FAQ

Common

Are WSO2 products able to integrate with and provide security management services to external entities?

External entities are incorporated at following scenarios;

Authentication -STS that issues SAML tokens+can accept SAML tokens

    Open ID Provider + Relying party

    SSO IDP + relying party

    Authorization - XACML

Does WSO2 products support cross domain federated identity management functionality to authenticate and authorize individuals of internal and external entities into the system, determine their permissions, and control access to the resources accordingly?

This can be achieved with WS-Trust (eg: service in ESB can be protected with a security policy to accept a security token issued by a trusted STS confirming the authentication of a user in a outside domain), XACML - PDP, PAP and PIP supported by WSO2 Identity Server. PEPs can communicate with PDP of Identity Server to grant authorization

Does WSO2 products support different user access technologies such as user credentials, biometrics, smart card, token, etc ?

User credentials, SAML tokens X.509 tokens are supported out of the box. Biometrics and smart card can be integrated via the custom authenticators available in the WSO2 Identity Server.

Does WSO2 products provide encryption and data integrity functionality (symmetric & asymmetric signatures) to maintain secure messaging across the platform and support various encryption and signature standards ?

For Encryption/Decryption, Symmetric/Asymmetric key based encryption/decryption algorithms recommended in WS-Security specification are being used.

For Digital Signature, the Identity module supports Symmetric/Asymmetric key based digital signature algorithms recommended in WS-Security specification

Does WSO2 Identity Server support security standards and protocols such as WS-Trust, WS-Federation, WS-Policy, etc?

Error initializing Cipher when using a custom Key Store for Secure Vault : If you try with a custom keystore, you might encounter the following error for certain instances :

"Exception in thread "main" org.wso2.ciphertool.CipherToolException: Error initializing Cipher at org.wso2.ciphertool.CipherTool.handleException(CipherTool.java:861) at org.wso2.ciphertool.CipherTool.initCipher(CipherTool.java:202) at org.wso2.ciphertool.CipherTool.main(CipherTool.java:80) Caused by: java.security.InvalidKeyException: Wrong key usage at javax.crypto.Cipher.init(DashoA13..) at javax.crypto.Cipher.init(DashoA13..) at org.wso2.ciphertool.CipherTool.initCipher(CipherTool.java:200) ... 1 more"

You can analyze the public certificates of the two jks's - In default wso2carbon.jks, the KeyUsage is KeyUsage [ DigitalSignature Non_repudiation Key_Encipherment Data_Encipherment ] - In the custom .jks, the KeyUsage is KeyUsage [ DigitalSignature Key_Encipherment ] Since the custom key store's certificate does not have 'Data_Encipherment' it can't use the Ciphertool and encrypt data for secure vault. So you may have to generate a new key store with at least a Self signed certificate.

Does WSO2 products provide encryption and data integrity functionality to maintain secure messaging across the platform?

Can we store user identity, user attributes as well as Trust Level (TL) and Consent level (CL) as user data stored in the data repositories?

What provisioning standards does WSO2 support?

How can I setup WSO2 IS as a KDC?

You have to change following configuration files in order to enable KDC and this solution is applicable for IS 3.2.x

1) embedded-ldap.xml (CARBON_HOME/repository/conf)

<KDCServer>

<Property name="name">defaultKDC</Property>

<Property name="enabled">true</Property>

<Property name="protocol">UDP</Property>

<Property name="host">localhost</Property>

<Property name="port">${Ports.EmbeddedLDAP.KDCServerPort}</Property>

<Property name="maximumTicketLifeTime">8640000</Property>

<Property name="maximumRenewableLifeTime">604800000</Property>

<Property name="preAuthenticationTimeStampEnabled">true</Property>

</KDCServer>

2) user-mgt.xml (CARBON_HOME/repository/conf)

<Property name="kdcEnabled">true</Property>

If KDC is sucessfully enabled, you'll see followng log printed when server is starting

INFO {org.apache.directory.server.kerberos.kdc.KdcServer} - Kerberos service started. Kerberos service started.

Now login thorough management console and go to Configure -> Kerberos KDC -> Service Principals. You can see that "Add new service principals" option is now enabled and you'll be able to add service principals through that option.

How can I change the host-name of the Identity Server ?

If you want to change the host-name you need to do the following configuration changes..

Please find the following two elements inside [IS_HOME]/repository/conf/identity.xml and change the "localhost" to your IP address.

<openidserverurl>https://localhost:9443/openidserver</OpenIDServerUrl> <openiduserpattern>https://localhost:9443/openid/</OpenIDUserPattern>

You need not to change the keystore [JKS files] to change the host name.

But, in a production setup we would recommend you to change the key store.

You can create a keystore using the keytool which comes with JDK.

How to install a new feature in WSO2 Identity Server ?

Please follow this [1] blog post.

[1]. http://sureshatt.blogspot.com/2012/04/how-to-install-new-feature-on-wso2.html

How wso2 products does support running multiple instances using Virtual ip?

You can refer the following article [1] to make relevant changes for public transports. Also, local ports for JMX, Qpid and LDAP need to be changed in order to support virtual ip with carbon instances.

Qpid is currently supporting virtual ip. JMX and LDAP will also support in future. After that you can run carbon instances with same port by configuring virtual ips.

[1]. https://wso2.org/jira/browse/CARBON-13143

Does Identity Server support "no-encryption" association session?

no-encryption modes works with no issues with WSO2 Identity Server. In fact, openid4java client side library keeps this as the last option - so even-though in our client code if we set this as the preferred way, since this is not encouraged - openid4java takes this as last option and keeps on to build the association with HMAC-SHA256 and encryption. To avoid that to use the week form - we had to tweak the openid4java client side library - you can find it at https://svn.wso2.org/repos/wso2/people/pradeeban/jars/openid4java-nodeps-0.9.6.jar

You can try this by your self in the rp1 webapp...

*** Modify the RP1 code - RP1Servlet.java search for

manager = new ConsumerManager();

and just after the above line add the following...

manager.setPrefAssocSessEnc(AssociationSessionType.NO_ENCRYPTION_SHA1MAC);

*** Now build rp1.war

*** Once the war file is exploded in Tomcat, please replace the openid4java library there with the attached one. [[CATALINA_HOME\webapps\rp1\WEB-INF\lib]

*** If you look at the association request, it will be like this.

openid.ns:http://specs.openid.net/auth/2.0 openid.mode:associate openid.session_type:no-encryption openid.assoc_type:HMAC-SHA1

*** If you look at the association response, it will be like this..

ns:http://specs.openid.net/auth/2.0 session_type:no-encryption assoc_type:HMAC-SHA1 assoc_handle:1336219492632-9 expires_in:1799 mac_key:crnx2KRe+REA/h0WtJXkg/nhiJc= 
End to end flow works with no issue.

Deploy WSO2 Identity Server over MySQL

Yes, It is possible. This blog post by Prabath explains the steps which should be followed in order to deploy WSO2 Identity Server over MySQL.

How to map Identity Server schemas for specific profiles?

Identity Server does not have specific schemas for different profiles. Rather it has a generic schema for profiles which can be extended by adding new claims. And it has a concept of the dialects which represents a set of claims required for particular format.

For example, if you take Facebook, then it is possible to define a new dialect for Facebook containing the claims provided by a Facebook profile. Then these Facebook claims can be mapped with the generic claim definitions. This concept is known as claim mapping.

So in summary, for storing the claims, it uses a generic schema. But the claims can be retrieved through the claim definitions of that particular dialect which are internally mapped with the generic schema.

In claim-config.xml, you can find the dialect URI "http://wso2.org/claims" which is the first of the dialect URIs (which is also used as the carbon dialect). Under this you can find all the claims that are used by our carbon servers to store user profile data in user stores. We can used the same dialect and store some of the properties that can be obtained using the Facebook and Twitter APIs. E.g. in Facebook we store full name, gender, email address and country, while in Twitter we store full name, country and locality.

Please list out all the non-apache 2 licensed software in IS, if any ?

Non-apache2 licenses used in IS are listed below. The licensing information can be found using the CARBON_HOME/LICENSE.txt file.

lgpl3 [GNU LESSER GENERAL PUBLIC LICENSE Version 3]

cpl1 [Common Public License 1.0]

epl1 [Eclipse Public License]

lgpl2 [Lesser GPL v2.1]

icu [ICU License]

sunbinary [Binary Code License Agreement]

mit [MIT License]

bsd [Berkeley License]

cddl1 [Common Development and Distribution License]

bouncy [Bouncy Castle License]

other http://sunxacml.sourceforge.net/license.txt

Does WSO2 platform provide support for mobile phone access?

In the mobile phone access scenarios lightweight authentication mechanisms such as sending REST like tokens from OAuth and using Mutual SSL can be considered.

Do we have a way to support off-line process to support off-line verification / validation of user identities

No current support is available for this feature.

Do we have SPML (Service Provisioning Markup Language) XML based standard in wso2 platform?

Currently not supported, due to its heavyweight nature and being bias to SOAP.

But instead, the WSO2 platform will have SCIM (Simple Cloud Identity Management) specification support, which the implementation is currently in progress.

How easy it is to use carbon administration console and a security monitoring tool for security based administration?

The WSO2 Identity Server packages an UI based PAP component for XACML and a collection of relying party components in an easy to use, rich UI based and intuitive management console. Any security configuration can be done and the applied security policies and other viewing capabilities can be handled via this GUI based admin console.

How can I write my own custom authenticator?

The blog post [1] by Hasini, describes how to write an authenticator, including a sample custom authenticator.

[1]http://hasini-gunasinghe.blogspot.com/2011/08/carbon-authentication-framework.html

How can I access the XDAS audit information of the WSO2 Identity Server? Is there any User Interface for this?

XDAS was only done in IS in a PoC level, and there's no immediate plan to integrate it into the Identity Server product as yet. The general audit logs of IS can be found at $IS_ROOT/repository/logs/audit.log.

Where can I get the use case diagrams and the documents such as Software Requirements specification and use cases?

The documents can be found at https://svn.wso2.org/repos/wso2/people/pradeeban/IS/docs

The use case and the other diagrams, along with their respective umbrello source files, can be found at https://svn.wso2.org/repos/wso2/people/pradeeban/IS/diagrams

The Google Spread sheet of the SRS is at https://docs.google.com/a/wso2.com/document/d/1eXeliLdaxymJmS5C3kz5JFuV4PQb36jWgflBMo8FuCo/edit?pli=1#

Where can I find a document about "API for integrating identity management to any application"?

You can use the document at [1] [1]https://svn.wso2.com/wso2/svn/supsup/Documents/IS/4.0.0/RemoteUserManagement_API.pdf

Document on API for integrating identity management to any application

You can use the document at [1] [1]https://svn.wso2.com/wso2/svn/supsup/Documents/IS/4.0.0/RemoteUserManagement_API.pdf

Where can I find the Identity Server use cases and design documents?

The documents can be found at https://svn.wso2.org/repos/wso2/people/pradeeban/IS/docs The use case and the other diagrams, along with their respective umbrello source files, can be found at https://svn.wso2.org/repos/wso2/people/pradeeban/IS/diagrams

The Google Spread sheet of the SRS is at https://docs.google.com/a/wso2.com/document/d/1eXeliLdaxymJmS5C3kz5JFuV4PQb36jWgflBMo8FuCo/edit?pli=1#

OAuth

How can I secure a proxy service running in ESB with 2-legged OAuth?

<oauthService xmlns="http://ws.apache.org/ns/synapse" remoteServiceUrl="" /> 

<proxy name="ProxyName" transports="https http" startOnLoad="true" trace="disable"> 
 <target>
  <inSequence> 
 <oauthService remoteServiceUrl="https://localhost:9443/services/"/>
  <send> ..... </send> ...
  </inSequence>
 <outSequence> ...
 </outSequence> 
</target> 
</proxy> 

$.ajax({
    type: "GET",
    url: "{API URL}",
    beforeSend: function(xhr, settings){
            xhr.setRequestHeader('Authorization', 'Bearer {Access Token}');}, //set access token from step5
    success: function(data){
        alert(data);
    }
});

<saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xs="http://www.w3.org/2001/XMLSchema" ID="urn:uuid:FF7F36F2DC68C5987C1377114779114" IssueInstant="20 
13-08-21T19:52:59.118Z" Version="2.0"><saml2:Issuer>localhost</saml2:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> 
<ds:SignedInfo> 
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /> 
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /> 
<ds:Reference URI="#urn:uuid:FF7F36F2DC68C5987C1377114779114"> 
<ds:Transforms> 
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /> 
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="xs" /></ds:Transform> 
</ds:Transforms> 
<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /> 
<ds:DigestValue>dmVzma4jtxt42kfdV1anRmz12MQ=</ds:DigestValue> 
</ds:Reference> 
</ds:SignedInfo> 
<ds:SignatureValue> 
B2kLRrvZrEc0+APpCwYqfTAX16GggXAdkr7Nryn0EDZP6/kCxvb3jBOsvBp/Gg3uZ/aaj7CPvikl 
W6GV0At1GIGkK+9FJR3JErC+3QbOhtP5JMjn7cw+dNiezcIPn/vj7wp3LXf3XMOmhRoplVgEQ6sv 
fIFFKPbn6G5h9gaizWU= 
</ds:SignatureValue> 
<ds:KeyInfo><ds:X509Data><ds:X509Certificate>MIICNTCCAZ6gAwIBAgIES343gjANBgkqhkiG9w0BAQUFADBVMQswCQYDVQQGEwJVUzELMAkGA1UE 
CAwCQ0ExFjAUBgNVBAcMDU1vdW50YWluIFZpZXcxDTALBgNVBAoMBFdTTzIxEjAQBgNVBAMMCWxv 
Y2FsaG9zdDAeFw0xMDAyMTkwNzAyMjZaFw0zNTAyMTMwNzAyMjZaMFUxCzAJBgNVBAYTAlVTMQsw 
CQYDVQQIDAJDQTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzENMAsGA1UECgwEV1NPMjESMBAGA1UE 
AwwJbG9jYWxob3N0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCUp/oV1vWc8/TkQSiAvTou 
sMzOM4asB2iltr2QKozni5aVFu818MpOLZIr8LMnTzWllJvvaA5RAAdpbECb+48FjbBe0hseUdN5 
HpwvnH/DW8ZccGvk53I6Orq7hLCv1ZHtuOCokghz/ATrhyPq+QktMfXnRS4HrKGJTzxaCcU7OQID 
AQABoxIwEDAOBgNVHQ8BAf8EBAMCBPAwDQYJKoZIhvcNAQEFBQADgYEAW5wPR7cr1LAdq+IrR44i 
QlRG5ITCZXY9hI0PygLP2rHANh+PYfTmxbuOnykNGyhM6FjFLbW2uZHQTY1jMrPprjOrmyK5sjJR 
O4d1DeGHT/YnIjs9JogRKv4XHECwLtIVdAbIdWHEtVZJyMSktcyysFcvuhPQK8Qc/E/Wq8uHSCo=</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml2:Subject><saml2:NameID Format= 
"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">admin</saml2:NameID><saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer" /></saml2:Subject><saml2 
:Conditions NotBefore="2013-08-21T19:52:59.147Z" NotOnOrAfter="2013-08-21T19:57:59.147Z" /><saml2:AuthnStatement AuthnInstant="2013-08-21T19:52:59.149Z"><saml2:AuthnContext><s 
aml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml2:AuthnContextClassRef></saml2:AuthnContext></saml2:AuthnStatement><saml2:AttributeStatement><sa 
ml2:Attribute Name="http://wso2.org/claims/emailaddress" NameFormat="http://wso2.org/claims/emailaddress"><saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-ins 
tance" xsi:type="xs:string">manisha.eleperuma@gmail.com</saml2:AttributeValue></saml2:Attribute><saml2:Attribute Name="http://wso2.org/claims/givenname" NameFormat="http://wso 
2.org/claims/givenname"><saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">manisha</saml2:AttributeValue></saml2:Attribute></saml 
2:AttributeStatement></saml2:Assertion> 
Token is valid 
<ns:echoStringResponse xmlns:ns="http://echo.services.core.carbon.wso2.org"><return>Hello World</return></ns:echoStringResponse>

__ Getting the STS Sample App __ 
1. Download the sts sample (java app) from: https://svn.wso2.org/repos/wso2/people/dulanja/samples/sts-sample.zip and extract it. 
__ Configuring the IS 4.0.0 __ 
[STS] 
2. Start IS 4.0.0 and go to "Security Token Service" in the Management Console. 
3. Click "Apply Security Policy" and select "yes" for "Enable Security" 
4. Choose first option - "UsernameToken" and press "Next". 
5. Select "admin" and "everyone" user groups and press "Finish". 
[PDP] 
6. In IS Management Console, go to Entitlement --> Administration and click "Import New Entitlement Policy" 
7. Using the "Browse" button, upload the attached 'echoServicePolicy.xml' file. 
8. Back again in the "Policy Administration" page, you will see the uploaded policy file displayed in "Available Entitlement Policies" table. Click "Enable" and "Promote To PDP" links in that table. 
__ Configuring ESB 4.5.0 __ 
9. Place the attached 'EchoProxy.xml' in "wso2esb-4.5.0/repository/deployment/server/synapse-configs/default/proxy-services" folder. 
10. Start ESB 4.5.0 
11. In the Management Console, go to Registry --> Browse. Go to '/_system/config/repository/esb' and create a new collection named "policies" by using "Add Collection" link. 
12. Go inside the policies collection and click "Add Resource". Then using the "Browse" button, upload the 'service-policy.xml' file at 'sts-sample/src/main/resources' folder and press 'Add'. 
__ Running the STS Sample __ 
13. Run the sts-sample by using the sts-client.sh (sts-client.bat if windows) which is located at sample's root level. You should see an output similar to the attached 'sts-sample-output.png'. 
      It shows the received token from STS and the response ("Hello World") from the ESB echo service. 
Please note that, in this scenario IS runs with the port offset 0 (i.e. on port 9443) and ESB with offset 1 (i.e. 9444). If your servers run on different ports, you should configure the following: 
* 'address.relyingParty' and 'address.sts' properties in 'sts-sample/src/main/resources/client.properties' file. 
* service endpoint address in EchoProxy.xml 
* resource value in echoServicePolicy.xml