Configuring Inbound Authentication for a Service Provider

1. Expand the SAML2 Web SSO Configuration and click Configure.
2. Fill in the form that appears.
   
3. Click Register.

The following points should be taken into consideration when filling the above New Service Provider form.

To enable OAuth support for your client application, you must first register your application by providing an application name. For code and implicit grant types, you have to provide a callback URL. Follow the instructions below to add a new application.

1. Expand the OAuth/OpenID Connect Configuration and click Configure.
2. Fill in the form that appears. For the Allowed Grant Types you can disable the ones you do not require or wish to block.
   
3. Click Add. The following information is added for your service provider.
   
   
   • OAuth Client Key - This is the client key of the service provider, which will be checked for authentication by the Identity Server before providing the access token.
   • OAuth Client Secret - This is the client secret of the service provider, which will be checked for authentication by the Identity Server before providing the access token. Click the Show button to view the exact value of this.

   Tip: The OAuth client key and client secret are stored in plain text. To encrypt the client secret, access token and refresh token, do the following:

   Open the identity.xml file found in the <IS_HOME>/repository/conf/identity directory and change the <TokenPersistenceProcessor> property as follows:

   <TokenPersistenceProcessor>org.wso2.carbon.identity.oauth.tokenprocessor.EncryptionDecryptionPersistenceProcessor</TokenPersistenceProcessor>

When filling out the New Application form, the following should be taken into consideration.

• Selecting OAuth Version as 1.0a removes all the configurable Allowed Grant Types. This is because this version of OAuth does not support grant types.
• The Callback Url is the exact location in the service provider's application where an access token would be sent. This is a required field and important to configure as it is imperative that the service provider receives the access token. This is necessary for security purposes to ensure that the token is not compromised.
• The following are the grant types that are used to get the access token.
  • Code - Entering the user name and password required at the service provider will result in a code being generated. This code can be used to obtain the access token.
  • Implicit - This is similar to the code grant type, but instead of generating a code, this directly provides the access token.
  • Password - This authenticates the user using the password provided and the access token is provided.
  • Client Credential - This is the grant type for the client key and client secret. If these two items are provided correctly by the service provider, the access token is sent.
  • Refresh Token - This will enable the user to obtain an access token by using the refresh token once the originally provided access token is used up.
  • SAML - This uses SAML as the grant type to obtain the access token.
  • IWA-NTLM - This is similar to the password grant type, but it is specific to Microsoft Windows users.

1. Expand the OpenID Configuration.
2. Enter the identifier for the OpenID Realm as specified in the form below. This identifier need to be specified as identification when the service provider reaches out to the Identity Server. 
   

WSO2 Identity Server's passive security token service (Passive STS) is used as the WS-Federation implementation. 

Configuring passive STS

1. See here for details on adding a service provider. 
2. Expand the Inbound Authentication Configuration followed by the WS-Federation (Passive) Configuration section and provide the following values. 
   

   • • Passive STS Realm - 

       This uniquely identifies the web app. Provide the same realm name given to the web app you are configuring WS-Federation for.

     • Passive STS WReply URL - 

       Provide the URL of the web app you are configuring WS-Federation for.  This endpoint URL handles the token response. 

       Tip

       If you want to configure an expiration time for the security token, you need to add the following configuration in the <IS_HOME>/repository/conf/carbon.xml file, under the <Server> element:

       <STSTimeToLive>1800000</STSTimeToLive>

       Here, the expiration time should be specified in milliseconds.

     
     

   
3. Expand the Claim Configuration section and map the relevant claims. See Configuring Claims for a Service Provider for more information. 
4. Click Update to save changes. 

WSO2 Identity Server's security token service (STS) is used as the WS-Trust implementation. The STS is capable of issuing SAML 1.1 and 2.0 security tokens and has a SOAP/XML API for token issuance. This API can be secured with the UserNameToken or with any other WS-Security mechanism.

Configuring STS

STS is configured under the Resident Identity Provider section of the Identity Server Management Console. Use the following step to do the configurations.

1. Configure the Resident Identity Provider. See here for more detailed information on how to do this.
2. In the Resident Identity Provider page, expand the Inbound Authentication Configuration section along with the Security Token Service Configuration section.
3. Click Apply Security Policy.
   
4. Select Yes in the Enable Security? dropdown and select UsernameToken under the Basic Scenarios section.
   
5. Click Next.
6. In the resulting page, select the admin checkbox and click Finish.
   
7. Click Ok on the confirmation dialog window that appears and click Update to complete the process.

Now STS is configured and secured with a username and password. Only users with the Admin role can consume the service.

The next step is to add a service provider to consume the STS.

Adding a service provider for the STS client

1. See here for details on adding a service provider. 
2. Expand the Inbound Authentication Configuration section and the WS-Trust Security Token Service Configuration section. Click Configure.
   
3. In the resulting screen, enter the Endpoint Address. This must be used as the service URL and the token is delivered by the STS client.
   
4. Click Update to save the changes made to the service provider.