Basic Client Profile with Playground

This section demonstrates the WSO2 Identity Server's OpenID Connect Basic Client Profile implementation with the WSO2 OAuth2 playground sample.

Setting up the playground sample

First follow the instructions in the sections below to set up the playground sample and register it in WSO2 IS. Once you have done so, complete the user profile and try out the scenario.

Set up the WSO2 OAuth2.0 Playground sample

To obtain and configure the Playground sample, follow the steps below.

You can check out the repository of the OAuth 2.0 sample from GitHub. Follow the instructions here to checkout the folder. We refer <SAMPLE_HOME> as the modules/samples folder inside the folder where the product-is repository is checked out.
```
https://github.com/wso2/product-is/tree/master/modules/samples/oauth2/playground2
```
In your command line, navigate to <SAMPLE_HOME>/oauth2/playground2 in the folder you checked out and build the sample using the following command. You must have Apache Maven installed to do this (see Installation Prerequisites for the appropriate version to use).
```
mvn clean install
```
After successfully building the sample, a .war file named playground2 can be found inside the <SAMPLE_HOME>/oauth2/playground2/target folder. Deploy this sample web app on a web container. To do this, use the Apache Tomcat server.

Since this sample is written based on Servlet 3.0 it needs to be deployed on Tomcat 7.x.
Use the following steps to deploy the web app in the web container:
1. Stop the Apache Tomcat server if it is already running.
2. Copy the playground2.war file to the <TOMCAT_HOME>/webapps folder.
3. Start the Apache Tomcat server.

Make sure to update param-value the following parameter in the WEB-INF/web.xml file with the server url of the Identity Server if required.
```
<init-param>
     <description>serverUrl</description>
     <param-name>serverUrl</param-name>
     <param-value>https://localhost:9443/services/</param-value>
</init-param>
```
Note that localhost is the server that hosts WSO2 Identity Server and 9443 is the default SSL port of it.

Update param-value of below parameters with credentials of an admin user if required.

<init-param>
     <description>userName</description>
     <param-name>userName</param-name>
     <param-value>admin</param-value>
</init-param>
<init-param>
     <description>password</description>
     <param-name>password</param-name>
     <param-value>admin</param-value>
</init-param>

Restart Apache Tomcat and access http://localhost:8080/playground2.0/ (assuming Tomcat is running on HTTP port 8080). You are directed to the landing page of the sample application. Click on Import Photos and the following page appears.

This application is used to request access tokens using the four OAuth2 grant types.

Register the Playground application in WSO2 Identity Server

In order to configure Single-Sign-On (SSO) for OAuth2-OpenID Connect, you must first register a service provider for inbound authentication.

Unable to render {include} The included page could not be found.

Complete the user profile

Create a user.
Log in as the user you created and go to the dashboard.
Update your profile filling the user attributes.
You can also do this at Main > List > Users and Roles > Users, then select the user and update the profile.
Click Update to save your changes.

Try out scenario

Visit the URL http://localhost:8080/playground2/oauth2.jsp to start the scenario with the sample application.
Enter the following details and click Authorize.
- Authorization Grant Type: Authorization Code
- Client ID: (the client id received at the application registration step in Identity Server)
- Scope: openid (This scope is a requirement to provide user information. Any token without this scope will not be allowed to access user information.)
- Callback URL:http://localhost:8080/playground2/oauth2client
- Authorize Endpoint:https://localhost:9443/oauth2/authorize
Note: To try out this scenario with different consent values, see step 7.
Provide user credentials and sign in with the previously created user.
Click Approve to provide consent to this action. The screen mentions the service provider by name and requests for user consent to provide user information to that particular service provider. The user can either
1. Deny to provide information to the service provider.
2. Approve to provide user profile information to this service provider only for this time.
3. Approve Always to provide approval to share user profile information with the service provider even in the future without prompting for consent again.
Tip: After approval is provided, the application receives an authorization code issued from WSO2 Identity Server. This authorization code can only be used once to get a valid access token and has a expiry time that can be configured by editing the following property in the <IS_HOME>/repository/conf/identity/identity.xml file. The default expiry time is 300 seconds.
 <AuthorizationCodeDefaultValidityPeriod>300</AuthorizationCodeDefaultValidityPeriod>
Enter the following details in the form that appears and click Get Access Token.
- Callback URL:http://localhost:8080/playground2/oauth2client
- Access Token Endpoint:https://localhost:9443/oauth2/token
- Client Secret: (client secret received at the application registration)
At this point, the application receives the Access Token with the id token, which follows the format shown in step 7. Enter the UserInfo endpoint of the WSO2 Identity Server, (i.e., https://localhost:9443/oauth2/userinfo), in the form as seen below, to get user information.
Since the received access token has the scope 'openid', the userinfo endpoint provides the user attribute details when the request is made. You will receive the following response from the Identity Server.
Response
```
{  
   "scope":"openid",
   "token_type":"Bearer",
   "expires_in":3600,
   "refresh_token":"74d0d7e6d4b3c19484f5135593c2dc88",   		  "id_token":"eyJhbGciOiJSUzI1NiJ9.eyJhdXRoX3RpbWUiOjE0NTIxNzAxNzYsImV4cCI6MTQ1MjE3Mzc3Niwic3ViIjoidXNlQGNhcmJvbi5zdXBlciIsImF6cCI6IjF5TDFfZnpuekdZdXRYNWdCMDNMNnRYR3lqZ2EiLCJhdF9oYXNoIjoiWWljbDFlNTI5WlhZOE9zVDlvM3ktdyIsImF1ZCI6WyIxeUwxX2Z6bnpHWXV0WDVnQjAzTDZ0WEd5amdhIl0sImlzcyI6Imh0dHBzOlwvXC9sb2NhbGhvc3Q6OTQ0M1wvb2F1dGgyXC90b2tlbiIsImlhdCI6MTQ1MjE3MDE3Nn0.RqAgm0ybe7tQYvQYi7uqEtzWf6wgDv5sJq2UIQRC4OJGjn_fTqftIWerZc7rIMRYXi7jzuHxX_GabUhuj7m1iRzi1wgxbI9yQn825lDVF4Lt9DMUTBfKLk81KIy6uB_ECtyxumoX3372yRgC7R56_L_hAElflgBsclEUwEH9psE",
   "access_token":"f1824ef345f0565ab88a06a51db98d24"
}
```
The returned ID token carries the user details. It follows the following format: <header>.<body>.<signature>. The decoded ID token can be seen below.
Decoded ID Token
```
{"alg":"RS256"}.
{  
   "auth_time":1452170176,
   "exp":1452173776,
   "sub":"use@carbon.super",
   "azp":"1yL1_fznzGYutX5gB03L6tXGyjga",
   "at_hash":"Yicl1e529ZXY8OsT9o3y-w",
   "aud":[  
      "1yL1_fznzGYutX5gB03L6tXGyjga"
   ],
   "iss":"https:\/\/localhost:9443\/oauth2\/token",
   "iat":1452170176
}.<signature value>
 
```
Tip: Alternatively, you can get user information by running the following cURL command on the terminal.
You can also try out this scenario with different consent values {none, login and consent}. To do this, try the following URLs when entering the Authorization Endpoint URL in step 2 of the Try out scenario section.
- https://localhost:9443/oauth2/authorize?prompt=none - The Identity Server does not display any authentication or consent user interface pages. An error is returned if an end user is not already authenticated or the client does not have pre-configured consent for the requested claims or if there are any other unfulfilled conditions for processing the request.
- https://localhost:9443/oauth2/authorize?prompt=login - Even if the end user is already authenticated, it will prompt the end user for re-authentication.
- https://localhost:9443/oauth2/authorize?prompt=consent - Even if the consent is already given, it will prompt the end user for consent again before returning information to the Client.