Connecting Two Identity Servers with SAML SSO

This topic demonstrates a scenario where two WSO2 Identity Server instances with different user stores can be used for federated authentication. The scenario uses the following software.

WSO2 Identity Server
Apache Tomcat to run the client application

Setting up the WSO2 Identity Server instances

Download the WSO2 Identity Server from here.
Extract the file to a dedicated directory. For the purposes of this scenario, this is referred to as <IS_HOME_PRIMARY> in this topic.
Make a copy of this folder in the same location and rename it. For the purposes of this scenario, this is referred to as <IS_HOME_SECONDARY> in this topic.
By default, the HTTPS port of the primary IS instance is 9443. Let this be left as it is. Go to the <IS_HOME_SECONDARY>/repository/conf directory and open the carbon.xml file. Change the <Offset> value under the <Ports> configuration to 1. This changes the HTTPS port in the secondary IS instance to 9444 to avoid conflicts with the primary IS instance.
Install and run the two Identity Server instances.
- Go to <IS_HOME_PRIMARY> and <IS_HOME_SECONDARY> in your command line and type the following command for each instance.
  - On Windows: wso2server.bat --run
  - On Linux/Solaris: sh wso2server.sh
The management console for the primary Identity Server can be accessed using the following URL: https://localhost:9443/carbon
The management console for the secondary Identity Server can be accessed using the following URL: https://localhost:9444/carbon

Configuring the secondary IS as IdP in the primary IS

The next step in this scenario is to configure the secondary Identity Server as an identity provider in the primary Identity Server.

Go to the management console of the primary IS.
Navigate to the Identity Providers section in the Main menu and click Add.
Enter “Secondary" as the Identity Provider Name for this scenario.
Expand the Federated Authenticators section and then expand the SAML2 Web SSOConfiguration section.
Make the following changes.
1. Select the Enable SAML2 Web SSO checkbox.
2. Enter “Secondary IDP” as Identity Provider Entity Id.
3. Enter “Primary'” as the Service Provider Entity Id.
4. Enter 'https://localhost:9444/samlsso/' as the SSO URL. This is the SAML2 SSO URL of the secondary IS.
5. Select the Enable Logout checkbox.
Click Register. The new identity provider named 'Secondary' is listed under List (go to Main menu and click List under Identity Providers).
Now that the secondary Identity Server is added as an IdP in the primary Identity Server, this primary IS should be added as service provider in the Secondary IS instance.
Go to management console of the Secondary IS instance using the following URL: https://localhost:9444/carbon
Navigate to the Main menu and click Add under Service Providers. Enter service provider name as 'PrimaryIDP' for this sample scenario.
Click Register.
In the form that appears, expand the Inbound Authentication Configuration and SAML2 Web SSO Configuration sections.
Click Configure.
Enter the following in the form that appears.
1. Enter “Primary” as the Issuer, this is the same value as Service Provider Entity Id in step 5c.
2. Enter value https://localhost:9443/commonauth as Assertion Consumer URL.
3. Enable the following checkboxes.
  1. Use fully qualified username in the NameID
  2. Enable Response Signing
  3. Enable Assertion Signing
  4. Enable Single Logout
Click Update and then click Register. The primary Identity Server instance is added as the service provider in the secondary Identity Server instance.

Setting up an application as the SP in the primary IS

The client application in this scenario is the travelocity sample application that can be checked out from WSO2 repo using the following command.

svn co http://svn.wso2.org/repos/wso2/carbon/platform/branches/turing/products/is/5.0.0/modules/samples/sso/

The client application must be set up as a service provider in the primary Identity Server instance and this can be done by following the instruction here.