Basic Client Profile with Playground

This section demonstrates the WSO2 Identity Server's OpenID Connect Basic Client Profile implementation with the WSO2 OAuth2 playground sample.

Setting up the playground sample

First follow the instructions in the sections below to set up the playground sample and register it in WSO2 IS. Once you have done so, complete the user profile by adding user attributes and try out the scenario.

Set up the WSO2 OAuth2.0 Playground sample

Configuring OAuth for WSO2 Playground

Before you begin, you must first configure OAuth for a service provider to use this sample.

Add a new service provider.
1. Sign in. Enter your username and password to log on to the Management Console.
2. Navigate to the Main menu to access the Identity menu. Click Add under Service Providers.
3. Fill in the Service Provider Name and provide a brief Description of the service provider. Only Service Provider Name is a required field.
4. Click Register to add the new service provider.
Expand the Inbound Authentication Configuration section and configure OAuth/OpenID Connect.

You can use the following Callback URL when configuring OAuth for WSO2 Playground: http://wso2is.local:8080/playground2/oauth2client

To obtain and configure the Playground sample, follow the steps below.

You can check out the repository of the OAuth 2.0 sample from GitHub. Follow the instructions here to checkout the folder. We refer <SAMPLE_HOME> as the modules/samples folder inside the folder where the product-is repository is checked out.
Open a terminal window and add the following entry to the /etc/hosts file of your machine to configure the hostname.
Why is this step needed?
Some browsers do not allow you to create cookies for a naked hostname, such as localhost. Cookies are required when working with SSO. Therefore, to ensure that the SSO capabilities work as expected in this tutorial, you need to configure the etc/host file as explained in this step.
The etc/host file is a read-only file. Therefore, you won't be able to edit it by opening the file via a text editor. To avoid this, edit the file using the terminal commands.
For example, use the following command if you are working on a Mac/Linux environment.
sudo nano /etc/hosts
```
127.0.0.1		wso2is.local
```
Navigate to <SAMPLE_HOME>/oauth2/playground2 directory via the terminal and build the sample using the following command. You must have Apache Maven installed to do this (see Installation Prerequisites for the appropriate version to use).
```
mvn clean install
```
After successfully building the sample, a .war file named playground2 can be found inside the <SAMPLE_HOME>/oauth2/playground2/target folder. Deploy this sample web app on a web container, such as Apache Tomcat server.

Since this sample is written based on Servlet 3.0 it needs to be deployed on Tomcat 7.x.
Use the following steps to deploy the web app in the web container:
1. Stop the Apache Tomcat server if it is already running.
2. Copy the playground2.war file to the <TOMCAT_HOME>/webapps folder.
3. Start the Apache Tomcat server.
Make sure to update param-value parameter in the WEB-INF/web.xml file with the server URL of the Identity Server if required.
Make sure to enter the port the application is running on, in the URL. If you have started the Identity Server with a port offset, then the respective port needs to be configured here.
```
<init-param>
     <description>serverUrl</description>
     <param-name>serverUrl</param-name>
     <param-value>https://localhost:9443/services/</param-value>
</init-param>
```
Note that localhost is the server that hosts WSO2 Identity Server and 9443 is the default SSL port of it. In order to access the admin services you should have the values in step 5 and 6. Since playground application is accessing the admin service OAuth2TokenValidationService, you should have the correct serverUrl,username and password as described in step 5 and 6.

Update param-value parameter with credentials of an admin user if required.

<init-param>
     <description>userName</description>
     <param-name>userName</param-name>
     <param-value>admin</param-value>
</init-param>
<init-param>
     <description>password</description>
     <param-name>password</param-name>
     <param-value>admin</param-value>
</init-param>

Restart Apache Tomcat and access http://wso2is.local:8080/playground2/
By default Tomcat runs on port 8080. If you have configured it to run on a different port make sure to update the URL and access the playground application.
You are directed to the landing page of the sample application. Click on Import Photos and the following page appears.

Are you getting the error that is given below?

Error

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

The sample applications do not have a keystore in them. Therefore, after changing the tomcat hostname you might get this error because the public key of the WSO2 Identity Server does not exist in the Java certificate store. For more information on the steps you need to follow to overcome the error, see FAQ.

This application is used to request access tokens using the four OAuth2 grant types:

Register the Playground application in WSO2 Identity Server

In order to configure Single-Sign-On (SSO) for OAuth2-OpenID Connect, you must first register a service provider for inbound authentication.

OAuth 2.0 has three main phases. They are; requesting an Authorization Grant, exchanging the Authorization Grant for an Access Token and accessing the resources using this Access Token. OpenID Connect is another identity layer on top of OAuth 2.0. OAuth applications can get authentication event information over the IDToken and can get the extra claims of the authenticated user from the OpenID Connect UserInfo endpoint.

To enable OAuth support for your client application, you must first register your application. Follow the instructions below to add a new application.

Let's get started to configure the service provider you created!

Expand the Inbound Authentication Configuration section and then expand OAuth/OpenID Connect Configuration. Click Configure.

Fill in the form that appears. For the Allowed Grant Types you can disable the ones you do not require or wish to block.

Note: The grant type highlighted below is a custom grant type. This will only appear on the UI if you have configured the JWT grant type. The value specified in the <GrantTypeName> property of the identity.xml file when creating the custom grant type is the value that will appear on the UI. For more information on writing a custom grant type, see Writing a Custom OAuth 2.0 Grant Type.

When filling out the New Application form, the following details should be taken into consideration.

Field	Notes
OAuth Version	Selecting OAuth Version as 1.0a removes all the configurable Allowed Grant Types. This is because this version of OAuth does not support grant types.
Callback Url	This is the exact location in the service provider's application where an access token would be sent. This is a required field (if the grant type is anything other than 'Code' or 'Implicit') and it is important to configure, as it is imperative that the service provider receives the access token. This is necessary for security purposes to ensure that the token is not compromised. Configure multiple callback URLs From IS 5.2.0 onwards, regex-based consumer URLs are supported when defining the callback URL. This enables you to configure multiple callback URLs for one application by entering a regex pattern as the value for the callback URL field. For example, if you have two service providers that use the same application, you can now define a regex pattern which will work for both callback URLs instead of having to configure two different applications for the two service providers. Assume the two callback URLs for your two service providers are as follows: `https://myapp.com/callback` `https://testapp:8000/callback` To configure the callback URL to work for both of these URLs, set it using a regex pattern as follows: regexp=(https://((myapp\.com)\|(testapp:8000))(/callback)) You must have the prefix 'regexp=' before your regex pattern. To define a normal URL, you can specify the callback URL without this prefix. You can also configure a regex pattern that contains dynamic values as seen below. regexp=https://mchcon.clance.local\?id=(.*)
Allowed Grant Types - The following are the grant types that are used to get the access token:
Code	Entering the username and password required at the service provider will result in a code being generated. This code can be used to obtain the access token. For more information on this grant type, see this Authorization Code specification.
Implicit	This is similar to the code grant type, but instead of generating a code, this directly provides the access token. For more information on this grant type, see this Implicit Grant specification.
Password	This authenticates the user using the password provided and the access token is provided. For more information on this grant type, see this Resource Owner Password Credentials Grant specification.
Client Credential	This is the grant type for the client key and client secret. If these two items are provided correctly by the service provider, the access token is sent. For more information on this grant type, see this Client Credentials specification.
Refresh Token	This will enable the user to obtain an access token by using the refresh token once the originally provided access token is used up. For more information on this grant type, see this Refresh Token specification.
SAML	This uses SAML assertion to obtain the access token. For more information on this grant type, see this SAML2 Bearer specification.
IWA-NTLM	This is similar to the password grant type, but it is specific to Microsoft Windows users.
urn:ietf:params:oauth:grant-type:jwt-bearer	This is a custom grant type. It uses a JWT token to obtain the access token. For more information about this grant type, see this JWT specification.
PKCE Mandatory	Select this if you are using the Code grant type. PKCE is a recommended security measure used to mitigate a code interception attack. See Mitigating Authorization Code Interception Attacks for more information.
Support PKCE 'Plain' Transform Algorithm	Select this if you are using PKCE.
User Access Token Expiry Time, Application Access Token Expiry Time, Refresh Token Expiry Time, Id Token Expiry Time	Set the validity period (in seconds) for User Access Token, Application Access Token, Refresh Token, and Id Token.
Enable Audience Restriction	Select this to enable audience restrictions for OAuth applications. If necessary, you can add multiple audiences. To add an audience, specify a required Audience value and click Add. All audience values that you add would be available in the ID token generated for the corresponding application. Before you add an audience, ensure that the following property is set to true in the `<IS_HOME>/repository/conf/identity/identity.xml` file. <EnableAudiences>true</EnableAudience>

Click Add. The following information is added for your service provider.
- OAuth Client Key - This is the client key of the service provider, which will be checked for authentication by the Identity Server before providing the access token.
- OAuth Client Secret - This is the client secret of the service provider, which will be checked for authentication by the Identity Server before providing the access token. Click the Show button to view the exact value of this.
- Actions -
  - Edit: Click to edit the OAuth/OpenID Connect Configurations
  - Revoke: Click to revoke (deactivate) the OAuth application. This action revokes all tokens issued for this application. In order to activate the application, you have to regenerate the consumer secret.
  - Regenerate Secret: Click to regenerate the secret key of the OAuth application.
  - Delete: Click to delete the OAuth/OpenID Connect Configurations
Tip

The OAuth Client Key and OAuth Client Secret are stored as plain text values by default. Here, the Client Secret is stored as a random number generated using two UUIDs and HMAC-SHA1 hash function, which is known to resist the strongest attack known against HMAC.
If you want to change the format in which the client secret is stored, you need to change the <TokenPersistenceProcessor> property in the <IS_HOME>/repository/conf/identity/identity.xml file depending on how you want to store tokens. For information on possible values that you can specify as <TokenPersistenceProcessor> based on your requirement, see Supported token persistence processors.
Once you configure a required token persistence processor, be sure to restart the server for the changes to be applied to WSO2 Identity Server.

Related Topics

See Configuring OpenID Connect Single Logout to configure single logout or session management with OpenID Connect.

See Delegated Access Control for more information on working with OAuth2/OpenIDConnect. See the following topics for samples of configuring delegated access control:

Complete the user profile

Create a user.
Log in as the user you created and go to the dashboard.
Update your profile filling the user attributes.
You can also do this at Main > List > Users and Roles > Users, then select the user and update the profile.
Click Update to save your changes.

Try out scenario

Visit the URL http://wso2is.local:8080/playground2/oauth2.jsp to start the scenario with the sample application.
Enter the following details and click Authorize.
- Authorization Grant Type: Authorization Code
- Client ID: (the client id received at the application registration step in Identity Server)
- Scope: openid (This scope is a requirement to provide user information. Any token without this scope will not be allowed to access user information.)
- Callback URL: http://wso2is.local:8080/playground2/oauth2client
- Authorize Endpoint: https://localhost:9443/oauth2/authorize
Note: To try out this scenario with different consent values, see step 7.
Provide user credentials and sign in with the previously created user.
Click Approve to provide consent to this action. The screen mentions the service provider by name and requests for user consent to provide user information to that particular service provider. The user can either
1. Deny to provide information to the service provider.
2. Approve to provide user profile information to this service provider only for this time.
3. Approve Always to provide approval to share user profile information with the service provider even in the future without prompting for consent again.
Tip: After approval is provided, the application receives an authorization code issued from WSO2 Identity Server. This authorization code can only be used once to get a valid access token and has a expiry time that can be configured by editing the following property in the <IS_HOME>/repository/conf/identity/identity.xml file. The default expiry time is 300 seconds.
 <AuthorizationCodeDefaultValidityPeriod>300</AuthorizationCodeDefaultValidityPeriod>
Enter the following details in the form that appears and click Get Access Token.
- Callback URL: http://wso2is.local:8080/playground2/oauth2client
- Access Token Endpoint:https://localhost:9443/oauth2/token
- Client Secret: (client secret received at the application registration)
At this point, the application receives the Access Token with the id token, which follows the format shown in step 7. Enter the UserInfo endpoint of the WSO2 Identity Server, (i.e., https://localhost:9443/oauth2/userinfo?schema=openid), in the form as seen below, to get user information.
Since the received access token has the scope openid, the userinfo endpoint provides the user attribute details when the request is made. You receive the following response from the Identity Server.
Response
```
{  
   "scope":"openid",
   "token_type":"Bearer",
   "expires_in":3600,
   "refresh_token":"74d0d7e6d4b3c19484f5135593c2dc88",   		  "id_token":"eyJhbGciOiJSUzI1NiJ9.eyJhdXRoX3RpbWUiOjE0NTIxNzAxNzYsImV4cCI6MTQ1MjE3Mzc3Niwic3ViIjoidXNlQGNhcmJvbi5zdXBlciIsImF6cCI6IjF5TDFfZnpuekdZdXRYNWdCMDNMNnRYR3lqZ2EiLCJhdF9oYXNoIjoiWWljbDFlNTI5WlhZOE9zVDlvM3ktdyIsImF1ZCI6WyIxeUwxX2Z6bnpHWXV0WDVnQjAzTDZ0WEd5amdhIl0sImlzcyI6Imh0dHBzOlwvXC9sb2NhbGhvc3Q6OTQ0M1wvb2F1dGgyXC90b2tlbiIsImlhdCI6MTQ1MjE3MDE3Nn0.RqAgm0ybe7tQYvQYi7uqEtzWf6wgDv5sJq2UIQRC4OJGjn_fTqftIWerZc7rIMRYXi7jzuHxX_GabUhuj7m1iRzi1wgxbI9yQn825lDVF4Lt9DMUTBfKLk81KIy6uB_ECtyxumoX3372yRgC7R56_L_hAElflgBsclEUwEH9psE",
   "access_token":"f1824ef345f0565ab88a06a51db98d24"
}
```
The returned ID token carries the user details. It follows the following format: <header>.<body>.<signature>. The decoded ID token can be seen below.
Decoded ID Token
```
{"alg":"RS256"}.
{  
   "auth_time":1452170176,
   "exp":1452173776,
   "sub":"use@carbon.super",
   "azp":"1yL1_fznzGYutX5gB03L6tXGyjga",
   "at_hash":"Yicl1e529ZXY8OsT9o3y-w",
   "aud":[  
      "1yL1_fznzGYutX5gB03L6tXGyjga"
   ],
   "iss":"https:\/\/localhost:9443\/oauth2\/token",
   "iat":1452170176
}.<signature value>
 
```
Tip: Alternatively, you can get user information by running the following cURL command on the terminal.

You can also try out this scenario with different consent values {none, login and consent}. To do this, try the following URLs when entering the Authorization Endpoint URL in step 2 of the Try out scenario section.

Authorization Endpoint URL	Description
`https://localhost:9443/oauth2/authorize?prompt=none`	The Identity Server does not display any authentication or consent user interface pages. An error is returned if an end user is not already authenticated or the client does not have pre-configured consent for the requested claims or if there are any other unfulfilled conditions for processing the request.
`https://localhost:9443/oauth2/authorize?prompt=login`	Even if the end user is already authenticated, it will prompt the end user for re-authentication.
`https://localhost:9443/oauth2/authorize?prompt=consent`	Even if the consent is already given, it will prompt the end user for consent again before returning information to the client.
`https://localhost:9443/oauth2/authorize?prompt=consent login`	The user will be prompted to login as well as for consent when returning information to the client. From IS 5.2.0 onwards, you can send multiple prompt parameters (e.g., prompt=consent login) in a format similar to this URL.

Note: To skip user consent, you can also edit the following property in the <IS_HOME>/repository/conf/identity/identity.xml file found under the <OAuth> <OpenIDConnect> tags. To skip user consent, set this property to true.

<SkipUserConsent>false</SkipUserConsent>

Note that even if this property is set to true so that it will skip user consent, if you use an Authorization Endpoint URL that prompts user consent (e.g.,https://localhost:9443/oauth2/authorize?prompt=consent), it will still prompt consent from the user.