How to apply security policies with WSO2 ESB 4.9.0

Hi All,

Here is a quick tutorial on how to create a secured service in WSO2 ESB 4.9.0. As QoS is removed from the admin console, now you will have to use WSO2 Developer Studio to apply the relevant security policies for the proxy services.

1) Download WSO2 ESB 4.9.0 and WSO2 Developer Studio 3.8.0
2) Extract these into folders
3) First we need to create a policy using the developer studio
Please refer following URL on creating a new policy - here we can use UsernamToken Policy
policy https://docs.wso2.com/display/DVS380/Applying+Security+for+a+Service#ApplyingSecurityforaService-Creatingthesecuritypolicy

4) Then you need to create the proxy service - for this first create an ESB Config Project from the Developer Studio Dashboard - then right click on the project name and add a proxy service

5) For this scenario lets create a simple Pass through proxy- lets use StockQuote Sample as the sample endpoint

Please follow the following link on how to startup the sample services https://docs.wso2.com/display/ESB490/Setting+Up+the+ESB+Samples#SettingUptheESBSamples-StartingtheAxis2server

6) After creating the proxy , you need to add the previously created security policy to the proxy service

Please refer the following guide on how to do that  https://docs.wso2.com/display/DVS380/Applying+Security+for+a+Service#ApplyingSecurityforaService-Applyingsecurityforaproxyservice

7) After creating both proxy service and the policy , you need to deploy this into the ESB. For this purpose lets create a composite application First

8) Go to the Developer studio dashboard and Click on Composite Application Project - there give a name to the project and select both the proxy service project and the policy project you have created and click on Finish

9) Now right click on the created composite application project and click on Export Composite Application Project

10) Now startup the ESB server and Login - then go to Carbon Applications from the right side menu and upload the car file by clicking on Add

11) After the successful deployment of the .car file when you go to list the proxy services you can see the created Proxy Service with Security Applied

12) Click on Try this Service and the following window will be opened

Note :- please enter the username and password and select the https endpoint as shown above and invoke the service with a parameter ex:- IBM

You will get the relevant response :)

Cheers...!!

Use Case scenarios with WSO2 Identity Server 5.0.0 - Part 2

Hi All,

Today lets talk about database connectivity with WSO2 Identity Server.  As you know WSO2 Identity Server can be deployed over any LDAP, AD or JDBC user store. In fact, you can create write a custom user store manager , and connect to any legacy databases.

The WSO2 IS has the concept of primary database and secondary databases. If you are to change the primary database, you will have to change the configuration files and start-up the server. But , if you are going to add the secondary databases, you can do this through the IS management console. This is some background information on the product.

Now, lets talk about a common use case scenario.

Say, you have a need of connecting the IS server to many databases. Clearly you can do this by connecting all the databases as secondary databases. Therefore, if a use is trying to get authenticated, the user will be authenticated against checking all the databases connected.

Solution 1
-------------
If your user bases are located in different geographical locations, say for an example you have three offices located in three countries , and you need to connect Identity Server to the three user databases located in these countries, what  you can do is connecting these databases as secondary databases via VPN connections.

Solutions 2
----------------
Another solution would be to have 3 Identity Servers in each of these countries, and have one central Identity Server where you can provision users from other three servers to the central server where the user will be authenticated against.

Please check on following resource links for implementation of these scenarios :-

[1] https://docs.wso2.com/display/IS500/Working+with+User+Stores
[2] https://docs.wso2.com/display/IS500/Configuring+Primary+User+Stores
[3] https://docs.wso2.com/display/IS500/Configuring+Secondary+User+Stores
[4] https://docs.wso2.com/display/IS500/Identity+Provisioning+Concepts
[5] https://docs.wso2.com/display/IS500/Identity+Provisioning

Cheers ! Last post for year 2014...have a wonderful 2015 ahead...see you in the next year ;)

Product releases, and relevant information - WSO2

This is just a note + anyone who is looking for this information - not a fancy blog post :)
---------------------------------------------------------------------------------


Once a WSO2 product is released,  the release related information is recorded in the release matrix [1] :-

[1] http://wso2.com/products/carbon/release-matrix/

You can refer the relevant release dates , the released chunk , relevant P2 repo link (for feature installations), compatible carbon version, and the platform.

If you click on P2 repo link , it will redirect you to the relevant P2 repo information and the link. We use this for the feature installations for the WSO2 Products. For and example, when you need to install WSO2 Identity Server , Key Manager to WSO2 API-M, then you can install those features to API-M using the relevant P2 repo link.

If you want to refer the relevant source code for a particular release, you can check the the Chunk where the product is released.

Normally, in the WSO2 svn, there will be following categories.

1) trunk  - normal development
2) branch - getting ready for a relase development
3) tag - once released the product is available under the tag


If you want to look for the source code for a particular release you can check under the relevant released , you can check for the chunk the product is released, then check for the relevant feature source code under  components...

For an example :-

API-M 1.8.0 can be found under [1], and you can check relevant source code for API-M : Store at [2].

[1] https://svn.wso2.org/repos/wso2/carbon/platform/tags/turing-chunk14/products/apimgt/1.8.0/
[2] https://svn.wso2.org/repos/wso2/carbon/platform/tags/turing-chunk14/components/apimgt/api-store-web/

Cheers..!!!

Use cases with WSO2 IS 5.0.0 - Part 2 - User Provisioning - Part 1

Lets discuss about a user provisioning use case with regards to the provisioning framework of WSO2 Identity Server 5.0.0.

With the introduction of the the new Identity Server, There are lot of provisioning capabilities available. There are 3 major concepts as Inbound, outbound provisioning and Just-In-Time provisioning. Inbound provisioning means , provisioning users and groups from an external system to IS. Outbound provisioning means , provisioning users from IS to other external systems. JIT provisioning means , once a user tries to login from an external IDP, a user can be created on the fly in IS with JIT. Please read this awesome blog post about Provisioning framework of WSO2 Identity Server.

Now, lets take a sample scenario and talk about provisioning would work using provisioning capabilities of WSO2 IS.

The above diagram depicts a scenario where a user will be provisioned from and external system (Inbound provisioning), and in the same flow once the user is provisioned to the IS - A, this user will be provisioned to the other external systems like Google Apps, or another IS (Out bound provisioning).

From an external system you can provision users with SCIM or SPML connector, as well as you can use SOAP admin services to add a user. Or else another option would be, if none of the above mentioned can be used, you can always write a custom provisioning connector and plug in with WSO2 Identity Server.

For provisioning users to external systems, there are OOTB connectors shipped with WSO2 IS, or else you can always write a custom connector according to your requirement.

Lets talk about how to configure such a provisioning scenario in the next related post .....

Run Time Governance Use Case with WSO2 GREG and ESB - 1

Hi Ya''ll,

Long time ...How are you all doing? It is Christmas time again....Lets try to learn a run time governance scenario with WSO2 Governance Registry today.....:)

Lets start understanding the scenario with a diagram....

We can describe the above diagram as follows :-

1. Custom security policy is uploaded via GREG.
2. GREG is mounted with ESB.
3. Security proxy is created applying the custom policy in the registry (referring the policy in the GREG)
4. Proxy is created for the service hosted in the application server.

Once the service is invoked via SoapUI, since the security policy is applied at ESB , it will refer to the policy in the Governance Registry at the rum-time. Once the security policy is properly validated, the response will be passed back to the invoking party.

In the next post lets talk about how to simply build up the above scenario......

Bye bye for now...:)

Mutual SSL with WSO2 Enterprise Service Bus

Lets try to simply understand what is this Mutual SSL

I hope the following diagram will draw a good image in your brain to understand this

-------------------------------------------------------------------------------------------------------

Okay, lets see what happens in each step of the SSL handshake :-

(1) Client says hello and request for the Server certificate
(2) Server says hello with the certificate

That is the first handshake that happens , but when you enable mutual SSL there is a another handshake happens.

(3) Server says hello with requesting for the client certificate
(4) Client says hello back with the certificate

ONCE BOTH THE PARTIES TRUST EACH OTHER THEY ESTABLISH THE CONNECTION FOR FURTHER ACTIONS BETWEEN CLIENT AND THE SERVER.

Now lets look at what requirements should be completed into order for this to happen :)

(1) Client trust store should have the CA certificate / server certificate - signed by CA of the server - 

FOR THE CLIENT TO TRUST THE SERVER

(2) Server trust store should contain the CA certificate / client certificate - signed by CA of the client - 

FOR SERVER TO TRUST THE CLIENT

(3) The Certificate Authority who have signed the certificate should be trusted by both the parties


Now that you have an understanding of what is mutual SSL and what are the requirements needed, please have a look at the following important blog post by Asela in order to how to check the mutual SSL capability of the WSO2 ESB with an example java client :-

Enable Mutual SSL for Proxy services in WSO2ESB - I

Mutual SSL also called as two way SSL :)

THANKS !

How to simply setup centralized logging with WSO2 Business Activity Monitor

Hi All,

Today lets look at the following simple problem:-

We have two products of WSO2 running in an environment. When we have to check events loggs we have to separately log into those two products to check the relevant events. Say we have more products running and then we will have to log in to all the product management consoles to achieve the motive.

Simple Solution:-

We can setup WSO2 BAM for centralized logging therefore that when you log into the management console of WSO2 BAM, you can check for event logs of both / several WSO2 servers in your environment setup.

The following diagram will draw a clear picture of the solution
-------------------------------------------------------------------------------

 Say in our sample scenario we have WSO2 IS and WSO2 ESB, we can save the event logs to BAM Cassandra database , therefore the logs are accessible from a central location.

Simple Steps to achieve above:-
-------------------------------------------

1. Go to the [IS HOME] / repository / conf / log4j.properties file and add the following LOGEVENT to the log4j.rootLogger

log4j.rootLogger=INFO, CARBON_CONSOLE, CARBON_LOGFILE, CARBON_MEMORY, LOGEVENT


2. Then go to [IS HOME] / repository / conf / etc / logging - config .xml and set the <archivedHost>hdfs://localhost:9000/</archivedHost>

3. Start the BAM server and then start the IS server. You can see the event logs for IS in BAM when you go to Home > Tools > Cassandra Explorer > Connect to Cluster > Explore Cluster

4 . You can follow the same steps for ESB as well to set up the above scenario

Note :-

Connect to Cassandra with following details

Connection Url* localhost:9160
User Name         admin
Password          admin


Please refer to the following detailed blog for in depth details for centralized logging with BAM 

How Distributed Logging Works in WSO2 Stratos.

How to write a multiple Permit rule policy using WSO2 IS PAP simple policy editor - WSO2 IS 4.6.0

Hi All,

Today lets look at how to resolve the following simple problem scenario :-

Problem :-

Using WSO2 IS I want to give certain users the access to a web service that I have exposed.

But the rule must be in a way that one particular user "umesha" will only be having the READ rights, while all the other users will have READ, WRITE, DELETE rights.

How can I do this? of course you might know that you can achieve this with a  XACML policy to enable fine - grained authorization.

another problem - I do not know how to write XACML policies :O

Solution :-

Using WSO2 IS Simple Policy Editor you can write a multiple rule XACML policy, and you do not need to know XACML for this. 
Any novice user can create their own policies that comes with this feature of WSO2 XACML engine :)

Now lets look at how to write this simple policy :-

[You need to have WSO2 IS 4.6.0 downloaded and running]

1. Login to Identity Server Management Console

2. Go to Home > Entitlement > PAP > Policy Administration

3. And select Simple Policy Editor

4. Give the policy a name 

5 . Select what the policy is based on - Resource

6 . The name of the resource 

7. And then we will focus on the first rule

We need to give "umesha" the READ rights and READ rights only.

Select the Child Resource / UserName under User

Give the user name as "umesha"

Give the Action as "READ"

8. Now click on that little plus sign to add the other rule

To give all the other users READ, WRITE and DELETE actions

fill the selected UserName as "{^(?!umesha$).*}" - you should give this as a string regx

then give the actions as "READ | WRITE | DELETE"

9. Save the policy 

The Created policy will look like as follows:-

                 <Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="SimplePolicy" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable" Version="1.0">  
 <Target>  
 <AnyOf>  
 <AllOf>  
 <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">  
 <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">service</AttributeValue>  
 <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>  
 </Match>  
 </AllOf>  
 </AnyOf>  
 </Target>  
 <Rule Effect="Permit" RuleId="Rule-1">  
 <Target>  
 <AnyOf>  
 <AllOf>  
 <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">  
 <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">READ</AttributeValue>  
 <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>  
 </Match>  
 </AllOf>  
 </AnyOf>  
 </Target>  
 <Condition>  
 <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:any-of">  
 <Function FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal"/>  
 <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">umesha</AttributeValue>  
 <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>  
 </Apply>  
 </Condition>  
 </Rule>  
 <Rule Effect="Permit" RuleId="Rule-2">  
 <Condition>  
 <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">  
 <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">  
 <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">  
 <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">WRITE</AttributeValue>  
 <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">READ</AttributeValue>  
 <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">DELETE</AttributeValue>  
 </Apply>  
 <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>  
 </Apply>  
 <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:any-of">  
 <Function FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-regexp-match"/>  
 <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">^(?!umesha$).*</AttributeValue>  
 <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>  
 </Apply>  
 </Apply>  
 </Condition>  
 </Rule>  
 <Rule Effect="Deny" RuleId="Deny-Rule"/>  
 </Policy>  

How to access the H2 database of the WSO2 API Manager

1. Go to <APIM HOME>\repository\conf and open the carbon.xml

2. Enable the following configurations as shown below:-

<H2DatabaseConfiguration>
        <property name="web" />
        <property name="webPort">8082</property>
        <property name="webAllowOthers" />
        <!--property name="webSSL" />
        <property name="tcp" />
        <property name="tcpPort">9092</property>
        <property name="tcpAllowOthers" />
        <property name="tcpSSL" />
        <property name="pg" />
        <property name="pgPort">5435</property>
        <property name="pgAllowOthers" />
        <property name="trace" />
        <property name="baseDir">${carbon.home}</property-->
    </H2DatabaseConfiguration>

3. The start the server

4. Go to http://localhost:8082 where you can see the login page for the H2 database

5. Type jdbc:h2:repository/database/WSO2AM_DB as JDBC URL and wso2carbon as username and password.

How to configure WSO2 API Manager to use WSO2 BAM for statistics

1. Download WSO2 API Manager from here and WSO2 BAM from here.

First lets configure the BAM. I am using BAM 2.3.0 and APIM 1.5.0

BAM configuration
----------------------------

1. Change the <offset> tag of carbon.xml to 1 which is in <BAM HOME>\repository\conf (We are going to run APIM on port 9443 and BAM on 9444)

You can refer this for introductory information on WSO2 product start up. 

2. Then you have to copy the  API_Manager_Analytics.tbox which is in <APIM HOME>\wso2am-1.5.0\statistics to <BAM HOME>/repository/deployment/server/bam-toolbox

3. Add the following to <BAM_HOME>/conf/datasources/master-datasources.xml file.

<datasource>
          <name>WSO2AM_STATS_DB</name>
          <description>The datasource used for getting statistics to API Manager</description>
   <jndiConfig>
                <name>jdbc/WSO2AM_STATS_DB</name>
            </jndiConfig>
          <definition type="RDBMS">
          <configuration>
                 <!-- JDBC URL to query the database -->
                 <url>jdbc:h2:<BAM_HOME>/repository/database/APIMGTSTATS_DB;AUTO_SERVER=TRUE</url>
                 <username>wso2carbon</username>
                 <password>wso2carbon</password>
                 <driverClassName>org.h2.Driver</driverClassName>
                 <maxActive>50</maxActive>
                 <maxWait>60000</maxWait>
                 <testOnBorrow>true</testOnBorrow>
                 <validationQuery>SELECT 1</validationQuery>
                 <validationInterval>30000</validationInterval>
            </configuration>
         </definition>
  </datasource>

        <datasource>
           <name>WSO2BAM_CASSANDRA_DATASOURCE</name>
           <description>The datasource used for Cassandra data</description>
           <definition type="RDBMS">
               <configuration>
                   <url>jdbc:cassandra://localhost:9161/EVENT_KS</url>
                   <username>admin</username>
                   <password>admin</password>
               </configuration>
           </definition>
       </datasource>

Note:- When adding the above configurations, please check whether some of those are already there. No need of duplicating. And also check whehter the cassandra port is set to 9161 since we are running the BAM on port 9444. (we changed the offset of BAM)

For <BAM HOME> you need to give the path where you have extracted the BAM product.

Now lets go and configure APIM.

APIM configurations
--------------------------------------

1. Enable the following configurations in repository/conf/api-manager.xml.

<!--
   Enable/Disable the API usage tracker.
    -->
<Enabled>true</Enabled>

    <!--
        JNDI name of the data source to be used for getting BAM statistics.This data source should
        be defined in the master-datasources.xml file in conf/datasources directory.
    -->
    <DataSourceName>jdbc/WSO2AM_STATS_DB</DataSourceName>

2. Configure the following in the <APIM HOME>/conf/datasources/master-datasources.xml file.

<datasource>
         <name>WSO2AM_STATS_DB</name>
         <description>The datasource used for getting statistics to API Manager</description>
         <jndiConfig>
            <!-- This jndi name should be same as the DataSourceName defined in api-manager.xml -->
            <name>jdbc/WSO2AM_STATS_DB</name>
         </jndiConfig>
         <definition type="RDBMS">
            <configuration>
                <!-- JDBC URL to query the database -->
                <url>jdbc:h2:<BAM_HOME>/repository/database/APIMGTSTATS_DB;AUTO_SERVER=TRUE</url>
                <username>wso2carbon</username>
                <password>wso2carbon</password>
                <driverClassName>org.h2.Driver</driverClassName>
                <maxActive>50</maxActive>
                <maxWait>60000</maxWait>
                <testOnBorrow>true</testOnBorrow>
                <validationQuery>SELECT 1</validationQuery>
                <validationInterval>30000</validationInterval>
            </configuration>
         </definition>
    </datasource>

Note:- For <BAM HOME> you need to give the path where you have extracted the BAM product.

Now start the BAM server and then start the APIM.
Using WSO2 APIM you can create APIs and publish them to be used by external users by subscribing.
Lets learn about the WSO2 API Manager in the coming posts.

NOTE:-
In a clustered deployment change APIM setting in Gateway and Publisher nodes.

See ya'll for now :)

Fine-grained authorization with PIP points - WSO2 IS

Use Case Scenario :-

•User ‘john’ trying to get READ access by using his user id.

•Authorization should be given by validating the user id against user name, requesting use name information via PIP point.

•PIP requesting information from a web service.

Now lets see how to implement this use case scenario.

1 ) First of all you need to have the jax-rs service implemented.

Refer the blog post : http://umeshagunasinghe.blogspot.com/2013/09/how-to-create-jax-rs-service-using-wso2.html

2) Then you need to deploy it in the application server.

Refer the blog post: http://umeshagunasinghe.blogspot.com/2013/09/how-to-deploy-jax-rs-service-in-wso2.html

3) Then you have to write the PIP :http://umeshagunasinghe.blogspot.com/2013/10/how-to-write-pip-point-for-wso2-is.html

4) Now, register it in the Identity Server : http://umeshagunasinghe.blogspot.com/2013/10/how-to-register-pip-in-wso2-is.html

5) Write the XACML policy : http://umeshagunasinghe.blogspot.com/2013/10/how-to-write-simple-xacml-policy-in.html

6) You can use the TryIt tool in Identity Server as the PEP to test the XACML policy

:http://umeshagunasinghe.blogspot.com/2013/10/how-to-use-try-it-tool-in-wso2-is.html

7) You need to expose the entitlement service of the IS and then send request via SoapUI (you can also configure WSO2 ESB to further enhance the use case ) 

http://umeshagunasinghe.blogspot.com/2013/10/how-to-expose-entitlement-service-in.html

Fine grained xacml authorization with pip points from Umesha Gunasinghe

Thank You!

How to expose the entitlement service in WSO2 Identity Server and send requests via SoapUI

Hi All,

First lets talk about how to expose the entitlement service in the Identity Server.

1) Go to <IS HOME>\wso2is-4.5.0\repository\conf and open the carbon.xml.

2) Change <HideAdminServiceWSDLs> to false as follows.

3) Start the Identity Server.

4) Copy and paste the following url on the browser address bar.

https://localhost:9444/services/EntitlementService?wsdl

If you have saved the settings correctly , you should be able to view the entitlement server wsdl.

5) Save the wsdl file.

Now lets see how to use the wsdl and SoapUI to send requests.

1) Open SoapUI.

2) Go to File in top menu bar and select New SoapUI Project.

3) Give a project and browse for the wsdl file.

4) Then click OK and the simple requests for all operations will be created automatically.

5) Then Select getDecisionByAttributes request as follows.

6) Then fill in the parameter details as follows for our xacml policy we have written.

7) Then you have to authorize the request by entering authorization values as admin , admin for username and password respectively.

Now you can send the request and check for the decisions. The Permit is received as the decision only when the user id 124 trying to READ.

In the next post we will look at a use case scenario where fine grained authorization achieved via xacml engine in WSO2 IS 4.5.0 with PIP points.

Thank you!

How to use the TryIt tool in WSO2 IS

Lets try out the xacml policy we have written using WSO2 IS TryIt tool.

Login to IS and go to PEP > TryIt

Lets look at the picture above and understand the input values for xacml request.

Here we are using the TryIt tool as the Policy Enforcement Point in XACML engine.

We are trying to send the request and enforce the policy and get the policy decision from PEP.

Lets fill out the input values as follows in the tool :-

1) Resource - the service name you have given in the policy

2) Subject Name :- the user trying to access . Here, we are sending the user id of the user, where the policy send the request to PIP to get the user informaiton

3) Action - We are mentioning the action of the user in this case is READ

4) Environment Name - since we haven't mentioned any in the policy , we do not have to input it here

Now lets look at the Request created by the TryIt tool. Click on the Create Request button.

 The request is created with the values we have filled out.

Now lets Evaluate with PDP to get the decision. Click on Evaluate with PDP button.

You can see the decision is Permit.

You can go back and try to evaluate with different input values and see the decision of the PDP.

The policy only permits when user id 124 trying to READ.

Thank you and see you all soon :)

How to write a simple XACML policy in WSO2 IS

We meet again :)

Lets talk about how to write a simple xacml policy in WSO2 IS.

First lets recall our scenario.

Please refer the following links on understanding the scenario.

1) http://umeshagunasinghe.blogspot.com/2013/09/how-to-create-jax-rs-service-using-wso2.html

2) http://umeshagunasinghe.blogspot.com/2013/09/how-to-deploy-jax-rs-service-in-wso2.html

3) http://umeshagunasinghe.blogspot.com/2013/10/how-to-write-pip-point-for-wso2-is.html

4) http://umeshagunasinghe.blogspot.com/2013/10/how-to-register-pip-in-wso2-is.html

We wrote our jax-rs service with users initialized.

Lets say we had 'john' user with user id 124 and another user with user id 125.

Now we have a requirement that we need to permit john to read something.
But nobody else should be able to read it.

So how can we handle this authorization situation?? 

It is really simple to write xacml policies with new user interface provided by WSO2 IS 4.5.0.

Login to IS and go to 

Now lets fill in the necessary information.

1) First give the xacml policy a name

2) Then you can fill in a description

3) Then select on what this policy is based on. For our scenario this based on the resource we have which is the web service that is deployed on the Application Server. Therefore we can select Resource.

4) Then give the resource name
Note that the input values may change on what the policy is based on

5) Now lets focus on the bottom part. We do not intend to give child resource.
Our user is john
The action is READ
you can give an environment even.

Now we have filled the information we need to implement the policy.

You  can follow the following links to get in depth understanding of writing xacml policies in WSO2 IS.

1) http://xacmlinfo.org/2013/09/02/how-write-xacml-policies-1/

2) http://xacmlinfo.org/2013/09/03/how-to-write-xacml-policies-part-2/

3) http://xacmlinfo.org/2013/09/05/how-to-write-xacml-policies-part-3-basic-policy-editor/

After filling the information regarding the xacml policy click on finish button.

Now lets think about what is the purpose of we registered the PIP. The reason because we needed to get user information needed for authorization.
What user information we were trying to access form the web service? It was the username that is given to the user id.

So what we have actually done? We have written a xacml policy to permit READ access to john.

Now, we need to mention in the policy that "Look, you have to give permit 'john' to give READ rights to certain information, but only the user id of john is provided. So you have to verify the user id with the username before giving any permission. You have to look for a PIP to get this information."

But actually we haven't mention in the policy how to get this information.

Lets go do that. Go to 

Home

> Entitlement

> PAP

> Policy Administration

> Policy

Open the policy you have created and you can see the generated policy in editable format.

You can see the information we have given. Check out the user information section. There you have to mention where to get the user information to permit access to john. There you have to mention the attribute Id you have given when you wrote the PIP. In this case it is 'USERNAME'.

Now the policy knows everything :). Go to Policy Administration and Click on Publish to My PDP to publish the policy.

Then click on Publish.

Then go to Policy View and Enable the policy.

Now the policy is all ready. In the next post lets talk about the Try It tool to checkout the policy.

See y'all!