/
Sending Notifications to External PEP Endpoints

This site contains the documentation that is relevant to older WSO2 product versions and offerings.
For the latest WSO2 documentation, visit https://wso2.com/documentation/.

Sending Notifications to External PEP Endpoints

Jan 11, 2018

You can register external PEP Endpoints in the WSO2 Identity Server. The Identity Server sends cache invalidation notifications (JSON, XML, EMAIL) to the pre-configured external PEP endpoints. Basic authentication will be used as the authentication mechanism.

This topic describes how to enable the XACML engine to send invalidation notifications to these external PEP endpoints when there is a policy update or a change in user roles, permissions or attributes. This also clears the internal cache when user roles, permissions or attributes are updated.

  1. If you are using EMAIL as notification, configure email transport details using the axis2.xml file. The following steps provide instructions on how to do this. 

    1. Navigate to the <IS_HOME>/repository/conf/axis2/axis2.xml file.

    2. Configure the relevant attributes according to your email account information. The following is a sample configuration.

      <transportSender name="mailto" class="org.apache.axis2.transport.mail.MailTransportSender"> <parameter name="mail.smtp.from">wso2demomail@gmail.com</parameter> <parameter name="mail.smtp.user">wso2demomail</parameter> <parameter name="mail.smtp.password">mailpassword</parameter> <parameter name="mail.smtp.host">smtp.gmail.com</parameter> <parameter name="mail.smtp.port">587</parameter> <parameter name="mail.smtp.starttls.enable">true</parameter> <parameter name="mail.smtp.auth">true</parameter> </transportSender>

  2. Do the following to send notifications to external endpoints when there is a policy change.

    1. Navigate to the <IS_HOME>/repository/conf/identity/entitlement.properties file.

    2. Make the following change.

      PAP.Status.Data.Handler.2=org.wso2.carbon.identity.entitlement.EntitlementNotificationExtension

      Here the trailing number that is added after "PAP.Status.Data.Handler" should be the minimum positive number you can add for a new "PAP.Status.Data.Handler".

  3. Additionally, add the following to the file.

    org.wso2.carbon.identity.entitlement.EntitlementNotificationExtension.1=notificationType,JSON #org.wso2.carbon.identity.entitlement.EntitlementNotificationExtension.1=notificationType,XML #org.wso2.carbon.identity.entitlement.EntitlementNotificationExtension.1=notificationType,EMAIL org.wso2.carbon.identity.entitlement.EntitlementNotificationExtension.2=ignoreServerVerification,true org.wso2.carbon.identity.entitlement.EntitlementNotificationExtension.3=targetUrl,http://targetUrlAddress;username;password #org.wso2.carbon.identity.entitlement.EntitlementNotificationExtension.3=emailAddress,recipientAddresss@comany.com org.wso2.carbon.identity.entitlement.EntitlementNotificationExtension.4=pdpNotificationAction,ENABLE;DISABLE;UPDATE;DELETE org.wso2.carbon.identity.entitlement.EntitlementNotificationExtension.5=papNotification,true org.wso2.carbon.identity.entitlement.EntitlementNotificationExtension.6=pdpNotification,true #org.wso2.carbon.identity.entitlement.EntitlementNotificationExtension.7=emailTemplateFile,/home/asela/is/wso2is5.1.0/repository/conf/security/entitlement-email-config #org.wso2.carbon.identity.entitlement.EntitlementNotificationExtension.8=emailSubject,Policy Notification #org.wso2.carbon.identity.entitlement.EntitlementNotificationExtension.9=roleName, admin

    The following table lists out and describes the above attributes.

  4. In order to send notifications to external endpoints when a user attribute is updated, create a configuration file named notification-mgt.properties in the <IS_HOME>/repository/conf/security/ directory and add the following configurations to it. A sample configuration file is included in the resource folder.

    enable.notification=true # Specify the endpoint name the message needs to be posted in. endpoint=https://endpointUrl,username,password # Specify the notification type which is either XML or JSON notification.type=XML # Specify whether email notifications are also needed. enable.email.notification=true # Specify the group user name/receivers user name. email.target.username=Admin # Specify the group to receive the notification emails email.sending.group=receiverAddress@company.com

  5. It is recommended to use https to communicate with external endpoints. In that case, import your certificates to client-truststore.jks in the Identity Server. You can use the Java keytool command to do it. The following is a sample command. Note that the default password for client-truststore.jks is "wso2carbon".

    keytool -import -alias wso2 -file <path_to_your_certificate_file>/yourCertificate.crt -keystore <CARBON_SERVER>/repository/resources/security/client-truststore.jks