Configuring a JDBC User Store

When you configure a JDBC user store as the primary user store, you can either use the default configuration or you can change it in the following ways:

• You can set up two separate databases for the Authorization Manager and the User Store Manager.
• It is not recommended to use the default H2 database in production. Therefore, you can replace this as instructed in the related documentation.

Therefore, before you begin, ensure that the RDBMS that you want to use as the JDBC user store is correctly set up for your system. Then, follow the steps given below to configure a JDBC user store as the primary user store in your product.

Step 1: Configuring the JDBC user store manager

To configure a JDBC user store as the primary user store, you must change the JDBCUserStoreManager section in the <PRODUCT_HOME>/repository/conf/user-mgt.xml file. 

1. Uncomment the following section:

   <UserStoreManager class="org.wso2.carbon.user.core.jdbc.JDBCUserStoreManager">

2. Specify the connection to the RDBMS inside the JDBC user store manager according to your requirement. For more information about user store properties, see the related documentation.

   The sample for the external JDBC user store consists of properties pertaining to various SQL statements. This is because the schema may be different for an external user store, and these adjustments need to be made in order to streamline the configurations with WSO2 products.

3. Add the PasswordHashMethod property to the UserStoreManager configuration for JDBCUserStoreManager. For example:

   <UserStoreManager class="org.wso2.carbon.user.core.jdbc.JDBCUserStoreManager">
        <Property name="PasswordHashMethod">SHA</Property>
        ...
   </UserStoreManager>

   The PasswordHashMethod property specifies how the password should be stored. It usually has the following values:

   • SHA - Uses SHA digest method.
   • MD5 - Uses MD 5 digest method.
   • PLAIN_TEXT - Plain text passwords.

   In addition, it also supports all digest methods in http://docs.oracle.com/javase/6/docs/api/java/security/MessageDigest.html.

4. If you are setting up an external JDBC user store, you need to set the following property to 'true' to be able to create roles in the primary user store.

   <Property name="WriteGroups">false</Property>

Step 2: Updating the system administrator

The admin user is the super tenant that will be able to manage all other users, roles and permissions in the system by using the management console of the product. Therefore, the user that should have admin permissions is required to be stored in the user store when you start the system for the first time. If the JDBC user store is read-only, then we need to always use a user ID that is already in the user store as the super tenant. Otherwise, if the JDBC user store can be written to, you have the option of creating a new admin user in the user store when you start the system for the first time. Refer the related topics for information about the system administrator.

These two alternative configurations can be done as explained below.

• If the user store is read-only, find a valid user that already resides in the RDBMS. For example, say a valid username is AdminSOA. Update the <AdminUser> section of your configuration as shown below. You do not have to update the password element as it is already set in the user store.

  <AddAdmin>False</AddAdmin> 
  <AdminRole>admin</AdminRole> 
  <AdminUser> 
   <UserName>AdminSOA</UserName> 
   <Password>XXXXXX</Password> 
  </AdminUser>

• If the user store can be written to, you can add the super tenant user to the user store. Therefore, <AddAdmin> should be set to true as shown below.

  <AddAdmin>true</AddAdmin> 
  <AdminRole>admin</AdminRole> 
  <AdminUser> 
   <UserName>admin</UserName> 
   <Password>admin</Password> 
  </AdminUser>

In the realm configuration section, set the value of the MultiTenantRealmConfigBuilder property to org.wso2.carbon.user.core.config.multitenancy.SimpleRealmConfigBuilder. For example:

<Property name="MultiTenantRealmConfigBuilder">org.wso2.carbon.user.core.config.multitenancy.SimpleRealmConfigBuilder</Property>

Step 3: Updating the datasources

Whenever there is an RDBMS set up for your system, it is necessary to create a corresponding datasource, which allows the system to connect to the database. The datasource for the internal H2 database that is shipped with WSO2 products by default, is configured in the master-datasources.xml file, which is stored in the <PRODUCT_HOME>/repository/conf/datasources/ directory. Refer the related topics for detailed information on setting up databases and configuring datasources.

1. There are two possible methods for updating datasources:

   • Shown below is how the master-datasources.xml file is configured to connect to the default H2 database in your system. If you have replaced the default database with a new RDBMS, which you are now using as the JDBC users store, you have to update the master-datasource.xml file with the relevant information. 
     

     <datasource>
                 <name>WSO2_CARBON_DB</name>
                 <description>The datasource used for registry and user manager</description>
                 <jndiConfig>
                     <name>jdbc/WSO2CarbonDB</name>
                 </jndiConfig>
                 <definition type="RDBMS">
                     <configuration>
                         <url>jdbc:h2:repository/database/WSO2CARBON_DB;DB_CLOSE_ON_EXIT=FALSE;LOCK_TIMEOUT=60000</url>
                         <username>wso2carbon</username>
                         <password>wso2carbon</password>
                         <driverClassName>org.h2.Driver</driverClassName>
                         <maxActive>50</maxActive>
                         <maxWait>60000</maxWait>
                         <testOnBorrow>true</testOnBorrow>
                         <validationQuery>SELECT 1</validationQuery>
                         <validationInterval>30000</validationInterval>
                     </configuration>
                 </definition>
     </datasource> 

1. • Alternatively, instead of using the master-datasource.xml file, you can also create a new XML file with the datasource information of your new RDBMS and store it in the same <PRODUCT_HOME>/repository/conf/datasources/ directory. 
     
2. Now, the datasource configuration and the user store manager configuration in the user-mgt.xml file should be linked together. You can do this by referring to the datasource information (typically defined in the master-datasources.xml file) from the user-mgt.xml file as explained below.
   

   • The RDBMS that is used for storing Authorization information is configured under the <Configuration> section in the user-mgt.xml file, by adding <Property name="dataSource"> as shown below. The following example refers to the default H2 database. 

     <Configuration> 
         ....... 
         <Property name="dataSource">jdbc/WSO2CarbonDB</Property> 
     </Configuration>

     If you are using the same RDBMS as the user store in your system, this datasource reference will suffice.

   • However, if you have set up a separate RDBMS as the user store, instead of using a common RDBMS for Authorization information as well as the user store, you must refer to the datasource configuration from within the User Store Manager configuration in the user-mgt.xml file by adding the <Property name="dataSource"> property. 

Step 4: Starting the server

1. Add the JDBC driver to the classpath by copying its JAR file into the <PRODUCT_HOME>/repository/components/lib directory. 
2. Start the server.

Related Topics