Configuring a JDBC User Store

User management functionality is provided by default in all WSO2 Carbon-based products and is configured in the user-mgt.xml file found in the <PRODUCT_HOME>/repository/conf/ directory. This file is shipped with user store manager configurations for all possible user store types (JDBC, read-only LDAP/Active Directory, read-write LDAP and read-write Active directory). The instructions given below explains how to configure an RDBMS (JDBC) as the primary user store for the WSO2 server.

When you configure a JDBC user store as the primary user store, you can either use the default configuration or you can change it in the following ways:

• You can set up two separate databases for the Authorization Manager and the User Store Manager.
• It is not recommended to use the default H2 database in production. Therefore, you can replace this. For instructions on replacing this by setting up a new RDBMS and configuring it for your system, see Setting Up the Physical Database.

Therefore, before you begin, ensure that the RDBMS that you want to use as the JDBC user store is correctly set up for your system. Then, follow the steps given below to configure a JDBC user store as the primary user store in your product.

Step 1: Configuring the JDBC user store manager

To configure a JDBC user store as the primary user store, you must change the JDBCUserStoreManager section in the <PRODUCT_HOME>/repository/conf/user-mgt.xml file. 

1. Uncomment the following section:

   <UserStoreManager class="org.wso2.carbon.user.core.jdbc.JDBCUserStoreManager">

2. Specify the connection to the RDBMS inside the JDBC user store manager according to your requirement. For more information on user store properties in the <PRODUCT_HOME>/repository/conf/user-mgt.xml file which are used for configuring the primary user store, see Properties of Primary User Stores.

    

   The sample for the external JDBC user store consists of properties pertaining to various SQL statements. This is because the schema may be different for an external user store, and these adjustments need to be made in order to streamline the configurations with WSO2 products.

3. Add the PasswordHashMethod property to the UserStoreManager configuration for JDBCUserStoreManager. For example:

   <UserStoreManager class="org.wso2.carbon.user.core.jdbc.JDBCUserStoreManager">
        <Property name="PasswordHashMethod">SHA</Property>
        ...
   </UserStoreManager>

   The PasswordHashMethod property specifies how the password should be stored. It usually has the following values:

   • SHA - Uses SHA digest method.
   • MD5 - Uses MD 5 digest method.
   • PLAIN_TEXT - Plain text passwords.

   In addition, it also supports all digest methods in http://docs.oracle.com/javase/6/docs/api/java/security/MessageDigest.html.

4. If you are setting up an external JDBC user store, you need to set the following property to 'true' to be able to create roles in the primary user store.

   <Property name="WriteGroups">false</Property>

Step 2: Updating the system administrator

The admin user is the super tenant that will be able to manage all other users, roles and permissions in the system by using the management console of the product. Therefore, the user that should have admin permissions is required to be stored in the user store when you start the system for the first time. If the JDBC user store is read-only, then we need to always use a user ID that is already in the user store as the super tenant. Otherwise, if the JDBC user store can be written to, you have the option of creating a new admin user in the user store when you start the system for the first time. For information on configuring the system administrator user, see Configuring the System Administrator.

These two alternative configurations can be done as explained below.

• If the user store is read-only, find a valid user that already resides in the RDBMS. For example, say a valid username is AdminSOA. Update the <AdminUser> section of your configuration as shown below. You do not have to update the password element as it is already set in the user store.

  <AddAdmin>False</AddAdmin> 
  <AdminRole>admin</AdminRole> 
  <AdminUser> 
   <UserName>AdminSOA</UserName> 
   <Password>XXXXXX</Password> 
  </AdminUser>

• If the user store can be written to, you can add the super tenant user to the user store. Therefore, <AddAdmin> should be set to true as shown below.

  <AddAdmin>true</AddAdmin> 
  <AdminRole>admin</AdminRole> 
  <AdminUser> 
   <UserName>admin</UserName> 
   <Password>admin</Password> 
  </AdminUser>

In the realm configuration section, set the value of the MultiTenantRealmConfigBuilder property to org.wso2.carbon.user.core.config.multitenancy.SimpleRealmConfigBuilder. For example:

<Property name="MultiTenantRealmConfigBuilder">org.wso2.carbon.user.core.config.multitenancy.SimpleRealmConfigBuilder</Property>

Step 3: Updating the datasources

Whenever there is an RDBMS set up for your system, it is necessary to create a corresponding datasource, which allows the system to connect to the database. The datasource for the internal H2 database that is shipped with WSO2 products by default, is configured in the master-datasources.xml file, which is stored in the <PRODUCT_HOME>/repository/conf/datasources/ directory. For detailed information on setting up databases, see Setting Up the Physical Database, and for information on the purpose of defining datasources and how they are configured for a product, see Managing Datasources.

1. There are two possible methods for updating datasources:

   • Shown below is how the master-datasources.xml file is configured to connect to the default H2 database in your system. If you have replaced the default database with a new RDBMS, which you are now using as the JDBC users store, you have to update the master-datasource.xml file with the relevant information. 
     

     <datasource>
                 <name>WSO2_CARBON_DB</name>
                 <description>The datasource used for registry and user manager</description>
                 <jndiConfig>
                     <name>jdbc/WSO2CarbonDB</name>
                 </jndiConfig>
                 <definition type="RDBMS">
                     <configuration>
                         <url>jdbc:h2:repository/database/WSO2CARBON_DB;DB_CLOSE_ON_EXIT=FALSE;LOCK_TIMEOUT=60000</url>
                         <username>wso2carbon</username>
                         <password>wso2carbon</password>
                         <driverClassName>org.h2.Driver</driverClassName>
                         <maxActive>50</maxActive>
                         <maxWait>60000</maxWait>
                         <testOnBorrow>true</testOnBorrow>
                         <validationQuery>SELECT 1</validationQuery>
                         <validationInterval>30000</validationInterval>
                     </configuration>
                 </definition>
     </datasource>

1. • Alternatively, instead of using the master-datasource.xml file, you can also create a new XML file with the datasource information of your new RDBMS and store it in the same <PRODUCT_HOME>/repository/conf/datasources/ directory. 
     
2. Now, the datasource configuration and the user store manager configuration in the user-mgt.xml file should be linked together. You can do this by referring to the datasource information (typically defined in the master-datasources.xml file) from the user-mgt.xml file as explained below.
   

   • The RDBMS that is used for storing Authorization information is configured under the <Configuration> section in the user-mgt.xml file, by adding <Property name="dataSource"> as shown below. The following example refers to the default H2 database. 

     <Configuration> 
         ....... 
         <Property name="dataSource">jdbc/WSO2CarbonDB</Property> 
     </Configuration>

     If you are using the same RDBMS as the user store in your system, this datasource reference will suffice.

   • However, if you have set up a separate RDBMS as the user store, instead of using a common RDBMS for Authorization information as well as the user store, you must refer to the datasource configuration from within the User Store Manager configuration in the user-mgt.xml file by adding the <Property name="dataSource"> property. 

Step 4: Starting the server

1. Add the JDBC driver to the classpath by copying its JAR file into the <PRODUCT_HOME>/repository/components/lib directory. 
2. Start the server.