>https://localhost:8443/authenticationendpoint/oauth2_logout.do</OIDCLogoutPage> …. </OAuth> ... <SSOService> ... <DefaultLogoutEndpoint>https://localhost:8443/authenticationendpoint/samlsso_logout.do</DefaultLogoutEndpoint> <NotificationEndpoint>https://localhost:8443/authenticationendpoint/samlsso_notification.do</NotificationEndpoint> … </SSOService> …. <PassiveSTS> ... <RetryURL>https://localhost:8443/authenticationendpoint/retry.do</RetryUR> ... <PassiveSTS> ….

10. Start both Identity Server and Tomcat and access https://localhost:9443/dashboard. Now you can see that the authentication is redirected to: https://localhost:8443/authenticationendpoint/login.do

    Now let’s take out account recovery endpoint into the external Tomcat server as well.

11. Run setup-accountrecovery.sh obtained from step 2 and follow the instructions.

12. Change the following section in <TOMCAT_HOME>/webapps/authenticationendpoint/WEB-INF/web.xml file and point to IdentityManagementEndpointContextURL into tomcat URL.

    Code Block
    language xml
    … <context-param> <param-name>IdentityManagementEndpointContextURL</param-name> <param-value>https://localhost:8443/accountrecoveryendpoint</param-value> </context-param> …

13. In <TOMCAT_HOME>/accountrecoveryendpoint/WEB-INF/classes/RecoveryEndpointConfig.properties file, uncomment and change it to identity server.

    Code Block
    language xml
    identity.server.service.contextURL=https://localhost:9443/services/

14. Uncomment and change the user portal reference in <TOMCAT_HOME>/accountrecoveryendpoint/WEB-INF/web.xml

    Code Block
    language xml
    … <context-param> <param-name>UserPortalUrl</param-name> <param-value>https://localhost:9443/dashboard/index.jag</param-value> </context-param> ...