Page Comparison

Single sign-on (SSO) allows users, who are authenticated against one application, gain access to multiple other related applications as well without having to repeatedly authenticate themselves. It also allows the Web applications gain access to a set of back-end services with the logged-in user's access rights, and the back-end services can authorize the user based on different claims like user role.WSO2 API Manager includes Single Sign-On with SAML 2.0 feature, which is implemented according to the SAML 2.0 Web browser-based SSO support that is facilitated by WSO2 Single sign-on (SSO) allows users, who are authenticated against one application, gain access to multiple other related applications as well without having to repeatedly authenticate themselves. It also allows the Web applications gain access to a set of back-end services with the logged-in user's access rights, and the back-end services can authorize the user based on different claims like user role.

WSO2 API Manager includes Single Sign-On with SAML 2.0 feature, which is implemented according to the SAML 2.0 Web browser-based SSO support that is facilitated by WSO2 Identity Server (IS). This feature is available in any IS version from 4.1.0 onwards. We use IS 5.0.0 in this guide. WSO2 Identity Server acts as an identity service provider of systems enabled with single sign-on, while the Web applications such as API Manager apps act as SSO service providers. Using this feature, you can configure SSO across the two API Manager Web applications, which are API Publisher and API Store as well as other Web applications in your organization. After configuring, you will be able to access API Store or API Publisher in a single authentication attempt.

...

The topics below explain the configurations: 

Sharing the user store

Before moving to configuration, point both WSO2 IS and WSO2 API Manager to a single user store using the instructions given in section Configuring User Stores. For example, take a common JDBC user store for both IS and API Manager:

...

For example, let's take a common JDBC user store (MySQL) for both IS and API Manager.

1. Create a MySQL database (e.g., 410_um_db) and run the <AM_HOME>/dbscripts/mssql.sql script on it to create the required tables. 
   If you are using a different database type, find the relevant script from the <AM_HOME>/dbscripts directory.

2. Open <AM_HOME>/repository/conf/datasources/master-datasources.xml file and add the datasource configuration for the relevant databasedatabase that you use for the shared user store and user management information. For example,

   Code Block
   language html/xml
   <datasource> <name>WSO2_UM_DB</name> <description>The datasource used for registry and user manager</description> <jndiConfig> <name>jdbc/WSO2UMDB</name> </jndiConfig> <definition type="RDBMS"> <configuration> <url>jdbc:mysql://localhost:3306/410_um_db</url> <username>username</username> <password>password</password> <driverClassName>com.mysql.jdbc.Driver</driverClassName> <maxActive>50</maxActive> <maxWait>60000</maxWait> <testOnBorrow>true</testOnBorrow> <validationQuery>SELECT 1</validationQuery> <validationInterval>30000</validationInterval> </configuration> </definition> </datasource>

3. Create the database schema by running the script that is relevant to your database in the <AM_HOME>/dbscripts directory.

4. Add the same datasource configuration above to Add the same datasource configuration above to <IS_HOME>/repository/conf/datasources/master-datasources.xml file file.

5. TipPlace

   Copy the database driver JAR file

   in

   to the <IS_HOME>/repository/components/lib

   and

    and <AM_HOME>/repository/components/lib

   directories

    directories.

6. Open Open <AM_HOME>/repository/conf/user-mgt.xml file and change its dataSource element  file. The dataSource property points to the default H2 database. Change it to the jndiConfig name given above (i.e., jdbc/WSO2UMDB).

   Code Block

   This changes the datasource reference that is pointing to the default H2 database.

   Code Block
   language html/xml
   <Realm> <Configuration> ... <Property name="dataSource">jdbc/WSO2UMDB</Property>

   Insert the same configuration above in

   </Configuration> ... </Realm>

7. Add the same configuration above to the <IS_HOME>/repository/conf/user-mgt.xml file file.

8. The Identity Server has an embedded LDAP user store by default.

   Follow

   As this is enabled by default, follow the instructions

   in

   in Internal JDBC User Store Configuration

   to

    to disable the default LDAP and enable the JDBC

   User Store

   user store instead.

Sharing the registry space

Let's share a common registry space between the IS and APIM. This can be done by creating a registry database and mounting it on both the IS and APIM.

1. Create a

   database by the name WSO2REG_DB. In this example, we use MySQL.Run the script that is relevant to your database type from the scripts in the

   MySQL database (e.g., registry) and run the <IS_HOME>/dbscripts

   folder. For example,

   /mssql.sql script on it to create the required tables. 
   If you are using a different database type, find the relevant script from the <IS_HOME>/dbscripts

   /mysql.sql

    directory.

2. Add the following datasource configuration to both the <IS_HOME>/repository/conf/datasources/master-datasources.xml and <AM_HOME>/repository/conf/datasources/master-datasources.xml files files.

   Code Block
   language xml
   <datasource> <name>WSO2REG_DB</name> <description>The datasource used for registry</description> <jndiConfig> <name>jdbc/WSO2REG_DB</name> </jndiConfig> <definition type="RDBMS"> <configuration> <url>jdbc:mysql://localhost:3306/registry?autoReconnect=true&amp;relaxAutoCommit=true&amp;</url> <username>apiuser</username> <password>apimanager</password> <driverClassName>com.mysql.jdbc.Driver</driverClassName> <maxActive>50</maxActive> <maxWait>60000</maxWait> <testOnBorrow>true</testOnBorrow> <validationQuery>SELECT 1</validationQuery> <validationInterval>30000</validationInterval> </configuration> </definition> </datasource>

3. Copy the registry.xml file from the <AM_HOME>/repository/conf/ directory to the <IS_HOME>/repository/conf/ directory. Make sure you replace the existing registry.xml file found in the <IS_HOME>. This is because the <indexingConfiguration> element is not there in the registry.xml that comes in the IS.

4. Make the following changes to the <IS_HOME>/repository/conf/registry.xml file you copied in the above step.

   The handler used to evaluate the XACML media type is not there in the registry.xml file you copied. Therefore, you must add the handler shown in the following code block.

   Code Block

   language	xml

    <handler class="org.wso2.carbon.identity.entitlement.policy.finder.registry.RegistryPolicyHandler">

   </jndiConfig>

   <filter

   <definition

   class

   type="

   org.wso2.carbon.identity.entitlement.policy.finder.registry.RegistryPolicyMediaTypeMatcher">

   RDBMS"> <configuration>

   <property name="mediaType">application/xacml-policy+xml</property>

   <url>jdbc:mysql://localhost:3306/registry?autoReconnect=true&amp;relaxAutoCommit=true&amp;</url>

   </filter> </handler>

   Create the registry mounts by inserting the following sections into the registry.xml file.

   Tip
   When doing this change, do not replace the existing <dbConfig> for "wso2registry". Simply add the following configuration to the existing configurations.

   Code Block<dbConfig name="govregistry">

   <username>apiuser</username>

   <dataSource>jdbc/WSO2REG_DB</dataSource> </dbConfig>

   <password>apimanager</password>

   <remoteInstance url="https://localhost">

   <driverClassName>com.mysql.jdbc.Driver</driverClassName>

   <id>gov</id>

   <maxActive>50</maxActive>

   <dbConfig>govregistry<

   <maxWait>60000</

   dbConfig>

   maxWait>

   <readOnly>false</readOnly>

   <testOnBorrow>true</testOnBorrow>

   <enableCache>true</enableCache><registryRoot>/</registryRoot> </remoteInstance>

   <validationQuery>SELECT 1</validationQuery>

   <mountpath="/_system/governance"overwrite="true"><instanceId>gov<

   <validationInterval>30000</

   instanceId>

   validationInterval>

   <targetPath>/_system/governance</targetPath> </mount>

   </configuration>

   <mount path="/_system/config" overwrite="true"> <instanceId>gov</instanceId>

   </definition> </datasource>

5. Create the registry mounts by inserting the following sections into the <IS_HOME>/repository/conf/registry.xml file.

   Tip
   When doing this change, do not replace the existing <dbConfig> for "wso2registry". Simply add the following configuration to the existing configurations.

    

   Code Block
   language xml
   <dbConfig name="govregistry">

   <targetPath>

   <dataSource>jdbc/WSO2REG_

   system

   DB</

   config</targetPath> </mount>
6. Repeat the step b above in the <AM_HOME>/repository/conf/registry.xml file as well.

Change the datasource in the identity.xml and user-mgt.xml file found in the <IS_HOME>/repository/conf/ directory to WSO2AM_DB and WSO2UM_DB respectively.

Code Block
language xml title identity.xml configurations
<DataSource>dataSource> </dbConfig> <remoteInstance url="https://localhost"> <!-- Include a data source name (jndiConfigName) from the set of data sources defined in master-datasources.xml --><id>gov</id> <dbConfig>govregistry</dbConfig> <readOnly>false</readOnly> <Name>jdbc/WSO2AM_DB</Name> </DataSource>
Code Block
language xml title user-mgt.xml configurations
<Realm><enableCache>true</enableCache> <registryRoot>/</registryRoot> </remoteInstance> <Configuration> <mount path="/_system/governance" overwrite="true"> ...<instanceId>gov</instanceId> <targetPath>/_system/governance</targetPath> </mount> <Property<mount namepath="dataSource">jdbc/WSO2UM_DB</Property>_system/config" overwrite="true"> <instanceId>gov</instanceId> <targetPath>/_system/config</targetPath> </Configuration> ... </Realm> /mount>

7. Repeat the above step in the <AM_HOME>/repository/conf/registry.xml file as well.

Configuring WSO2 Identity Server as a SAML 2.0 SSO Identity Provider

...

a SAML 2.0 SSO Identity Provider

1. Start the IS server and log in to its Management Console UI (https://localhost:9443/carbon).   
   

   Tip
   If you use login pages that are hosted externally to log in to the Identity Server, give the absolute URLs of those login pages in the authenticators.xml and application-authenticators.xml files in the <IS_HOME>/repository/conf/security directory.

2. Select Add under Service Providers menu.
   Image Modified

3. Give a service provider name and click Register.
   

   Tip

   Tip: If you are working in a multi tenanted environment and you want all tenants to be able to log in to the APIM Web applications, you must click the SaaS Application option that appears after registering the service provider. If not, only users in the current tenant domain (the one you are defining the service provider in) will be allowed to log in to the Web application and you have to register new service providers for all Web applications (API Store and API Publisher in this case) from each tenant space separately. For example, let's say you have three tenants as TA, TB and TC and you register the service provider in TA only. If you tick the SaaS Application option, all users in TA, TB, TC tenant domains will be able to log in. Else, only users in TA will be able to log in.

4. You are navigated to the detailed configuration page. Expand SAML2 Web SSO Configuration inside the Inbound Authentication Configuration section.

5. Expand SAML2 Web SSO Configuration inside the Inbound Authentication Configuration section.

6. Provide the following configurations to register the API Manager Web applications as SSO service providers.
   

   Note
   In the following configurations, use the exact values that were used to configure the API Manager Web applications.

   To register API Publisher as an SSO service provider:

   • Issuer : API_PUBLISHER
   • Assertion Consumer URL: https://localhost:9443/publisher/jagg/jaggery_acs.jag. Change the IP and port accordingly. This is the URL for the acs page in your running publisher app.

   • Select the following options:

     • Use fully qualified username in the NameID  

     • Enable Response Signing

     • Enable Assertion Signing

     • Enable Single Logout

   • Click Register once done.

   To register API Store as an SSO service provider:

   • Issuer : API_STORE
   • Assertion Consumer URL: https://localhost:9443/store/jagg/jaggery_acs.jag. Change the IP and port accordingly. This is the URL for the acs page in your running store app.
   • Select the following options:
     
     • Use fully qualified username in the NameID  
     • Enable Response Signing  
     • Enable Assertion Signing  
     • Enable Single Logout   
   • Click Register once done.

For example:

Configuring WSO2 API Manager Apps as SAML 2.0 SSO Service Providers

...