Extending WSO2 Identity Server to Handle Custom SAML Assertions

Before reading this, please familiarize yourself with WSO2 Identity Server and Claim Aware Proxy Services with ESB.

Once you get the above running, all of the client requests to attributes are satisfied through Identity Server's default implementation.

To filter attributes being sent, invoke an EJB to obtain custom attributes, and insert them as an SAML assertion to the returning security token, you need to execute some custom logic inside Identity Server to manipulate attributes being added to the returning security token.

Follow the instructions below to do this.

1. Make sure the first scenario works fine. That is, make sure the Security Token with SAML attribute assertions is inserted by Identity Server.
2. To override it, you need to write a Carbon component to insert our custom logic.

3. Download and extract sample.aar. Next, run the following from the sample folder:

   mvn clean install

4. Now, you can find the bundle inside sample\org.wso2.carbon.identity.samples.attributeservice\target\org.wso2.carbon.identity.samples.attributeservice-2.0.0.SNAPSHOT.jar.
5. Stop Identity Server if it's already running.
6. Copy org.wso2.carbon.identity.samples.attributeservice-2.0.0.SNAPSHOT.jar to IS_HOME\webapps\ROOT\WEB-INF\plugins\server.

7. Open IS_HOME\webapps\ROOT\WEB-INF\eclipse\configuration\org.eclipse.equinox.simpleconfigurator\bundles.info and add the following entry to the end.

   org.wso2.carbon.identity.samples.attributeservice,2.0.0.SNAPSHOT,file:plugins/org.wso2.carbon.identity.samples.attributeservice-2.0.0.SNAPSHOT.jar,10,true

   Note

   It is one line.

8. Start the Identity Server with the following command:

   \> wso2server.bat -DosgiConsole -cleanCache

9. Once it has started, press "Enter" on the console to get the osgi prompt.

10. Type in the following there to list the available bundles.

    osgi\> ss

11. Check the status of the org.wso2.carbon.identity.samples.attributeservice bundle and get its bundle ID, for example, 164. If the status is RESOLVED, then type:

    osgi\> start 164

12. Once again, check the status with ss. It should be ACTIVE now.

13. Run the same client used here before. You can see the "First Name" attribute being overridden, as well as a new attribute being added. You can also see the following line on the console.
    

    INFO - SampleAttributeService being called