Content Comparison

TopProblem Scenario

The first problem that Pickup faces is that each employee has to use separate sets of user names and passwords (credentials) to log in to Pickup Dispatch and Pickup Manager.

When the number of applications that are used in Pickup increases, the employees have to maintain more credentials. This is not scalable. Cameron decides to use Single Sign-On (SSO) to overcome this situation. With SSO, when a user signs in to one application (authentication), that user is automatically authenticated to other applications, eliminating the need to maintain multiple credentials.

Cameron decides to use WSO2 IS to configure SSO.

Let's use the command-line to check the SSO functionality with SAML2 or OIDC.

Configuring SSO with SAML2

If the two applications are using SAML2 as their authentication protocol, follow the steps below:

1. Enter 1 as the scenario number at the command prompt to:

   1. Create the two users, Cameron and Alex.
   2. Create and assign the user role Manager to Cameron.
   3. Create service providers for Pickup Dispatch and Pickup Manager.
   4. Configure SAML2 web SSO for Pickup Dispatch and Pickup Manager.
      
   5. Note that a message with the user and web application details appears.
      

   You can also perform the above using the WSO2 IS Management Console. For more information, see Creating users and roles, , and .

2. Go to the URL http://localhost.com:8080/saml2-web-app-pickup-dispatch.com using a web browser to access the Dispatch application.

3. Click Log in.
   

4. Enter either of the following credentials to sign in to the application.

5. Select the attributes that you want to share with Dispatch and click Approve.

   Obtaining the user consent is one of the fundamental requirements of the GDPR regulation. WSO2 IS facilitates this through its Consent Management features. To know more about GDPR and how WSO2 IS handles consent, see Consent Management.

   Note that the Pickup Dispatch home screen appears.

   
   

6. Similarly, go to the URL http://localhost.com:8080/saml2-web-app-pickup-manager.com Using your browser to access the Pickup Manager application.

7. Click Log in.
   

8. Note that the Pickup Manager application opens without having to enter the user credentials again.

9. To try out other scenarios, navigate back to where you ran the Quick Start sample on the command-line and enter y to clean the setup.
   

Configuring SSO with OIDC

If the two applications are using OIDC as their authentication protocol, follow the steps below:

1. Enter 2 as the scenario number at the command prompt.

   1. Create the two users: Cameron and Alex.
   2. Create and assign the user role Manager to Cameron.
   3. Create service providers for Pickup Dispatch and Pickup Manager.
   4. Configure SAML2 web SSO for Pickup Dispatch and Pickup Manager.

   
   Note that a message with the user and web application details appears.

2. Enter the http://localhost.com:8080/pickup-dispatch URL on a web browser to access the Pickup Dispatch application.
3. Click Log in.
   

4. Enter either of the following credentials to sign in to the application.

5. Select the approval type that you wish provide and the attributes that you wish to share with the application and click Continue.
   

   Obtaining the user consent is one of the fundamental requirements of GDPR regulation. WSO2 IS facilitates this through its Consent Management features. To know more about GDPR and how WSO2 IS handles consent, see Consent Management.

   Note that the Pickup Dispatch home screen appears.

6. Similarly, enter http://localhost:8080/pickup-manager on a browser to access the Pickup Manager application. Notice that the Pickup Manager application opens without having to enter the user credentials.
   
   
   Hurrah! You have set up SSO and your employees are happy with their experience as they only have to provide credentials once in order to access both Pickup Dispatch and Pickup Manager.
7. Next, in order to try out other scenarios, navigate back to the command prompt where you ran the Quick Start sample and enter y to clean the setup.
   

MFATOPProblem Scenario

Pickup has a secure, hassle-free identity management system in place to better protect the data resources and applications. However, the traditional authentication mechanism that uses a user ID and password is not sufficient. Cameron wants to enhance the security standards by introducing another level of authentication. As a result, Cameron decides to use the Multi-factor Authentication (MFA) capability in WSO2 IS using the following factors:

• First factor: password
• Second factor: Twitter

Let's use the command-line to check the MFA functionality.

Configuring Multi-factor Authentication

Follow the steps below to configure MFA on the Pickup Dispatch and Pickup Manager applications where Twitter is the second authentication factor.

1. Enter 3 as the scenario number at the command prompt.
   
   

2. Enter y to confirm that you have already registered an app in Twitter. (See the Prerequisites tab) 

3. Enter the API key and the secret of the Twitter application when prompted.

4. Note that a message with the user and application details appears.

5. Go to the Enter the http://localhost:8080/saml2-web-app-pickup-dispatch.com URL on a web browser to access the Dispatch application.

6. Click Log in.
   

7. Enter either of the following credentials to sign in to the application.

   The Twitter login page appears as Twitter is the second authentication factor.

8. Enter your Twitter username and password and click Sign In.

   After successful authentication, the User Consents form of the Dispatch application appears.

9. Select the attributes that you want to share with Dispatch and click Approve.

   
   

   Obtaining user consent is one of the fundamental requirements of the GDPR regulation. WSO2 IS facilitates this through its Consent Management features. To know more about GDPR and how WSO2 IS handles consent, see Consent Management.

10. Note that the Dispatch home screen appears.

11. To try out other scenarios, navigate back to where you ran the Quick Start sample on the command-line and enter y to clean the setup.

FATOPProblem Scenario

Pickup works with a team of external consultants. Cameron wants to grant them access to the Pickup Dispatch and Pickup Manager applications. However, it is a hassle to keep adding and maintaining their accounts in the employee database as these consultants are temporary and they keep rotating. Therefore, Cameron decides to use the identity federation capability of WSO2 IS. This facilitates the external consultants to use their already existing Twitter account credentials to sign in to the Pickup applications.  

Let's use the command line utility to check out how an external consultant uses the command utility to configure federated authentication.

Configuring Federated Authentication

Follow the steps below to configure federated authentication using WSO2 IS:

1. Enter 4 as the scenario number at the command prompt to:

   1. Create the two users: Cameron and Alex.
   2. Create and assign the user role Manager to Cameron.
   3. Create service providers for Pickup Dispatch and Pickup Manager.
   4. Configure SAML2 web SSO for Pickup Dispatch and Pickup Manager.

2. Enter y to confirm that you have already registered an app in Twitter. (See Prerequisites tab) 

   
   

3. Enter the API key and the secret of the Twitter application when prompted.

   Note that a message with the user and application details appears.
4. Enter the http://localhost:8080/saml2-web-app-pickup-dispatch.com URL on a web browser to access the Pickup Dispatch application.

5. Click Log in.

   
   The Twitter login page appears.

6. Enter your Twitter username and password and click Sign In .

   After a successful authentication, the User Consents form of the Dispatch application appears.

7. Select the attributes that you wish to share with Pickup Dispatch and click Approve.

   Obtaining the user consent is one of the fundamental requirements of GDPR regulation. WSO2 IS facilitates this through its Consent Management features. To know more about GDPR and how WSO2 IS handles consent, see Consent Management.

   Note that the Pickup Dispatch home screen appears.

   
   Hurrah! You have just signed in to the Pickup Dispatch application as an external consultant using your Twitter credentials.

8. Next, in order to try out other scenarios, navigate back to the command prompt where you ran the Quick Start sample and enter y to clean the setup.
   

SSUTOPProblem Scenario 

Pickup is going through a major expansion and is in the process of hiring new employees. Currently, when a new employee joins, the Pickup HR team requests for their details, and creates user accounts and then asks them to verify, edit and customize their user profiles. This process sometimes takes a few days. Thus, the Rowan and the Pickup HR team is having a hard time doing this one by one for especially when a larger number of employees come on-board. Cameron realizes that allowing the new employees to self sign-up to Pickup web applications will speed up the onboarding process. As a result Cameron sets this up for Pickup HR using WSO2 IS.

Let's use the command line utility to check out the self sign-up functionality.

Configuring Self Sign-up

Follow the steps below to configure self sign-up for Pickup Dispatch and Pickup Manager applications using WSO2 IS.

1. Enter 5 as the scenario number at the command prompt.

   WFStep01A prompt appears to choose the user sign-up approach.

   • Enable self user registration (without any config): This enables self sign-up without having to do additional configurations. Once registered, the user receives an email to the provided email address.
   • Enable account lock on creation: This locks the user account during user registration. The user can only sign in to the application after clicking the verification link sent to the user-provided email address. A confirmation mail is sent to the user but user account is locked until the user confirms the account by clicking on the account confirmation mail sent by WSO2 IS.

2. Enter number that matches with the approach you would like to try.

3. Enter the http://localhost.com:8080/pickup-dispatch URL on a web browser to access the Dispatch application.

4. Click Log in.
   

5. Click Register Now.

   
   

6. Enter a username for your user account and click Proceed to Self Register.

   If you want a user to self register for a specific tenant, provide the username in the following format: <USERNAME>@<TENAND_DOMAIN>. 

7. Provide the  user profile details, agree to the Privacy Policy, and click Register.
   

   A confirmation message appears.

8. Click Close.

   1. If you selected Enable User Registration (without any config) at , navigate back to the Pickup Dispatch application and sign in using the new user credentials.

   2. If you selected Account Lock on Creation at , access your email account to view the account registration confirmation mail.

      1. Click Confirm Registration in the email or copy the link in the email to your browser and confirm the account creation.

         The account gets unlocked and an email is sent. 

      2. Navigate back to the Pickup Dispatch application and sign in using the new user credentials.

      Note that the Dispatch home screen appears.

      Hurrah! You have just self-signed up to a Pickup web application.

9. Next, in order to try out other scenarios, navigate back to the command prompt where you ran the Quick Start sample and enter y to clean the setup.

Problem Scenario

Follow the steps below to configure a workflow.

1. Enter 6 as the scenario number at the command prompt.
   

   Note that a message with the user and web application details appears.

2. Enter the http://localhost.com:8080/pickup-dispatch URL on a web browser to access the Pickup Dispatch application.

3. Click Log in.
   

4. Click Register Now.

5. Enter a username for your user account and click Proceed to Self Register.

   If you want a user to self register for a specific tenant, provide the username in the following format: <USERNAME>@<TENAND_DOMAIN>. 

6. Provide the user profile details, agree to the Privacy Policy, and click Register.
   

   Even though a new user account is created successfully, it is in disabled state. To enable the user, you need to sign in to the WSO2 dashboard and approve the pending workflow requests.

7. Enter the http://localhost:9443/dashboard URL on a web browser to access WSO2 Dashboard.
   

8. Enter the following credentials to sign in as Alex and click Sign In.

9. Provide the consents.

10. Click Pending Approvals > View Details.
    

11. Click the Task ID.

12. Click Approve to approve the user account creation.
    

    Note that a confirmation message appears.
    

    Click OK.

13. Click Sign out to sign out of WSO2 Dashboard as Alex.
    

14. Enter the following credentials to sign in as Cameron and click Sign In.

15. Provide consents.

16. Click Pending Approvals > View Details.

17. Click the Task ID.

18. Click Approve to approve the user account creation.

19. Navigate back to the Pickup Dispatch application and sign in using the new user credentials.

    Select the attributes that you wish to share with Pickup Dispatch and click Approve.

    Obtaining the user consent is one of the fundamental requirements of GDPR regulation. WSO2 IS facilitates this through its Consent Management features. To know more about GDPR and how WSO2 IS handles consent, see Consent Management.

    Note that the Pickup Dispatch home screen appears.

This concludes the Quick Start Guide!

You have set up WSO2 IS and gone through the basic use cases of the product. For more advanced use cases, check our Tutorials.