Adding and Configuring an Identity Provider

An Identity Provider (IdP) is responsible for authenticating users and issuing identification information by using security tokens like SAML 2.0, OpenID Connect, OAuth 2.0 and WS-Trust. This is a favorable alternative to explicitly authenticating a user within a security realm.

The responsibility of the identity provider configuration is to represent external identity providers. These external identity providers can be Facebook, Yahoo, Google, Salesforce, Microsoft Windows Live, etc. If you want to authenticate users against these identity providers, then you must associate one or more federated authenticators with the WSO2 Identity Server. These identity providers support for different authentication protocols. For example, if you want to authenticate users against Salesforce, then you must associate the SAML 2.0 authenticator with the Salesforce identity provider, if you want to authenticate users against Yahoo, then you must associate the OpenID Connect authenticator with it. To make this process much easier, the Identity Server also comes with a set of more specific federated authenticators. For example, if you want to authenticate against Facebook, you do not need to configure OAuth 2.0 authenticator. Instead, you can directly use the Facebook federated authenticator.

Each identity provider configuration can also maintain a claim mapping. This is to map the identity provider's own set of claims to the Identity Server's claims. When the response from an external identity provider is received by the response processor component of the federated authenticator, before it hands over the control to the authentication framework, the response processor will create a name/value pair of user claims received in the response from the identity provider. These claims are specific to the external identity provider. Then it is the responsibility of the authentication framework to read the claim mapping configuration from the identity provider component and do the conversion. So, while inside the framework, all the user claim values will be in a common format.

So, in short, the WSO2 Identity Server allows you to add identity providers and specify various details that help you to link the identity provider to the Identity Server. So you must specify all information required to send the authentication requests and get a response back from the identity provider. This topic contains the following sections.

Follow the instructions below to add a new identity provider.

1. Sign in. Enter your username and password to log on to the Management Console. 

2. Navigate to the Main menu to access the Identity menu. Click Add under Identity Providers.

3. Fill in the details in the Basic Information section. 
   

   
   Note the following when filling the above form.

   
   
   
   

4. Enter the Identity Provider Name and provide a brief Description of the identity provider. Only Identity Provider Name is a required field.

5. Fill in the remaining details where applicable. Click the arrow buttons to expand the forms available to update.
   

6. Click Register to add the Identity Provider.

This section provides instructions on how to manage identity providers once they are created.

Follow the instructions below to view the list of identity providers added in the WSO2 Identity Server.

1. Sign in. Enter your username and password to log on to the Management Console.

2. In the Main menu under the Identity section, click List under Identity Providers. The list of identity providers you added appears.
   

   Open

   

Follow the instructions below to edit an identity provider's details.

1. Sign in. Enter your username and password to log on to the Management Console.

2. In the Main menu under the Identity section, click List under Identity Providers. The list of identity providers you added appears.

3. Locate the identity provider you want to edit and click on the corresponding Edit link.
   

   Open

   

4. You are directed to the edit screen where you can modify the details you configured for the identity provider.

Follow the instructions below to delete an identity provider.

1. Sign in. Enter your username and password to log on to the Management Console.

2. In the Main menu under the Identity section, click List under Identity Providers. The list of identity providers you added appears.

3. Locate the identity provider you want to delete and click on the corresponding Delete link.
   

   Open

   

4. Confirm your request in the WSO2 Carbon window. Click the Yes button.

Follow the instructions below to disable or enable an identity provider.

1. Sign in. Enter your username and password to log on to the Management Console.

2. In the Main menu under the Identity section, click List under Identity Providers. The list of identity providers you added appears.

3. Locate the identity provider you want to delete and click on the corresponding Disable link to disable the identity provider. Clicking this link will change the link to Enable. To enable the identity provider again, click the Enable link.

   Open

   

4. Click Ok on the confirmation form that appears when clicking Disable/Enable.