/
Configuring a SP and IdP Using Configuration Files

This site contains the documentation that is relevant to older WSO2 product versions and offerings.
For the latest WSO2 documentation, visit https://wso2.com/documentation/.

Configuring a SP and IdP Using Configuration Files

Aug 15, 2018

This topic provides instructions on how to create a service provider and identity provider in the WSO2 Identity Server using configuration files which is typically used during the deployment stage. This is done so that multiple tenants in the Identity Server can have the same identity provider.

While this topic need not be specifically about federated authentication, this scenario addresses a federated authentication solution. This scenario requires two WSO2 Identity Server instances, where one acts as the external identity provider, and the other acts as the service provider. From this point onwards, the Identity Server instance that acts as the external identity provider will be referred to as  identity provider IS  and the instance that acts as the service provider will be referred to as service provider IS . Once we are done with the configuration, the  service provider IS  will have the travelocity application configured as a service provider and an identity provider configured and shared across its tenant space. This is illustrated in the following diagram.

The following are the high level steps required for this scenario.

  1. Add the  identity provider IS  in the  service provider IS  as an identity provider.

  2. Add the  service provider IS  in the  identity provider IS  as a service provider.

  3. Add the travelocity.com application in the  service provider IS  as a service provider. This uses the identity provider created earlier (in step 1) as a federated authenticator. 

The above processes can be easily done using the Management Console, but the service provider and identity provider created in  service provider IS  are only visible to the tenant who creates them. So the difference here is that the identity provider and service provider in service provider IS are created using configuration files so that they are available to all the tenants in service provider IS.

The following sections provide instructions on how to carry out the above steps.

Before you begin

Do the following steps to setup the two WSO2 Identity Server instances for the scenario.

  1. Download and install the two Identity Server instances.

  2. In the <IDENTITY_PROVIDER_IS_HOME>/repository/conf/carbon.xml file, locate the Offset element and change this to 1. This is done to increment the port values in the identity provider IS so that there is no port conflict with the service provider IS . Port conflicts occur when multiple WSO2 product instances run on the same machine.

    <Offset>1</Offset>

Now you have setup the Identity Server instances so you can proceed with the configuration steps.

Adding the service provider in the identity provider IS

This section involves adding the  service provider IS as a service provider in the  identity provider IS .

  1. Start the  identity provider IS  and access the Management Console.

  2. Navigate to the Main menu to access the Identity menu. Click Add under Service Providers.

  3. Fill in the Service Provider Name and provide a brief Description of the service provider. For the purposes of this scenario, enter the Service Provider Name as ServiceProviderSP_IS.

  4. Click Register to add the service provider.

  5. Expand the Inbound Authentication and SAML2 Web SSO Configuration sections and click Configure.

  6. Do the following configurations.

  7. Click Register to save your changes.

Adding the identity provider in the service provider IS

This section involves adding the  identity provider IS  as an identity provider in the  service provider IS .

Create a file named identityProviderIDP_IS.xml inside the <SERVICE_PROVIDER_IS_HOME>/repository/conf/identity/identity­-providers directory and add the following content into it. These configurations basically add the identity provider in the  service provider IS . Additionally, this has the configurations necessary for a federated authentication scenario.

Note: This configuration will only allow the file based identity provider to be visible in file based service providers. Additionally, it will only be visible to the super tenant. To make it visible across tenants and in the SP registration UI, add the prefix "SHARED_" before the identity provider name to the<IdentityProviderName> element, as seen below.

<IdentityProviderName>SHARED_identityProviderIDP_IS</IdentityProviderName>

Adding this prefix allows this identity provider to be shared between the service providers. Consequently, it will also be shown in the UI drop down as a federated identity provider when configuring a service provider.

identityProviderIDP_IS.xml
<IdentityProvider> <IdentityProviderName>identityProviderIDP_IS</IdentityProviderName> <DisplayName>identityProviderIDP_IS</DisplayName> <IdentityProviderDescription></IdentityProviderDescription> <Alias>https://localhost:9444/oauth2/token/</Alias> <IsPrimary></IsPrimary> <IsEnabled>true</IsEnabled> <IsFederationHub></IsFederationHub> <HomeRealmId></HomeRealmId> <ProvisioningRole></ProvisioningRole> <FederatedAuthenticatorConfigs> <saml2> <Name>SAMLSSOAuthenticator</Name> <DisplayName>samlsso</DisplayName> <IsEnabled>true</IsEnabled> <Properties> <property> <Name>IdPEntityId</Name> <Value>identiryProviderIDP</Value> </property> <property> <Name>IsLogoutEnabled</Name> <Value>true</Value> </property> <property> <Name>SPEntityId</Name> <Value>travelocitySP</Value> </property> <property> <Name>SSOUrl</Name> <Value>https://localhost:9444/samlsso/</Value> </property> <property> <Name>isAssertionSigned</Name> <Value>false</Value> </property> <property> <Name>commonAuthQueryParams</Name> <Value></Value> </property> <property> <Name>IsUserIdInClaims</Name> <Value>false</Value> </property> <property> <Name>IsLogoutReqSigned</Name> <Value>false</Value> </property> <property> <Name>IsAssertionEncrypted</Name> <Value>false</Value> </property> <property> <Name>IsAuthReqSigned</Name> <Value>false</Value> </property> <property> <Name>IsAuthnRespSigned</Name> <Value>false</Value> </property> <property> <Name>LogoutReqUrl</Name> <Value>false</Value> </property> </Properties> </saml2> </FederatedAuthenticatorConfigs> <DefaultAuthenticatorConfig>SAMLSSOAuthenticator</DefaultAuthenticatorConfig> <ProvisioningConnectorConfigs> </ProvisioningConnectorConfigs> <DefaultProvisioningConnectorConfig></DefaultProvisioningConnectorConfig> <ClaimConfig></ClaimConfig> <Certificate></Certificate> <PermissionAndRoleConfig></PermissionAndRoleConfig> <JustInTimeProvisioningConfig></JustInTimeProvisioningConfig> </IdentityProvider>

Tip: When studying the above configurations, you can identify the Service Provider Entity Id in the following code snippet.

<property> <Name>SPEntityId</Name> <Value>travelocitySP</Value> </property>

Here, travelocitySP must be the same value as the value configured as the Issuer in the identity provider IS .

About certificates: The following is a sample command if the identity provider is WSO2 Identity Server where you can export the public certificate in PEM format.

keytool -exportcert -alias wso2carbon -keypass wso2carbon -keystore wso2carbon.jks -storepass wso2carbon -rfc -file ispublic_crt.pem

Then, you can open the certificate file with a notepad so you see the certificate value. Copy this certificate value and put in the file within the <Certificate> tag.

Please note that above is only if the identity provider is the WSO2 Identity Server. If the identity provider is a third party IDP, then you can get the certificate in PEM format and read the value. You need to copy the entire content of the PEM file and place it within the <Certificate> tag.

Adding the service provider in the service provider IS

This section involves adding the travelocity application as a service provider in the  service provider IS .

  1. Open the <SERVICE_PROVIDER_IS_HOME>/repository/conf/identity/sso-idp-config.xml file and add the following configuration under the  <SSOIdentityProviderConfig>  properties
    <ServiceProviders>  tag. This adds thetravelocity application as a service provider.

    <ServiceProvider> <Issuer>travelocity.com</Issuer> <AssertionConsumerServiceURLs> <AssertionConsumerServiceURL>http://wso2is.local:8080/travelocity.com/home.jsp</AssertionConsumerServiceURL> </AssertionConsumerServiceURLs> <DefaultAssertionConsumerServiceURL>http://wso2is.local:8080/travelocity.com/home.jsp</DefaultAssertionConsumerServiceURL> <EnableSingleLogout>true</EnableSingleLogout> <SLOResponseURL></SLOResponseURL> <SLORequestURL></SLORequestURL> <SAMLDefaultSigningAlgorithmURI>http://www.w3.org/2000/09/xmldsig#rsa-sha1</SAMLDefaultSigningAlgorithmURI> <SAMLDefaultDigestAlgorithmURI>http://www.w3.org/2000/09/xmldsig#sha1</SAMLDefaultDigestAlgorithmURI> <SignResponse>true</SignResponse> <ValidateSignatures>true</ValidateSignatures> <EncryptAssertion>true</EncryptAssertion> <CertAlias></CertAlias> <EnableAttributeProfile>true</EnableAttributeProfile> <IncludeAttributeByDefault>true</IncludeAttributeByDefault> <ConsumingServiceIndex>2104589</ConsumingServiceIndex> <EnableAudienceRestriction>false</EnableAudienceRestriction> <AudiencesList> <Audience></Audience> </AudiencesList> <EnableRecipients>false</EnableRecipients> <RecipientList> <Recipient></Recipient> </RecipientList> <EnableIdPInitiatedSSO>false</EnableIdPInitiatedSSO> <EnableIdPInitSLO>false</EnableIdPInitSLO> <ReturnToURLList> <ReturnToURL></ReturnToURL> </ReturnToURLList> </ServiceProvider>

  2. Create a file named travelocity.com.xml in the <SERVICE_PROVIDER_IS_HOME>/repository/conf/identity/service-providers directory.

  3. Add the following configurations into the travelocity.com.xml file you created. This adds the necessary SAML configurations to thetravelocity service provider.

    <ServiceProvider> <ApplicationID>3</ApplicationID> <ApplicationName>travelocity.com</ApplicationName> <Description>travelocity Service Provider</Description> <IsSaaSApp>true</IsSaaSApp> <InboundAuthenticationConfig> <InboundAuthenticationRequestConfigs> <InboundAuthenticationRequestConfig> <InboundAuthKey>travelocity.com</InboundAuthKey> <InboundAuthType>samlsso</InboundAuthType> <Properties></Properties> </InboundAuthenticationRequestConfig> </InboundAuthenticationRequestConfigs> </InboundAuthenticationConfig> <LocalAndOutBoundAuthenticationConfig> <AuthenticationSteps> <AuthenticationStep> <StepOrder>1</StepOrder> <LocalAuthenticatorConfigs> <LocalAuthenticatorConfig> <Name>BasicAuthenticator</Name> <DisplayName>basicauth</DisplayName> <IsEnabled>true</IsEnabled> </LocalAuthenticatorConfig> </LocalAuthenticatorConfigs> <FederatedIdentityProviders> <IdentityProvider> <IdentityProviderName>identityProviderIDP_IS</IdentityProviderName> <IsEnabled>true</IsEnabled> <DefaultAuthenticatorConfig> <FederatedAuthenticatorConfigs> <FederatedAuthenticatorConfig> <Name>SAMLSSOAuthenticator</Name> <DisplayName>samlsso</DisplayName> <IsEnabled>true</IsEnabled> </FederatedAuthenticatorConfig> </FederatedAuthenticatorConfigs> </DefaultAuthenticatorConfig> </IdentityProvider> </FederatedIdentityProviders> <SubjectStep>true</SubjectStep> <AttributeStep>true</AttributeStep> </AuthenticationStep> </AuthenticationSteps> <subjectClaimUri> <!--selected URI --> </subjectClaimUri> </LocalAndOutBoundAuthenticationConfig> <RequestPathAuthenticatorConfigs></RequestPathAuthenticatorConfigs> <InboundProvisioningConfig></InboundProvisioningConfig> <OutboundProvisioningConfig></OutboundProvisioningConfig> <ClaimConfig> <AlwaysSendMappedLocalSubjectId>true</AlwaysSendMappedLocalSubjectId> <LocalClaimDialect>true</LocalClaimDialect><ClaimMappings><ClaimMapping><LocalClaim><ClaimUri>http://wso2.org/claims/givenname</ClaimUri></LocalClaim><RemoteClaim><ClaimUri>http://wso2.org/claims/givenName</ClaimUri>ClaimUri></RemoteClaim><RequestClaim>true</RequestClaim></ClaimMapping></ClaimMappings></ClaimConfig> <PermissionAndRoleConfig></PermissionAndRoleConfig> </ServiceProvider>

  4. Restart the WSO2 Identity Server to apply the file-based configurations to the system. 

Running the travelocity application

Do the following steps to run the travelocity application.

  1. Check out the single sign on sample from the following GitHub repository. See the Downloading a Sample topic for more information. 

    https://github.com/wso2/product-is/tree/master/modules/samples/sso

  2. Remove the parent entry in the pom.xml file that comes along with the sample. Once you are done with this step, the contents of the pom.xml file will look similar to the following.

    <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd"> <groupId>org.wso2.identity</groupId> <version>5.0.0</version> <modelVersion>4.0.0</modelVersion> <artifactId>wso2is-identity-samples-sso</artifactId> <packaging>pom</packaging> <name>Identity Server : SSO Samples</name> <modules> <module>SSOAgentSample</module> </modules> </project>

  3. In your command line, navigate to <SAMPLE_HOME>/sso/ in the folder you checked out and build the sample using the following command. You must have Apache Maven installed to do this (see Installation Prerequisites for the appropriate version to use).

    mvn clean install

  4. After successfully building the sample, a .war file named travelocity.com can be found inside the <HOME>/sso/SSOAgentSample/ target folder. Deploy this sample web app on a web container. To do this, use the Apache Tomcat server.

    Use the following steps to deploy the web app in the web container:

    1. Stop the Apache Tomcat server if it is already running.

    2. Copy the travelocity.war file to the <TOMCAT_HOME>/webapps folder.

    3. Start the Apache Tomcat server.

  5. When you access the following link to the travelocity application, you are directed to the identity provider for authentication: http://wso2is.local:8080/travelocity.com/index.jsp