Configuring an Identity Provider

An Identity Provider (IdP) is responsible for issuing identification information and authenticating users by using security tokens like SAML 2.0. This is a favourable alternative to explicitly authenticating a user within a security realm.

The responsibility of the identity provider configuration is to represent external identity providers. These external identity providers can be Facebook, Yahoo, Google, Salesforce, Microsoft Windows Live, etc. If you want to authenticate users against these identity providers, then you must associate one or more federated authenticators with the WSO2 Identity Server. For example, if you want to authenticate users against Salesforce, then you must associate the SAML 2.0 authenticator with the Salesforce identity provider, if you want to authenticate users against Yahoo, then you must associate the OpenID authenticator with it. To make this process much easier, the Identity Server also comes with a set of more specific federated authenticators. For example, if you want authenticate against Facebook, you do not need to configure OAuth 2.0 authenticator. Instead you can directly use the Facebook federated authenticator.

Each identity provider configuration can also maintain a claim mapping. This is to map the identity provider's own set of claims to the Identity Server's claims. When the response from an external identity provider is received by the response processor component of the federated authenticator, before it hands over the control to the authentication framework, the response processor will create a name/value pair of user claims received in the response from the identity provider. These claims are specific to the external identity provider. Then it is the responsibility of the authentication framework to read the claim mapping configuration from the identity provider component and do the conversion. So, while inside the framework, all the user claim values will be in a common format.

So, in short, the WSO2 Identity Server allows you to add identity providers and specify various details that help you to link the identity provider to the Identity Server. So you must specify all information required to send the authentication requests and get a response back from the identity provider. This topic contains the following sections.

Adding an identity provider

Follow the instructions below to add a new identity provider.

1. Sign in. Enter your username and password to log on to the Management Console. 

2. Navigate to the Main menu to access the Identity menu. Click Add under Identity Providers.

3. Fill in the details in the Basic Information section. 
   

   
   Note the following when filling the above form.

4. Enter the Identity Provider Name and provide a brief Description of the identity provider. Only Identity Provider Name is a required field.

5. Fill in the remaining details where applicable. Click the arrow buttons to expand the forms available to update.
   

6. Click Register to add the Identity Provider.

Configuring a resident identity provider

WSO2 Identity Server can mediate authentication requests between service providers and identity providers. At the same time, the Identity Server itself can act as a service provider and an identity provider. When it acts as an identity provider it is known as the resident identity provider.

The resident identity provider configuration is very relevant for you if you are a service provider and want to send an authentication request or a provisioning request to the Identity Server (say via SAML, OpenID, OpenID Connect, SCIM, and WS-Trust). See Configuring WS-Trust STS for an example of how resident identity provider is used to implement security token service. 

Resident identity provider configuration is a one time configuration for a given tenant. It basically shows you the Identity Server's metadata, like the endpoints. In addition to the metadata, you can configure this if you want to secure the WS-Trust endpoint with a security policy.

Follow the instructions below to configure a resident identity provider.

1. Sign in. Enter your username and password to log on to the Management Console.

2. In the Main menu under the Identity section, click List under Identity Providers. The list of identity providers you added appears.
   Click the Resident Identity Provider link.
   

   
   The Resident Identity Provider page appears.
   
   
   Enter a Home Realm Identifier for the resident identity provider. You can enter multiple identifiers as a comma separated list.

3. Configure inbound authentication if required. This is not mandatory for creating a resident identity provider.

   • Set the Identity Provider Entity Id under SAML2 Web SSO Configuration. Specifying this gives the tenant identification, so any users provisioned through this tenant can be identified as such.

   • Configure the WS-Trust/WS-Federation (Passive). You can configure this if you want to secure the WS-Trust endpoint with a security policy.
     

4. Click Update.

5. Click Ok to the confirmation message that appears.

Note the following information regarding the URLs on this screen.

<HostName>localhost</HostName>

<IdentityProviderURL>https://localhost:9443/samlsso</IdentityProviderURL>

Managing identity providers

This section provides instructions on how to manage identity providers once they are created.

Viewing identity providers

Follow the instructions below to view the list of identity providers added in the WSO2 Identity Server.

1. Sign in. Enter your username and password to log on to the Management Console.

2. In the Main menu under the Identity section, click List under Identity Providers. The list of identity providers you added appears.

Editing identity providers

Follow the instructions below to edit an identity provider's details.

1. Sign in. Enter your username and password to log on to the Management Console.

2. In the Main menu under the Identity section, click List under Identity Providers. The list of identity providers you added appears.

3. Locate the identity provider you want to edit and click on the corresponding Edit link.

4. You are directed to the edit screen where you can modify the details you configured for the identity provider.

Deleting identity providers

Follow the instructions below to delete an identity provider.

1. Sign in. Enter your username and password to log on to the Management Console.

2. In the Main menu under the Identity section, click List under Identity Providers. The list of identity providers you added appears.

3. Locate the identity provider you want to delete and click on the corresponding Delete link.

4. Confirm your request in the WSO2 Carbon window. Click the Yes button.

Disabling/Enabling identity providers

Follow the instructions below to disable or enable an identity provider.

1. Sign in. Enter your username and password to log on to the Management Console.

2. In the Main menu under the Identity section, click List under Identity Providers. The list of identity providers you added appears.

3. Locate the identity provider you want to delete and click on the corresponding Disable link to disable the identity provider. Clicking this link will change the link to Enable. To enable the identity provider again, click the Enable link.

4. Click Ok on the confirmation form that appears when clicking Disable/Enable.