Configuring STS for Obtaining Tokens with Holder-Of-Key Subject Confirmation

This requires registration of relying party endpoint addresses and their corresponding public certificates. In this scenario, STS generates a symmetric key and encrypts it with the public key of the relying party. This is included in the subject confirmation section of the SAML token, which is validated at the relying party end.

Follow the instructions below to configure STS for obtaining tokens with Holder-Of-Key subject confirmation (Symmetric Key).

1. Start the WSO2 Identity Server.
2. Log in as an admin to access the management console. 
3. Do the following steps if you are using a Holder of Key confirmation method.
   1. Navigate to the Service Providers section by clicking Add in the Main menu under Service Providers.
   2. Add a Service Provider Name and Description and click Register.
      
      
      
   3. In the resulting page, expand the Inbound Authentication Configuration and the WS-Trust Security Token Service Configuration sections. Click Configure.

   4. Enter the trusted relying parties and upload the public certificate of the trusted relying party (against its end-point).

      These relying parties will accept security tokens from the Identity Server.

      The tokens issued are encrypted using the public key of the trusted relying party. Accordingly, even the client who obtains the token to send to the RP has no visibility to the included token.

   5. Click Apply.
4. A new trusted service is added to the service provider.