Page Comparison

Single sign-on (SSO) allows users, who are authenticated against one application, gain access to multiple other related applications as well without having to repeatedly authenticate themselves. It also allows the Web applications gain access to a set of back-end services with the logged-in user's access rights, and the back-end services can authorize the user based on different claims like user role.

WSO2 API Manager includes Single Sign-On with SAML 2.0 feature, which is implemented according to the SAML 2.0 Web browser-based SSO support that is facilitated by WSO2 Identity Server (IS). This feature is available in any IS version from 4.1.0 onwards. We use IS 5.0.0 in this guide. WSO2 Identity Server acts as an identity service provider of systems enabled with single sign-on, while the Web applications such as API Manager apps act as SSO service providers. Using this feature, you can configure SSO across the two API Manager Web applications, which are API Publisher and API Store as well as other Web applications in your organization. After configuring, you will be able to access API Store or API Publisher in a single authentication attempt.

Info
To learn more about Single Sign-On with WSO2 Identity Server, see the following article in WSO2 library: http://wso2.org/library/articles/2010/07/saml2-web-browser-based-sso-wso2-identity-server.

The topics below explain the configurations:

Table of Contents

maxLevel	4
minLevel	4

...

Create a MySQL database (e.g., registry) and run the <IS_HOME>/dbscripts/mssqlmysql.sql script on it to create the required tables.
If you are using a different database type, find the relevant script from the <IS_HOME>/dbscripts directory.

Add the following datasource configuration to both the <IS_HOME>/repository/conf/datasources/master-datasources.xml and <AM_HOME>/repository/conf/datasources/master-datasources.xml files.

Code Block

language	xml

<datasource>
    <name>WSO2REG_DB</name>
    <description>The datasource used for registry</description>
    <jndiConfig>
        <name>jdbc/WSO2REG_DB</name>
    </jndiConfig>
    <definition type="RDBMS">
        <configuration>
            <url>jdbc:mysql://localhost:3306/registry?autoReconnect=true&amp;relaxAutoCommit=true&amp;</url>
            <username>apiuser</username>
            <password>apimanager</password>
            <driverClassName>com.mysql.jdbc.Driver</driverClassName>
            <maxActive>50</maxActive>
            <maxWait>60000</maxWait>
            <testOnBorrow>true</testOnBorrow>
            <validationQuery>SELECT 1</validationQuery>
            <validationInterval>30000</validationInterval>
        </configuration>
    </definition>
</datasource>

Create the registry mounts by inserting the following sections into the <IS_HOME>/repository/conf/registry.xml file.

Tip
When doing this change, do not replace the existing `<dbConfig>` for "`wso2registry`". Simply add the following configuration to the existing configurations.

Code Block

language	xml

<dbConfig name="govregistry">
        <dataSource>jdbc/WSO2REG_DB</dataSource>
</dbConfig>
 
<remoteInstance url="https://localhost">    
        <id>gov</id>
        <dbConfig>govregistry</dbConfig>
        <readOnly>false</readOnly>
        <enableCache>true</enableCache>
        <registryRoot>/</registryRoot>
</remoteInstance>
 
<mount path="/_system/governance" overwrite="true">
        <instanceId>gov</instanceId>
        <targetPath>/_system/governance</targetPath>
</mount>
 
<mount path="/_system/config" overwrite="true">
       <instanceId>gov</instanceId>
       <targetPath>/_system/config</targetPath>
</mount>

Repeat the above step in the <AM_HOME>/repository/conf/registry.xml file as well.

...

Configuring WSO2 Identity Server as a SAML 2.0 SSO Identity Provider

Start the IS server and log in to its Management Console UI ( https://localhost:9443/carbon).

Tip
If you use login pages that are hosted externally to log in to the Identity Server, give the absolute URLs of those login pages in the `authenticators.xml` and `application-authenticators.xml` files in the `<IS_HOME>/repository/conf/security` directory.

Select Add under Service Providers menu.
Image Modified

Give a service provider name and click Register.

Tip

Tip: If you are working in a multi tenanted environment and you want all tenants to be able to log in to the APIM Web applications, you must click the SaaS Application option that appears after registering the service provider.

If not, only users in the current tenant domain (the one you are defining the service provider in) will be allowed to log in to the Web application and you have to register new service providers for all Web applications (API Store and API Publisher in this case) from each tenant space separately. For example, let's say you have three tenants as TA, TB and TC and you register the service provider in TA only. If you tick the SaaS Application option, all users in TA, TB, TC tenant domains will be able to log in. Else, only users in TA will be able to log in.

You are navigated to the detailed configuration page. Expand SAML2 Web SSO Configuration inside the Inbound Authentication Configuration section.
Expand SAML2 Web SSO Configuration inside the Inbound Authentication Configuration section.
Pro vide the following configurations to register the API Manager Web applications as SSO service providers.
Note
In the following configurations, use the exact values that were used to configure the API Manager Web applications.
To register API Publisher as an SSO service provider:
To register API Store as an SSO service provider:

For example:

Configuring WSO2 API Manager Apps as SAML 2.0 SSO Service Providers

...

Versions Compared

Old Version 40

New Version 41

Key

Configuring WSO2 Identity Server as a SAML 2.0 SSO Identity Provider

Configuring WSO2 API Manager Apps as SAML 2.0 SSO Service Providers