Page Comparison

...

Table of Contents

maxLevel	4
minLevel	4

Sharing the user store

First, Initially, configure your user store(s), if you have not done so already, by following the instructions in Configuring User Stores. Thereafter, point both WSO2 IS Identity Server and WSO2 API Manager to a single user store your user stores(s) using the instructions given in section Configuring User Storesbelow. You do this to make sure that a user who tries to log in to the the API Manager console, the API Store or the Publisher is is authorized. When a user tries to log in to either of the three applications, s/he is redirected to the configured identity provider (WSO2 IS in this case) where s/he provides the login credentials to be authenticated. In addition to this, the user should also be authorized by the system as some user roles do not have permission to perform certain actions. For the purpose of authorization, the IS and API Manager need to have a shared user store and user management database (by default, this is the H2 database in the <APIM_HOME>/repository/conf/user-mgt.xml file) where the user's role and permissions are stored.

For example, let let's take share a common JDBC user store (MySQL) for with both the WSO2 IS and Identity Server and WSO2 API Manager as follows:

Download WSO2 API Manager 1.10.0 from here and unzip it. <APIM_HOME> refers to the root folder where WSO2 APIM was unzipped.
Create a MySQL database (e.g., 410_um_db) and run the <APIM_HOME>/dbscripts/mysql.sql script on it to create the required tables.
If you are using a different database type, find the relevant script from the <APIM_HOME>/dbscripts directory.

Open the <APIM_HOME>/repository/conf/datasources/master-datasources.xml file and add the datasource configuration for the database that you use for the shared user store and user management information. For example,

Code Block

language	html/xml

For example, you can share as single user store as follows. If you are sharing multiple datasources, you need to define a datasource for each of the user stores that you are working with, so that they can be shared.

Code Block

title	Example

<datasource>
     <name>WSO2_UM_DB</name>
     <description>The datasource used for registry and user manager</description>
     <jndiConfig>
              <name>jdbc/WSO2UMDB</name>
     </jndiConfig>
     <definition type="RDBMS">
              <configuration>
                  <url>jdbc:mysql://localhost:3306/410_um_db</url>
                  <username>username</username>
                  <password>password</password>
                  <driverClassName>com.mysql.jdbc.Driver</driverClassName>
                  <maxActive>50</maxActive>
                  <maxWait>60000</maxWait>
                  <testOnBorrow>true</testOnBorrow>
                  <validationQuery>SELECT 1</validationQuery>
                  <validationInterval>30000</validationInterval>
              </configuration>
       </definition>
</datasource>

Add the same datasource configuration above to <IS_HOME>/repository/conf/datasources/master-datasources.xml file.
Copy the database driver JAR file to the <IS_HOME>/repository/components/lib and <APIM_HOME>/repository/components/lib directories.
Open the <APIMDownload WSO2 Identity Server (WSO2 IS) 5.1.0 from here and unzip it. <IS_HOME> refers to the root folder where WSO2 IS was unzipped.
Tip
If you plan on using WSO2 IS as Key Manager as well, you can download the WSO2 Identity Server 5.1.0 as a Key Manager pack, which has Key Manager features pre-packaged with WSO2 IS, from here.
Add the same datasource configuration above to <IS_HOME>/repository/conf/datasources/usermaster-mgtdatasources.xml file. The
Copy the database driver JAR file to the <IS_HOME>/repository/components/lib and <APIM_HOME>/repository/components/lib directories.
Open the <APIM_HOME>/repository/conf/user-mgt.xml file. The dataSource property points to the default H2 database. Change it to the jndiConfig name given above (i.e., jdbc/WSO2UMDB). This changes the datasource reference that is pointing to the default H2 database.
Code Block
language html/xml
<Realm> <Configuration> ... <Property name="dataSource">jdbc/WSO2UMDB</Property> </Configuration> ... </Realm>
Add the same configuration above to the <IS_HOME>/repository/conf/user-mgt.xml file.
The Identity Server has an embedded LDAP user store by default. As this is enabled by default, follow the instructions in Internal JDBC User Store Configuration to disable the default LDAP and enable the JDBC user store instead.

...

Create a MySQL database (e.g., registry) and run the <IS_HOME>/dbscripts/mysql.sql script on it to create the required tables.
If you are using a different database type, find the relevant script from the <IS_HOME>/dbscripts directory.

Add the following datasource configuration to both the <IS_HOME>/repository/conf/datasources/master-datasources.xml and <APIM_HOME>/repository/conf/datasources/master-datasources.xml files.

Code Block

language	xml

<datasource>
    <name>WSO2REG_DB</name>
    <description>The datasource used for registry</description>
    <jndiConfig>
        <name>jdbc/WSO2REG_DB</name>
    </jndiConfig>
    <definition type="RDBMS">
        <configuration>
            <url>jdbc:mysql://localhost:3306/registry?autoReconnect=true&amp;relaxAutoCommit=true&amp;</url>
            <username>apiuser</username>
            <password>apimanager</password>
            <driverClassName>com.mysql.jdbc.Driver</driverClassName>
            <maxActive>50</maxActive>
            <maxWait>60000</maxWait>
            <testOnBorrow>true</testOnBorrow>
            <validationQuery>SELECT 1</validationQuery>
            <validationInterval>30000</validationInterval>
        </configuration>
    </definition>
</datasource>

Create the registry mounts by inserting the following sections into the <IS_HOME>/repository/conf/registry.xml file.

Tip
When doing this change, do not replace the existing `<dbConfig>` for "`wso2registry`". Simply add the following configuration to the existing configurations.

Code Block

language	xml

<dbConfig name="govregistry">
        <dataSource>jdbc/WSO2REG_DB</dataSource>
</dbConfig>
 
<remoteInstance url="https://localhost">    
        <id>gov</id>
        <dbConfig>govregistry</dbConfig>
        <readOnly>false</readOnly>
        <enableCache>true</enableCache>
        <registryRoot>/</registryRoot>
</remoteInstance>
 
<mount path="/_system/governance" overwrite="true">
        <instanceId>gov</instanceId>
        <targetPath>/_system/governance</targetPath>
</mount>
 
<mount path="/_system/config" overwrite="true">
       <instanceId>gov</instanceId>
       <targetPath>/_system/config</targetPath>
</mount>

Repeat the above step in the <APIM_HOME>/repository/conf/registry.xml file as well.

Next, let us look at the SSO configurations.

Configuring WSO2 Identity Server as a SAML 2.0 SSO Identity Provider

Start the IS server and log in to its registry.xml file as well.

Next, let us look at the SSO configurations.

Configuring WSO2 Identity Server as a SAML 2.0 SSO Identity Provider

Start the WSO2 Identity Server.

Code Block
./wso2server.sh -DportOffset=1

Info

title	What is port offset?

The port offset feature allows you to run multiple WSO2 products, multiple instances of a WSO2 product, or multiple WSO2 product clusters on the same server or virtual machine (VM). The port offset defines the number by which all ports defined in the runtime, such as the HTTP/S ports, will be offset. For example, if the HTTPS port is defined as 9443 and the portOffset is 1, the effective HTTPS port will be 9444.

Sign in to the WSO2 IS Management Console UI (https://localhost:9443/carbon).

Tip
If you use login signin pages that are hosted externally to log sign in to the Identity Server, give the absolute URLs of those login pages in the `authenticators.xml` and `application-authenticators.xml` files in the `<IS_HOME>/repository/conf/identity` directory.

Select Add under Service Providers menu.

Give a service provider name and click Register.

Tip

In a multi tenanted environment, for all tenants to be able to log in to the APIM Web applications, do the following:

Click the SaaS Application option that appears after registering the service provider.

If not, only users in the current tenant domain (the one you are defining the service provider in) will be allowed to log in to the Web application and you have to register new service providers for all Web applications (API Store and API Publisher in this case) from each tenant space separately. For example, let's say you have three tenants as TA, TB and TC and you register the service provider in TA only. If you tick the SaaS Application option, all users in TA, TB, TC tenant domains will be able to log in. Else, only users in TA will be able to log in.
Add the following inside the <SSOService> element in the <IS_HOME>/repository/conf/identity/identity.xml file and restart the server.
Code Block
<SSOService> <UseAuthenticatedUserDomainCrypto>true</UseAuthenticatedUserDomainCrypto> ... </SSOService>
If not, you get an exception as SAML response signature verification fails.
Because the servers in a multi-tenanted environment interact with all tenants, all nodes should share the same user store. Therefore, make sure you have a shared registry (JDBC mount, WSO2 Governance Registry etc.) instance across all nodes.

You are navigated to the detailed configuration page. Expand SAML2 Web SSO Configuration inside the Inbound Authentication Configuration section. Click Configure.
Provide the configurations to register the API Publisher as the SSO service provider. These sample values may change depending in your configuration.
For example:
Similarly, provide the configurations to register the API Store as the SSO service provider. These sample values may change depending in your configuration.

Tip
For more information on SAML related terminologies discussed in the sections above, go to Assertions and Protocols for the OASIS SAML 2.0 documentation.

Make sure that the responseSigningEnabled element is set to true in both the following files:
<APIM_HOME>/repository/deployment/server/jaggeryapps/publisher/site/conf/site.json
<APIM_HOME>/repository/deployment/server/jaggeryapps/store/site/conf/site.json
Info
For more details on configuring WSO2 Identity Server 5.1.0 see, Configuring the service provider.

...

Versions Compared

Old Version 16

New Version Current

Key

Sharing the user store

Configuring WSO2 Identity Server as a SAML 2.0 SSO Identity Provider

Configuring WSO2 Identity Server as a SAML 2.0 SSO Identity Provider