This site contains the documentation that is relevant to older WSO2 product versions and offerings.
For the latest WSO2 documentation, visit https://wso2.com/documentation/.
Adding and Configuring an Identity Provider
Introduction
An Identity Provider (IdP) is responsible for authenticating users and issuing identification information by using security tokens like SAML 2.0, OpenID Connect, OAuth 2.0 and WS-Trust. This is a favourable alternative to explicitly authenticating a user within a security realm.
The responsibility of the identity provider configuration is to represent external identity providers. These external identity providers can be Facebook, Yahoo, Google, Salesforce, Microsoft Windows Live, etc. If you want to authenticate users against these identity providers, then you must associate one or more federated authenticators with the WSO2 Identity Server. These identity providers support for different authentication protocols. For example, if you want to authenticate users against Salesforce, then you must associate the SAML 2.0 authenticator with the Salesforce identity provider, if you want to authenticate users against Yahoo, then you must associate the OpenID authenticator with it. To make this process much easier, the Identity Server also comes with a set of more specific federated authenticators. For example, if you want to authenticate against Facebook, you do not need to configure OAuth 2.0 authenticator. Instead, you can directly use the Facebook federated authenticator.
Each identity provider configuration can also maintain a claim mapping. This is to map the identity provider's own set of claims to the Identity Server's claims. When the response from an external identity provider is received by the response processor component of the federated authenticator, before it hands over the control to the authentication framework, the response processor will create a name/value pair of user claims received in the response from the identity provider. These claims are specific to the external identity provider. Then it is the responsibility of the authentication framework to read the claim mapping configuration from the identity provider component and do the conversion. So, while inside the framework, all the user claim values will be in a common format.
So, in short, the WSO2 Identity Server allows you to add identity providers and specify various details that help you to link the identity provider to the WSO2 Identity Server. Therefore, you must specify all information required to send the authentication requests and get a response back from the identity provider. This topic contains the following sections.
Adding an identity provider
Follow the instructions below to add a new identity provider.
Sign in. Enter your username and password to log on to the Management Console.
Navigate to the Main menu to access the Identity menu. Click Add under Identity Providers.
Fill in the details in the Basic Information section.
Note the following when filling the above form.
Field | Description | Sample Value |
|---|---|---|
Identity Provider Name | The Identity Provider Name must be unique as it is used as the primary identifier of the identity provider. | FacebookIdP, Twitter |
Display Name | The Display Name is used to identify the identity provider. If this is left blank, the Identity Provider Name is used. This is used in the login page when selecting the identity provider that you wish to use to log in to the service provider. | Facebook, Twitter |
Description | The Description is added in the list of identity providers to provide more information on what the identity provider is. This is particularly useful in situations where there are many identity providers configured and a description is required to differentiate and identify them. | This is the identity provider configuration. |
Federation Hub Identity Provider | Select the Federation Hub Identity Provider check-box to indicate if this points to an identity provider that acts as a federation hub. A federation hub is an identity provider that has multiple identity providers configured to it and can redirect users to the correct identity provider depending on their Home Realm identifier or their Identity Provider Name. When we have this check-box selected additional window will pop-up in the multi-option page in the first identity server to get the home realm identifier for the desired identity provider in the identity provider hub. | Selected |
Home Realm Identifier | The Home Realm Identifier value can be specified in each federated IDP and can send the Home Realm Identifier value as the “fidp” query parameter (e.g., fidp=googleIdp) in the authentication request by the service provider. The WSO2 Identity Server finds the IDP related to the “fidp” value and redirects the end user to the IDP directly rather than showing the SSO login page. By using this, you can avoid multi-option, in a multi-option scenario without redirecting to the multi-option page. | FB, TW |
Identity Provider Public Certificate | The Identity Provider Public Certificate is the public certificate belonging to the identity provider. Uploading this is necessary to authenticate the response from the identity provider. See Using Asymmetric Encryption in the WSO2 Product Administration Guide for more information on how public keys work and how to sign these keys by a certification authority. | This can be any certificate. If the identity provider is another Identity Server, this can be a |
Alias | The Alias is a value that has an equivalent value specified in the identity provider that we are configuring. This is required for authentication in some scenarios. |
|
About the federation hub and the home realm identifier
The federation hub has multiple identity providers configured to it. In a typical federation hub with multiple identity providers, each identity provider can have a unique home realm identifier that can be used to identify the identity provider you are logging into.
So when a user tries to log in to a service provider following flow will happen,
The Identity Server, which this service provider is configured to will find the required federated authenticator from the service provider configuration
If this Identity Provider configured as a federation hub, the user can specify the preferred identity provider in the federation hub using the multi-option page of the first Identity Server.
This information will pass with the authentication request to the federation hub.
When the request comes to the federation hub, it is sent to the identity provider that the user specifies from the first identity server. For instance, if the users prefer to use their Facebook credentials to log in, and Facebook is one of the identity providers configured in the federation hub, the user simply has to specify Facebook as the domain in the login screen of first Identity Server.
When the Home Realm Identifier is not specified, you can either select the domain name from a dropdown in the login page, or you have to enter the domain value in a separate page prior to logging in. This can be configured as explained below.
Open the <IS_HOME>/repository/conf/identity/application-authentication.xml file. The ProxyMode configuration allows the framework to operate in either smart mode or dumb mode. In smart mode, both local and federated authentication is supported, while in dumb mode, only federated authentication is supported. If dumb mode is configured here, you must provide the Home Realm Identifier, or you have to display a separate screen to the user to get it.
If smart mode is configured, the default behavior applies, where you can enter a local username and password, or use federated authenticators for authentication.
<ProxyMode>smart</ProxyMode>
About the Alias
The Alias is used in the following authentication scenario.
Here a SAML identity provider sends a SAML token to a web application for authentication. The SAML token has an audience restriction element that controls access and has a reference to the web application in order to access it. Using this token, the authentication takes place. Now, if the web application needs to access an API that is protected by OAuth 2.0, the same SAML token is sent to the token endpoint of the Identity Server. The Alias value you configure in the Identity Server is associated with this token endpoint. This alias value must be added to the audience restriction element of the SAML token. When this SAML token is sent to the Identity Server, you obtain an access token, which is used to access the API.
So in order to configure this, you must add the SAML identity provider as an identity provider in the Identity Server using the instructions in this topic. When configuring this in the Identity Server, you must specify the token alias for this scenario to work. This indicates that any token coming from the SAML identity provider must have this alias value in the audience restriction element.
Enter the Identity Provider Name and provide a brief Description of the identity provider. Only Identity Provider Name is a required field.
Fill in the remaining details where applicable. Click the arrow buttons to expand the forms available to update.
Click Register to add the Identity Provider.
Configuring a resident identity provider
WSO2 Identity Server can mediate authentication requests between service providers and identity providers. At the same time, the Identity Server itself can act as a service provider and an identity provider. When it acts as an identity provider it is known as the resident identity provider.
The resident identity provider configuration is very relevant for you if you are a service provider and want to send an authentication request or a provisioning request to the Identity Server (say via SAML, OpenID Connect, SCIM, and WS-Trust). See Configuring WS-Trust Security Token Service for an example of how resident identity provider is used to implement security token service.
Resident identity provider configuration is a one time configuration for a given tenant. It basically shows you the Identity Server's metadata, like the endpoints. In addition to the metadata, you can configure this if you want to secure the WS-Trust endpoint with a security policy.
Follow the instructions below to configure a resident identity provider.
Sign in. Enter your username and password to log on to the Management Console.
In the Main menu under the Identity section, click Resident under Identity Providers.
The Resident Identity Provider page appears.
Enter a Home Realm Identifier for the resident identity provider. You can enter multiple identifiers as a comma separated list.
Optionally, configure inbound authentication if required by setting the Identity Provider Entity Id. This is not mandatory for creating a resident identity provider.
If you want to change the default issuer that is localhost to a domain name, you need define the Identity Provider Entity Id under SAML2 Web SSO Configuration.
Configure the Security Token Service (STS). You can configure this if you want to secure the WS-Trust endpoint with a security policy.
Click Update.
Click Ok to the confirmation message that appears.
Note the following information regarding the URLs on this screen.
Exporting SAML2 metadata of the resident IdP
To configure WSO2 Identity Server as a trusted identity provider in a service provider application, export the SAML2 metadata of the resident identity provider of WSO2 IS and import the metadata to the relevant service provider.
Use one of the following approaches to do this.
Start the server and download the SAML2 metadata by accessing this URL: https://localhost:9443/identity/metadata/saml2.
Alternatively, access the management console and follow the steps given below to download the metadata.
Expand the Inbound Authentication Configuration section and then expand SAML2 Web SSO Configuration.
Click Download SAML2 metadata. A
metadata.xmlfile will be downloaded on to your machine.Import the
metadata.xmlfile to the relevant service provider to configure WSO2 Identity Server as a trusted identity provider for your application.
Managing identity providers
This section provides instructions on how to manage identity providers once they are created.
Viewing identity providers
Follow the instructions below to view the list of identity providers added in the WSO2 Identity Server.
Sign in. Enter your username and password to log on to the Management Console.
In the Main menu under the Identity section, click List under Identity Providers. The list of identity providers you added appears.
Editing identity providers
Follow the instructions below to edit an identity provider's details.
Sign in. Enter your username and password to log on to the Management Console.
In the Main menu under the Identity section, click List under Identity Providers. The list of identity providers you added appears.
Locate the identity provider you want to edit and click on the corresponding Edit link.
You are directed to the edit screen where you can modify the details you configured for the identity provider.
Deleting identity providers
Follow the instructions below to delete an identity provider.
Sign in. Enter your username and password to log on to the Management Console.
In the Main menu under the Identity section, click List under Identity Providers. The list of identity providers you added appears.
Locate the identity provider you want to delete and click on the corresponding Delete link.
Confirm your request in the WSO2 Carbon window. Click the Yes button.