Configure SAML2 Single Sign-On on WSO2 servers with WSO2 Identity Server.

By following this post you will be able to find out how to configure WSO2 servers to have SAML2 SSO with WSO2 Identity Server (IS) as the identity provider. It is really simple to configure SAML2 SSO for carbon servers.
I am going to address the server that you need to have SSO configured as 'Carbon Server' and just by following the below 2 steps you can configure SSO in your carbon server with WSO2 IS.

1. Configure your carbon server to enable SSO

All the required configuration to have SSO in your carbon server are in Carbon server/repository/conf/security/authenticators.xml

• Enable SSOAuthenticator in authenticators.xml

( 1 ) Set disabled="false"

( 2 ) This should be unique to your carbon server. You will need this value when configuring IS too.

• Start your carbon server with an offset ( offset can be configured in carbon.xml)

2. Register a service provider in IS side

• Start IS in default port ( 9443 ) and log in 
• Follow Main > Manage > SAML SSO > Register New Service Provider
• Add the unique identifier ( 2 ) as the Issuer
• Provide Assertion Consumer URL with your carbon server info as https://[host name]:[port]/acs
• Tick on Enable Response Signing and Enable Assertion Signing
• Click on "Register"

Now you are done. You can simply try to log into your carbon server with SSO.
To verify
    - Try to access https://[host name]:[port]/carbon
    - This will direct you to the authentication endpoint of IdentityProviderSSOServiceURL specified in authenticators.xml
      ( here https://localhost:9443/authenticationendpoint )
    - Give the credentials and hit Sign in
    - You will be logged in to your carbon server

Write a simple JDBC PIP attribute finder module for WSO2 Identity Server

With this post I am going to discuss on how you can implement a simple JDBC PIP attribute finder module for WSO2 IS. I am using the latest released IS version ( WSO2 IS version 4.5.0 ) which you can download from here.

To have your own customized PIP module, the main task is to implement an attribute finder. It is not that hard since we already have the modeling interfaces. You can simply extend the AbstractPIPAttributeFinder ( abstract class) or implement PIPAttributeFinder ( interface ) to create your attribute finder.

I will provide step by step guide on how to

• Create your own attribute finder
• Register your PIP module in WSO2 IS
• Test your attribute finder

Create your own attribute finder

I am going to create a JDBC attribute finder where the attributes required are stored in a database. I am going to use mysql for this sample.

I will add a sample code for our attribute finder and I'm going to address it as JDBCAttributeFinder.

package org.wso2.identity.samples.entitlement.pip.jdbc;

import org.apache.commons.dbcp.BasicDataSource;
import org.wso2.carbon.identity.entitlement.pip.AbstractPIPAttributeFinder;

import java.sql.Connection;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.util.HashSet;
import java.util.Properties;
import java.util.Set;

/**
 * This is sample implementation of PIPAttributeFinder in Wso2 Entitlement Engine Here we are
 * calling to a external user base to find given attribute Assume that user store is reside on mysql
 * database
 */
public class JDBCAttributeFinder extends AbstractPIPAttributeFinder {

    /**
     * DBCP connection pool is used to create connection to database
     */
    private BasicDataSource dataSource;

    /**
     * List of attribute finders supported by the this PIP attribute finder
     */
    private Set supportedAttributes = new HashSet();

    /**
     * initializes the Attribute finder module. creates a connection with JDBC database and the
     * retrieve attribute names from following sample table
     * +--------------+----------------+-----------------+---------+
     * | ATTRIBUTE_ID | ATTRIBUTE_NAME | ATTRIBUTE_VALUE | USER_ID |
     * +--------------+----------------+-----------------+---------+
     * | 1 | EmailOfUser | asela@gmail.com | 1 |
     * | 2 | EmailOfUser | bob@gmail.com | 2 |
     * | 3 | EmailOfUser | peter@gmail.com | 3 |
     * | 4 | CountryOfUser | SL | 1 |
     * | 5 | CountryOfUser | USA | 2 |
     * | 6 | CountryOfUser | UK | 3 |
     * | 7 | AgeOfUser | 23 | 1 |
     * | 8 | AgeOfUser | 19 | 2 |
     * | 9 | AgeOfUser | 31 | 3 |
     * +--------------+----------------+-----------------+---------+
     *
     *
     * @throws Exception throws when initialization is failed
     */
    public void init(Properties properties) throws Exception {
        /**
         * JDBC connection parameters
         */
        String dbUrl = properties.getProperty("databaseUrl");
        String driver = properties.getProperty("driverName");
        String userName = properties.getProperty("userName");
        String password = properties.getProperty("password");
/**
 * SQL statement to retrieve all attributes from database
 */
        String sqlStmt = "SELECT * FROM UM_USER_ATTRIBUTE";

        Connection connection = null;
        PreparedStatement prepStmt = null;
        ResultSet resultSet = null;

        dataSource = new BasicDataSource();
        dataSource.setUrl(dbUrl);
        dataSource.setDriverClassName(driver);
        dataSource.setUsername(userName);
        dataSource.setPassword(password);

        try {
            connection = dataSource.getConnection();
            if (connection != null) {
                prepStmt = connection.prepareStatement(sqlStmt);
                resultSet = prepStmt.executeQuery();
                while (resultSet.next()) {
                    String name = resultSet.getString(2);
                    supportedAttributes.add(name);
                }
            }
        } catch (SQLException e) {
            throw new Exception("Error while initializing JDBC attribute Finder", e);
        }
    }

    /**
     * This returns the name of the module
     * @return Returns a String that represents the module name
     */
    public String getModuleName() {
        return "JDBCPIPAttributeFinder";
    }

    /**
     * This returns the Set of Strings the attributeId that are retrieved
     * in initialization
     *
     * @return Set of String
     */
    public Set getSupportedAttributes() {
        return supportedAttributes;
    }

    /**
     * This is the overloaded simplify version of the getAttributeValues() method. Any one who extends the
     * AbstractPIPAttributeFinder can implement this method and get use of the default
     * implementation of the getAttributeValues() method which has been implemented within
     * AbstractPIPAttributeFinder class
     *
     * @param subject Name of the subject the returned attributes should apply to.
     * @param resource The name of the resource the subject is trying to access.
     * @param action  The name of the action the subject is trying to execute on resource
     * @param environment The name of the environment the subject is trying to access the resource
     * @param attributeId The unique id of the required attribute.
     * @param issuer The attribute issuer.
     *
     * @return Returns a Set of Strings that represent the attribute
     *         values.
     * @throws Exception throws if fails
     */
     public Set getAttributeValues( String subject, String resource, String action, String environment, String attributeId, String issuer) throws Exception {

        String sqlStmt = "select ATTRIBUTE_VALUE from UM_USER_ATTRIBUTE where ATTRIBUTE_NAME='" + attributeId + "' and USER_ID=(select USER_ID from UM_USER where USER_NAME='" + subject + "');";

        Set values = new HashSet();
        PreparedStatement prepStmt = null;
        ResultSet resultSet = null;
        Connection connection = null;

        try {
            connection = dataSource.getConnection();
            if (connection != null) {
                prepStmt = connection.prepareStatement(sqlStmt);
                resultSet = prepStmt.executeQuery();
                while (resultSet.next()) {
                    values.add(resultSet.getString(1));
                }
            }
        } catch (SQLException e) {
            throw new Exception("Error while retrieving attribute values", e);
        }
        return values;
    }
}

You need to create your PIP module by using this class.

Register your PIP module in WSO2 IS

I will provide the action that you should follow to get your module running.

• Build your module and copy the jar to CARBON_HOME/repository/components/lib
• Copy the JDBC driver to CARBON_HOME/repository/components/lib ( here the mysql-connector )
• Register your attribute finder by adding it to CARBON_HOME/repository/conf/security/entitlement.properties as follow ( make sure that you change the dbUserName and userPassword )

PIP.AttributeDesignators.Designator.2=org.wso2.identity.samples.entitlement.pip.jdbc.JDBCAttributeFinder
org.wso2.identity.samples.entitlement.pip.jdbc.JDBCAttributeFinder.1=databaseUrl,jdbc:mysql://localhost:3306/piptestdb
org.wso2.identity.samples.entitlement.pip.jdbc.JDBCAttributeFinder.2=userName,dbUserName
org.wso2.identity.samples.entitlement.pip.jdbc.JDBCAttributeFinder.3=password,userPassword
org.wso2.identity.samples.entitlement.pip.jdbc.JDBCAttributeFinder.4=driverName,com.mysql.jdbc.Driver

I am attaching the db script that can be used to generate data which is required for this sample, the sample module and the mysql-connector jar to make your job more easy

Test your attribute finder

Given below is a sample policy which can be used to test your new JDBC attribute finder.
You can find the uploaded policy here.

 
 
 
 
 foo
 
 
 
 
 
 
 
 
 
 
 bar
 
 
 
 
 
 
 
 
 
 
 
 18
 
 
 
 
 
 30
 
 
 
 
 

This policy says that only the users whose age is between 18 and 30 can access the resource “foo” and perform action “bar”

-  Copy the above sample policy to an xml file, start WSO2 IS and upload the policy file through Policy Administrator.

         Follow Policy Administration > Add New Entitlement Policy > Import Existing Policy

-  Enable the policy through Policy View

-  Publish the policy through Policy Administrator.

-  Click on Tryit and send a request. ( given below is a sample request which you can download from here)

foo




Bob




bar

Now you would see that your newly created attribute finder has come into play :)

There are some configuration changes if you are trying a 3.x.x version. This would help you to identify those changes if you are using an earlier version.

Convert XML String to OMElement and extract values

A simple tip which saves a lot of your time...
You can simply convert XML string to an OMElement as below

      OMElement resultElement = AXIOMUtil.stringToOM(xmlString);

Extracting values from XML

Sample XML code

        Gambardella, Matthew
        
        Computer
        44.95
        2000-10-01
        An in-depth look at creating applicationswith XML.
    
    
        Ralls, Kim
        
        Fantasy
        5.95
        2000-12-16
        A former architect battles corporate zombies,an evil sorceress.
    
    
        Corets, Eva
        
        Fantasy
        5.95
        2000-11-17
        After the collapse of a nanotechnologysociety in England.
    
    
        Corets, Eva
        
        Fantasy
        5.95
        2001-03-10
        In post-apocalypse England, the mysteriousagent known only as Oberon.
    

Java code to retrieve values

OMElement resultElement = AXIOMUtil.stringToOM(xmlString);

        Iterator i = resultElement.getChildren();
        while (i.hasNext()) {
            OMElement book = (OMElement) i.next();
            Iterator properties = book.getChildren();
            System.out.println("====== book =======");
            while (properties.hasNext()) {
                OMElement property = (OMElement) properties.next();
                String localName = property.getLocalName();
                String value = property.getText();
                System.out.println(localName + ": " + value);
            }
        }

Result

====== book =======
author: Gambardella, Matthew
title: XML Developer's Guide
genre: Computer
price: 44.95
publish_date: 2000-10-01
description: An in-depth look at creating applicationswith XML.
====== book =======
author: Ralls, Kim
title: Midnight Rain
genre: Fantasy
price: 5.95
publish_date: 2000-12-16
description: A former architect battles corporate zombies,an evil sorceress.
====== book =======
author: Corets, Eva
title: Maeve Ascendant
genre: Fantasy
price: 5.95
publish_date: 2000-11-17
description: After the collapse of a nanotechnologysociety in England.
====== book =======
author: Corets, Eva
title: Oberon's Legacy
genre: Fantasy
price: 5.95
publish_date: 2001-03-10
description: In post-apocalypse England, the mysteriousagent known only as Oberon.

Get started with WSO2 App Factory

AppFactory is an elastic and self-service enterprise DevOps platform to mange applications from cradle to grave. This is a 100% free and open source solution developed by WSO2 which covers the whole lifecycle of an application. You will be facilitated by all the required resources for the application created in one go. Just use ones, you will see the difference :)

Getting started is very simple. It is all online running on cloud. But I will go through step by step, so you do not miss anything.

Create an account

Click the 'Register' link in App Factory live URL

You need to fill the following form to get registered.

Do not worry about the phone number field, just give some number there if you do not like to put the actual number.

If your registration is successful you will be asked to check your email.

Change the default password

Using the URL sent to your email address given at register time, log in to the system and change password.
(Remember, that log in URL can be used only ones and you need to change the default password in that log in)

Then we will change the default password with the one you gave

 Log in to AF

Use this link and log into the system using your new password. You will see the following page just after the log in.

But wait for few seconds, we are creating a default application for you :)

When you navigate to the application that just now got created, you will see the set of features and the functionalities that are bound with your application. 

I will discuss about how to manage the applications with App Factory in a recent post.

Write your first Axis2 service

In this post I will describe on how to create a simple HelloWorld axis2 service by following three simple steps.

1. Implement the service class
2. Create the services.xml file
3. Pack the service as .aar file archive

Implement the service class

First we need to create the service class and the service methods. We will create HelloService.java service class and sayHello operation as shown below.

Create the services.xml file

    services.xml is a configuration file which all the axis2 web services must have.

    Create a META-INF directory and create the services.xml file inside the META-INF directory.

    You should define the service class as a parameter in services.xml

                 Your project structure will look like the following.

Pack the service as .aar file archive

    Compile your service class using javac command.

                  ie: javac HelloService.java -d ./ 

    

    Get a copy of your META-INF directory and the compiled .class file of the service to a temp

    directory. Now the tree structure of those should be as follows.

    Create an archive file with the META-INF directory and the compiled .class file of the service

    class and rename the archive to a .aar   

    

    Now you have a deployable axis2 service with you.

Get started with WSO2 Stratos Live and deploy your first axis2 service.

WSO2 Stratos Live is a complete open source PaaS and Cloud Middleware Platform.
To get a space in Stratos what you need is only an internet connection :)

By following the below mentioned steps you can have a your own service up and running in Stratos Live.

1. Register to Stratos Live
   Visit WSO2 Stratos site and click on 'Get Started Now For FREE' button to create an account and a domain for your tenant. You have to fill the registration form with the relevant information.
   
   

   

   
   
   
   The admin username and the domain name is used as the login username.
   The e-mail address you enter should be a valid one. A verification e-mail is send to that email address and you have to verify your email address by following the instructions in the mail.
   
   
2. After the verification you can log in to the Stratos manager page using the username and password given when registering.
   
   

   

   Now you have logged in to your domain in Stratos Live.
   
   
3. The services provided in Stratos for your tenant can be seen there. Click on Application Server to deploy an axis2 service in Application Server.
   
   

   

   
   
   
4. In the 'Main' tab of the left menu you can see the service types that you can add. Click on Axis2 Service under Web Services → Add
   
   

   

   
   
   
5. Upload your service archive by choosing the .aar file.
   ( You can read on how to create a simple axis2 service from this article )
   
   
6. Now you have deployed your axis2 service in Straots Live. You can access it by 'List' under Web Services in left menu.
   
   
7. Click on 'Try this service' and you can try the deployed service.

How to Deploy WSO2 Stratos Locally

WSO2 Stratos is a complete open source PaaS where you can use any of the WSO2 products as a service. This article describes how to set up WSO2 stratos locally by following few simple steps.


Prerequisites

mysql
following perl modules

• File::Copy ( sudo apt-get install libfile-copy-recursive-perl )
• File::Path (sudo apt-get install libfile-path-perl )
• File::Basename (sudo apt-get install libfile-basedir-perl )
• XML::LibXML (sudo apt-get install libxml-libxml-perl
• You many need to install libxml2-dev first- sudo apt-get install libxml2-dev)
• Archive::Zip ( sudo apt-get install libarchive-zip-perl )
• Getopt::Std (sudo apt-get install libgetopt-declare-perl )
• List::MoreUtils ( sudo apt-get install liblist-moreutils-perl )

Introduction

WSO2 Stratos is a complete open source Platform as a service (PaaS). You can use any WSO2 product through WSO2 Stratos Live which is the public online platform. And now you have the capability of deploying WSO2 Stratos in your personal computer by executing just a few simple steps. You can deploy WSO2 Stratos as a private cloud in your local machine with any of the WSO2 services required. Following are those service names with the terms that you can use to indicate them at the deployment time.

Service Name	term
WSO2 Stratos (Manager)	manager
WSO2 Business Process Server	bps
WSO2 Business Activity Monitor	bam
WSO2 Application Server	as
WSO2 Identity Server	is
WSO2 Enterprise Service Bus	esb
WSO2 Governance Registry	greg
WSO2 Data Service Server	dss
WSO2 Gadget Server	gs
WSO2 Mashup Server	ms
WSO2 Business Rules Server	brs
WSO2 Complex Event Processing Server	cep
WSO2 Message Broker	mb

Applies To

Service packs of version 1.5.2

Downloading Binaries

• First you have to download the binaries of the services that is required to deploy as services. The binary files of WSO2 Stratos services can be found in WSO2 Stratos release page.
• Download the required binary files listed under ‘Stratos Packs’.
• By running the WSO2 Stratos setup script which can be downloaded from here

you can simply setup WSO2 Stratos in your machine in few minutes.

 Preparing to Setup WSO2 Stratos

• Now you are ready to deploy WSO2 Stratos in your machine with the binary files that you have already downloaded. First copy all the binary files of the required services to one directory, e.g home/usr/stratos/packs.

Run the Script

• Now by simply executing the setup script and following the instruction given you can deploy stratos. For that use terminal and navigate to the build directory that you have checked out now.
• Give execute permission to the setup script by running chmod 755 ./stratos-setup.pl
• Run the following command with the required fields filled.

./stratos-setup.pl -p -t -v "" -s -d -l "" -c -u -w

-p : path to stratos packs directory (here /home/usr/stratos/packs)

-t : path that you want to deploy stratos ( Note that you should give the location of an   empty directory. If not the script will delete all the files/directories inside that given directory )

-v : version of the packs. ( All the packs should have the same version)

-s : whether you want to enable single sign on

If you put '-s true' you must deploy IS pack and to start any other service, you need to start IS. The advantage is that you would be able to to access any other server that you have started, without entering user credentials.

-d : whether to create the database. (At the first time you deploy stratos you should set this to true to create the relevant database and the tables)

-l : names of services that you need to deploy. These names should be separated by a space. If you want to deploy IS,manager and greg put ‘-l is manager greg’

-c : path to stratos_config_min.xml ( It is in the checked out 'build' directory )

-u : database username

-w : database password

(ex : ./stratos-setup.pl -p /home/usr/stratos/packs -t /home/usr/stratos/deploy -v "1.5.2" -s false -d true -l "is manager greg" -c ./stratos_config_min.xml -u myusername -w mypassword )

This script will setup the services locally.

Adding Entries to /etc/hosts

You will be informed to add the following lines to /etc/hosts file.

127.0.0.1 cloud-test.wso2.com

127.0.0.1 identity.cloud-test.wso2.com

127.0.0.1 governance.cloud-test.wso2.com

127.0.0.1 appserver.cloud-test.wso2.com

127.0.0.1 monitor.cloud-test.wso2.com

127.0.0.1 data.cloud-test.wso2.com

127.0.0.1 process.cloud-test.wso2.com

127.0.0.1 rule.cloud-test.wso2.com

127.0.0.1 cep.cloud-test.wso2.com

127.0.0.1 esb.cloud-test.wso2.com

127.0.0.1 gadget.cloud-test.wso2.com

127.0.0.1  messaging.cloud-test.wso2.com

127.0.0.1 mashup.cloud-test.wso2.com

By adding the entries to /etc/hosts file you can complete the stratos local deployment process. The deployed services will be in the deployment directory. ( here in /home/usr/stratos/deploy )

Starting Services

• You can start any service by navigating to the bin folder of that service ( /home/usr/stratos/deploy//bin ) and running the command ./wso2server.sh
• To start all WSO2 Stratos services in one command, navigate to the deploy folder ( /home/usr/stratos/deploy/ ) and run ./stratos.sh start all and to stop ./stratos.sh stop all