How to set up Single Sign-On between different Carbon instances

Hello all, I am back :)

Today we are going to look into a use case scenario where SAML2 Single Sign-On is enabled between two carbon instances.

Note : In this blog post I am using two WSO2 IS 4.0.0 instances for the setup. One instance we consider as the Identity Provider, and the other instance is the Identity Relying Party.

First of all download the WSO2 IS, and copy the binary file into two separate folders(ex:- Identity Provider and Identity Relying Party) that you have created, and extract the content.

We need these two instances to run in two different ports. 
Therefore, we need to select one of the instances and change the port. In order to do that go to the selected folder <productHome>\repository\conf and open the carbon.xml file.

Search for the <offset> tag and replace 0 with 1 to increment the default server running port by 1. 

In this example I selected the Identity Relying Party, and changed the default port. Therefore it will run on port 9444.

Now , start a new command line window and run the Identity Provider. (You can refer the post How to Start Up WSO2 Identity Server for help)

Get the Identity Provider server running port from the command prompt, and go to Identity Relying Party <productHome>\repository\conf\security. Open the authenticators.xml file and set the following settings.

Priority : This should be grater than five to be picked up as the highest priority authenticator.

Parameter LoginPage : default login page url of carbon

Parameter ServiceProviderID: This is the unique identifier for the carbon server in an SSO setup, and this value should be used as the value of the issuer in the Identity Single Sign-On provider configurations.

Parameter IdentityProviderSSOServiceURL: This is the url of the Identity Provider and this should be in the following format https://(host-name):(port)/samlsso

Now go and open the management console of the Identity Provider on the browser window, and Login using admin, admin for username and password respectively.

Run the Identity Relying party server, opening another command prompt window, and get the server running port.

From the left menu panel of the Identity Provider, select Main and click on SAML SSO, and enter the following configurations.

Assertion Consumer URL should be in the format of  https://(host-name):(port)/acs.

Now save the issuer, and log off from the management console of the Identity Provider.

Get the Identity Relying Party management console url and type it into your web browser.

Here you can see that you will be redirected to the Identity Provider with SAML2 SSO enabled, to enter the username and password.

Sign in using admin, admin as username and password respectively, and you will be redirected to your Identity Relying Party management console Home.

Thank you!

How to Sign-In to WSO2 Identity Server using Google Plus OpenID

Hi all,

Today we will try to understand one of features of WSO2 Identity Server which is OpenID Sign-in.

If you are new, you can refer to the post How to start up WSO2 Identity Server to learn how to get started with WSO2 Identity Server.

Okay, I assume you all have WSO2 IS up and running in your machine and the IS management console opened in your browser.

When we use WSO2 IS OpenID Sign-in option, we are using IS as the identity relying party in this instance (according to the SSO concept )

Note: WSO2 IS provides two SSO mechanisms: SAML2 based SSO and OpenID based SSO. WSO2 IS offers features to act as an Identity Provider as well as an Identity Relying Party. This blog has been tested with WSO2 IS 4.1.0.

Back to the topic, go to your localhost IS management console url, and find the OpenID Sign-in option on the top left corner.

Select the option, and you will be directed to the following page.

Copy and paste your Google profile url into the input area and click Login.( Here I am using the Google + profile url).

Then you will be asked whether you already have a profile in WSO2 IS to associate your OpenID, to Sign In or Sign Up for a new account.

If you are a new user, go and fill in your details to Sign Up and Submit.If you already have an account, enter your username and password to Sign In.In subsequent attempts, you can select the OpenID Sign-in option and paste your Google profile url (the openid) to sign in to WSO2 IS.

Okey, now you are successfully logged in to WSO2 IS. Lets talk about the other cool features of WSO2 IS next time we meet.

Cheers!!