Page Comparison

The default configurations of To work with WSO2 products, you must have a single, embedded user store ( primary user store). If requiredAdditionally, you can configure WSO2 products to connect to several secondary user stores as wellif required. After configuration, users from different stores can log in and perform operations depending on their roles/permissions. You can also configure your own customized user stores and connect them with the products as secondary stores.

You can use either use the management console to create secondary user stores or you can create them it manually. These will be stored as .xml files an XML file in the file system and you can use the same XML format that was , used to configure primary user store.The topics below explain how you can configure secondary user stores using management console or manually: 

...

...

Configuring using the

...

Management Console

1. Log in to the management console and click click Add under the  under the User Stores sub menu in the Main menu.
   The  sub menu in the Main menu. The Add New User Store page  page opens.

   Info
   You cannot update the PRIMARY user store at run timeruntime, so it is not visible on this page.

2. From the User Store Manager Class drop-down list, select the user store manager class that

   suite for

   suits your user store. 

   
   See User store manager section in Configuring User Stores for more information.

   The following table lists the available User store manager implementations and their usage:

   User store	User store manager class	Description
   LDAP ActiveDirectory	org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager	Used to do read-only operations for external LDAP or ActiveDirectory user stores.
   LDAP	org.wso2.carbon.user.core.ldap.ReadWriteLDAPUserStoreManager	Used for external LDAP user stores to do both read and write operations.This is the default primary user store configuration in user-mgt.xml file for WSO2 Identity Server.
   ActiveDirectory	org.wso2.carbon.user.core.ldap.ActiveDirectoryUserStoreManager	Used to configure an Active Directory Domain Service (AD DS) or Active Directory Lightweight Directory Service (AD LDS). This can be used only for read/write operations. If you need to use AD as read-only, you must use org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager.
   JDBC	org.wso2.carbon.user.core.jdbc.JDBCUserStoreManager	Used for JDBC user stores. This is the default primary user store configuration in user-mgt.xml file for all WSO2 Servers, except WSO2 Identity Server.

   If you have added a custom user store

   manger

   manager to the system, that

   also availble

   also be available in this

   dropdown

   drop-down menu.

3. Enter a unique domain name with no underscore (_) characters, and optionally enter a description (optional) for this user store.
4. Enter values for the properties, using the descriptions in the 'Descriptions' column for guidance. The properties that appear, vary based on the user store manager class you selected, and there may be additional properties in an Optional or Advanced section sections at the bottom of the screen.
   
   In the following document, you can find the information of on the properties that you need to configure in user store manager types and It it provides the additional steps and recommendations specific to each user store manager.
   
   

   • Configuring a JDBC User Store

   • Configuring a Read-

   Only

   • only LDAP User Store

   • Configuring a Read-

   Write

   • write Active Directory User Store

   • Configuring a Read-

   Write

   • write LDAP User Store

   Note
   It is important to read each user store configuration document to find specific information that you need to follow to configure particular user store.

5. Ensure that Make sure that all the mandatory fields are filled and a valid domain name is given, and click click Add.
   A  A message like the appears saying that the user stores are being added.
   Image RemovedImage Added

   Note
   The above message does not imply that the user store is added successfully. Rather it It simply means that the server is attempting to add the new user store to the end of the available chain of user stores.

6. Refresh the page after a few seconds to check the status.
   If the new user store is successfully added, it appears in the will appear in the User Stores page. This can be viewed at any time by clicking clicking List under  under User Stores in the  in the Main menu menu.
   
   
7. After adding to the server, you can edit the properties of the new secondary user store and enable/disable it in a dynamic manner.
   This will be saved

...

1. to an XML file with the same name as the domain name,

...

1.  under  <PRODUCT_HOME>/repository/deployment/server/userstores

...

1.  directory for super

...

1. tenant and <PRODUCT_HOME>/repository/tenants/<tenantid>/userstores

...

1.  directory fortenant.

Configuring manually

If you prefer to configure secondary the user store manually, you can create this . Follow the below steps to create and save the .xml file manually and save it as follows:

1. When you configure multiple user stores, you must give a unique domain name to each user store in the <DomainName> element. If you configure a user store without specifying a domain name, the server throws an exception

   at start

   at start up.

2. If

   it

   the configuration is done for the

   configuration of a

   super tenant, save the secondary user store definitions

   in

   in <PRODUCT_HOME>/repository/deployment/server/

   userstores directory

   userstores directory.

3. If

   it is a

   the configuration is done for the tenant, save the

   configuration in

   configuration in <PRODUCT_HOME>/repository/tenants/<tenantid>/userstores

   directory

    directory.

   Note
   The

   the

   secondary user store configuration file must have the same name as the domain with an underscore (_) in place of the period. For example, if the domain

   is

   is 'wso2.com', name the file as wso2_com.xml.

   (Only one file 

   One file contains the definition for one user store domain

   )

   .

   In the following user store manager configuration sections, you can find

   a

   sample configurations for each type of use store. Additionally, you need to set the DomainName property with the domain name of your user store

   as follows:

   .

   Code Block
   language xml
   <Property name="DomainName">Remote</Property>

   Note

...

1. If we create a secondary user store from the UI in a clustered environment, it will not sync between all the nodes by default

...

1. , so you need to copy manually to other nodes and same happens in deletion as well. So you can use some Sync mechanism like Rsync or first fully test it in a single node and apply to other nodes while setting up the cluster.