FAQ

Common

Are WSO2 products able to integrate with external entities and provide security management services to them?

External entities are incorporated in the following scenarios:

• Authentication -STS that issues SAML tokens+can accept SAML tokens
• OpenID Connect Provider + Relying party
• SSO IDP + relying party
• Authorization - XACML

Do WSO2 products support cross-domain federated identity management functionality to authenticate and authorize individuals of internal and external entities into the system, determine their permissions, and control access to the resources accordingly?

This can be achieved with WS-Trust (e.g., a service in WSO2 EI can be protected with a security policy to accept a security token issued by a trusted STS confirming the authentication of a user in a outside domain), XACML - PDP, PAP and PIP supported by WSO2 Identity Server. PEPs can communicate with the PDP of WSO2 Identity Server to grant authorization.

Do WSO2 products support different user access technologies such as user credentials, biometrics, smart card, token, etc?

User credentials and SAML tokens X.509 tokens are supported out of the box. Biometrics and smart card can be integrated via the custom authenticators available in the WSO2 Identity Server.

Do WSO2 products provide encryption and data integrity functionality (symmetric & asymmetric signatures) to maintain secure messaging across the platform and support various encryption and signature standards?

For Encryption/Decryption, Symmetric/Asymmetric key based encryption/decryption algorithms that are recommended in the WS-Security specification are being used.

For Digital Signature, the Identity module supports Symmetric/Asymmetric key based digital signature algorithms recommended in the WS-Security specification.

Does WSO2 Identity Server help your journey with GDPR and digital transformation?

WSO2 Identity and Access Management  (IAM)  helps address the new requirements of GDPR by providing customer data privacy, a self care portal to enable customer rights defined in the GDPR and full scale consent life-cycle management. The WSO2 IAM solution also supports secure identity provisioning across systems in a GDPR compliant manner. For more information, see the regulatory compliance details on the WSO2 .com site.

Does WSO2 Identity Server support security standards and protocols such as WS-Trust, WS-Federation, WS-Policy, etc?

Error initializing Cipher when using a custom Key Store for Secure Vault : If you try with a custom keystore, you might encounter the following error for certain instances :

Exception in thread "main" org.wso2.ciphertool.CipherToolException: Error initializing Cipher at org.wso2.ciphertool.CipherTool.handleException(CipherTool.java:861) at org.wso2.ciphertool.CipherTool.initCipher(CipherTool.java:202) at org.wso2.ciphertool.CipherTool.main(CipherTool.java:80) Caused by: java.security.InvalidKeyException: Wrong key usage at javax.crypto.Cipher.init(DashoA13..) at javax.crypto.Cipher.init(DashoA13..) at org.wso2.ciphertool.CipherTool.initCipher(CipherTool.java:200) ... 1 more

You can analyze the public certificates of the two jks's - In default wso2carbon.jks, the KeyUsage is KeyUsage [ DigitalSignature Non_repudiation Key_Encipherment Data_Encipherment ] - In the custom .jks, the KeyUsage is KeyUsage [ DigitalSignature Key_Encipherment ] Since the custom key store's certificate does not have 'Data_Encipherment' it can't use the Ciphertool and encrypt data for secure vault. So you may have to generate a new key store with at least a Self signed certificate.

Do WSO2 products provide encryption and data integrity functionality to maintain secure messaging across the platform?

Can we store user identity, user attributes as well as Trust Level (TL) and Consent level (CL) as user data stored in the data repositories?

What provisioning standards does WSO2 support?

How can I setup WSO2 IS as a KDC?

See Kerberos Security and follow the instructions.

How can I change the host-name of the Identity Server ?

Follow the instruction given in Deployment Guidelines in Production#Changingthehostname document.

How to install a new feature in WSO2 Identity Server ?

Follow the instructions given in Installing Features document. 

What are all the non-apache 2 licensed software in IS, if any ?

Non-apache2 licenses used in IS are listed below. The licensing information can be found using the CARBON_HOME/LICENSE.txt file.

• lgpl3 [GNU LESSER GENERAL PUBLIC LICENSE Version 3]
• cpl1 [Common Public License 1.0]
• epl1 [Eclipse Public License]
• lgpl2 [Lesser GPL v2.1]
• icu [ICU License]
• sunbinary [Binary Code License Agreement]
• mit [MIT License]
• bsd [Berkeley License]
• cddl1 [Common Development and Distribution License]
• bouncy [Bouncy Castle License]
• other http://sunxacml.sourceforge.net/license.txt
  

Does the WSO2 platform provide support for mobile phone access?

In the mobile phone access scenarios lightweight authentication mechanisms such as sending REST like tokens from OAuth and using Mutual SSL can be considered.

Do we have a way to support off-line process to support off-line verification / validation of user identities?

No current support is available for this feature.

Do we have SPML (Service Provisioning Markup Language) XML-based standard in the WSO2 platform?

The WSO2 platform supports both SPML and SCIM (Simple Cloud Identity Management) specifications.

How easy is it to use carbon administration console and a security monitoring tool for security based administration?

The WSO2 Identity Server packages an UI based PAP component for XACML and a collection of relying party components in an easy to use, rich UI based and intuitive management console. Any security configuration can be done and the applied security policies and other viewing capabilities can be handled via this GUI based admin console.How can I write my own custom authenticator?

Writing a Custom Local Authenticator describes how to write an authenticator, including a sample custom authenticator.

How can I access the XDAS audit information of the WSO2 Identity Server?

The audit logs of IS can be found at $IS_ROOT/repository/logs/audit.log.

Why do I get the javax.net.ssl.SSLHandshakeException when running the samples?

The sample applications do not have a keystore in them. Therefore, after changing the tomcat hostname you might get the error given below because the public key of the WSO2 Identity Server does not exist in the Java certificate store. 

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Follow the steps given below to avoid this error.

1. Generate a public key from the WSO2 carbon keystore.
   Navigate to the <IS_HOME>\repository\resources\security directory via your terminal and run the command given below to export the public certificate.

   
   

   keytool -export -keystore wso2carbon.jks -alias wso2carbon -file wso2PubCert.cer

2. You are prompted to enter the password. The default password is wso2carbon.
   Once the command is executed you see the newly created PubCert.cer file in this folder.

3. Navigate to the <JAVA_HOME>/jre/lib/security directory via the terminal and run the following command to get the number of certificates that are currently in the certificate store.

   keytool -list -keystore cacerts

4. You are prompted to enter a password. The default password is changeit.
   Scroll up on your terminal to see the list of certificates in the store.

5. Import the WSO2 public certificate to the Java certificate store by running the command that is given below.
   If you are a Windows users, make sure to run the commands as an administrator.

   keytool -import -keystore cacerts -file <Certificate Path>\wso2PubCert.cer

6. You are prompted to enter a password. The default password is changeit.

   Once the command is successfully executed, you get the confirmation that the certificate is successfully imported.

   Want to make sure that the certificate is created? Run the command given below to check if the wso2PubCert.cer file is in the list of certificates.

   keytool -list -keystore cacerts

7. Restart your machine after the above changes.

Now you are able to use the WSO2 IS samples.

Why do I get an org.apache.jasper.JasperException Java error when I am trying to access a web app:

Are you are getting the error that is given below?

Example:

TID: [-1234] [] [2018-01-19 12:18:23,596] ERROR {org.apache.catalina.core.StandardContext} -  Servlet [confirmregistration.do] in web application [/accountrecoveryendpoint] threw load() exception 
org.apache.jasper.JasperException: Unable to compile class for JSP: 

An error occurred at line: 56 in the jsp file: /self-registration-with-verification-confirm.jsp
'<>' operator is not allowed for source level below 1.7
53:     try {
54:         SelfRegisterApi selfRegisterApi = new SelfRegisterApi();
55:         CodeValidationRequest validationRequest = new CodeValidationRequest();
56:         List<Property> properties = new ArrayList<>();
57:         Property tenantDomainProperty = new Property();
58:         tenantDomainProperty.setKey(MultitenantConstants.TENANT_DOMAIN);
59:         tenantDomainProperty.setValue(tenantdomain);

Follow the steps given below to overcome the error:

1. Open the <IS_HOME>/repository/conf/tomcat/web.xml file.

2. Add the following properties below the <servlet-class>org.apache.jasper.servlet.JspServlet</servlet-class> property.

   
   

   <init-param>   <param-name>compilerSourceVM</param-name>
      <param-value>1.8</param-value>
   </init-param>
   <init-param>
      <param-name>compilerTargetVM</param-name>
      <param-value>1.8</param-value>
   </init-param>

    Click here to see the servlet XML property block after you added the above properties.

   <servlet>
      <servlet-name>jsp</servlet-name>
      <servlet-class>org.apache.jasper.servlet.JspServlet</servlet-class>
      <init-param>
         <param-name>fork</param-name>
         <param-value>false</param-value>
      </init-param>
      <init-param>
         <param-name>xpoweredBy</param-name>
         <param-value>false</param-value>
      </init-param>
      <init-param>
         <param-name>compilerSourceVM</param-name>
         <param-value>1.8</param-value>
      </init-param>
      <init-param>
         <param-name>compilerTargetVM</param-name>
         <param-value>1.8</param-value>
      </init-param>
      <load-on-startup>3</load-on-startup>
   </servlet>

SAML and SSO Support