WSO2 Identity Server : Internal SSO with tenants (file-based configs)


WSO2 Identity Server : Internal SSO with tenants (file-based configs)



I am using Puppet to deploy the Identity Server (5.3.0) , and want to use it as the Identity Bus for the Integration layer (IS,AM,EI)



Our testing environment will use a dev (int.dev) and a qa (int.qa) tenant respectively to separate those endpoints for other systems.


testing


int.dev


int.qa



The goal here is to use the IS as the SSO provider for all the WSO2 servers, including the tenanted test environment.



For the carbon.super tenant , SSO works perfectly. However , when setting up a tenant, SSO will not work.


carbon.super



I am testing this on the Identity server , where it will be the identity service provider as well as the relying party.



identity/sso-idp-config.xml


identity/sso-idp-config.xml


<ServiceProvider>
<Issuer>wso2is</Issuer>
<AssertionConsumerServiceURLs>
<AssertionConsumerServiceURL>https://wso2-mgr.ozzycorp.co.za/9453/acs</AssertionConsumerServiceURL>
</AssertionConsumerServiceURLs>
<DefaultAssertionConsumerServiceURL>https://identity.ozzycorp.co.za/acs</DefaultAssertionConsumerServiceURL>
<EnableSingleLogout>true</EnableSingleLogout>
<SLOResponseURL/>
<SLORequestURL/>
<SAMLDefaultSigningAlgorithmURI>http://www.w3.org/2000/09/xmldsig#rsa-sha1</SAMLDefaultSigningAlgorithmURI>
<SAMLDefaultDigestAlgorithmURI>http://www.w3.org/2000/09/xmldsig#sha1</SAMLDefaultDigestAlgorithmURI>
<SignResponse>true</SignResponse>
<ValidateSignatures>true</ValidateSignatures>
<EncryptAssertion>false</EncryptAssertion>
<CertAlias>wso2-mgr.ozzycorp.co.za</CertAlias>
<EnableAttributeProfile>true</EnableAttributeProfile>
<IncludeAttributeByDefault>true</IncludeAttributeByDefault>
<ConsumingServiceIndex/>
<EnableAudienceRestriction>false</EnableAudienceRestriction>
<AudiencesList>
<Audience/>
</AudiencesList>
<EnableRecipients>false</EnableRecipients>
<RecipientList>
<Recipient/>
</RecipientList>
<EnableIdPInitiatedSSO>false</EnableIdPInitiatedSSO>
<EnableIdPInitSLO>false</EnableIdPInitSLO>
<ReturnToURLList>
<ReturnToURL/>
</ReturnToURLList>
</ServiceProvider>



security/authenticators.xml


security/authenticators.xml


<Authenticator name="SAML2SSOAuthenticator" disabled="false">
<Priority>10</Priority>
<Config>
<Parameter name="LoginPage">/carbon/admin/login.jsp</Parameter>
<Parameter name="ServiceProviderID">wso2is</Parameter>
<Parameter name="IdentityProviderSSOServiceURL">https://identity.ozzycorp.co.za/samlsso</Parameter>
<Parameter name="NameIDPolicyFormat">urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</Parameter>
<Parameter name="AssertionConsumerServiceURL">https://identity.ozzycorp.co.za/acs</Parameter>

<!-- <Parameter name="IdPCertAlias">wso2carbon</Parameter> -->
<!-- <Parameter name="ResponseSignatureValidationEnabled">false</Parameter> -->
<!-- <Parameter name="LoginAttributeName"></Parameter> -->
<!-- <Parameter name="RoleClaimAttribute"></Parameter> -->
<!-- <Parameter name="AttributeValueSeparator">,</Parameter> -->

<!-- <Parameter name="JITUserProvisioning">true</Parameter> -->
<!-- <Parameter name="ProvisioningDefaultUserstore">PRIMARY</Parameter> -->
<!-- <Parameter name="ProvisioningDefaultRole">admin</Parameter> -->
<!-- <Parameter name="IsSuperAdminRoleRequired">true</Parameter> -->
</Config>



The IS endpoint https://identity.ozzycorp.co.za is load balanced via HAProxy , https://wso2-mgr.ozzycorp.co.za/9453 is the internal endpoint.


https://identity.ozzycorp.co.za


https://wso2-mgr.ozzycorp.co.za/9453



Attempted SSO login



In the url , I notice this : ...tenantDomain=carbon.super... , which is the incorrect tenant.


...tenantDomain=carbon.super...



Log file excerpt:



TID: [-1234] [2017-08-29 12:24:08,109] ERROR {org.wso2.carbon.identity.authenticator.saml2.sso.SAML2SSOAuthenticator} - Authentication Request is rejected. Signature validation failed.
TID: [-1234] [2017-08-29 12:24:08,110] WARN {org.wso2.carbon.core.services.util.CarbonAuthenticationUtil} - Failed Administrator login attempt 'vozzy[-1234]' at [2017-08-29 12:24:08,110+0200]
TID: [-1234] [2017-08-29 12:24:08,112] ERROR {org.wso2.carbon.identity.authenticator.saml2.sso.ui.authenticator.SAML2SSOUIAuthenticator} - Authentication failed.



HAProxy excerpt:



Aug 29 12:23:00 localhost haproxy[1509]: 192.168.100.1:50741 [29/Aug/2017:12:23:00.082] wso2-https~ is-mgt/wso2-mgr.pepkorit.co.za 0/0/0/4/4 200 2372 - - --IP 1/1/0/1/0 0/0 "GET /authenticationendpoint/login.do?RelayState=a297e09a-80f1-420c-abd5-5d5679963d25&SSOAuthSessionID=197F03A56D003D1569C210D0624AF34E&commonAuthCallerPath=%2Fsamlsso&forceAuth=false&passiveAuth=false&tenantDomain=carbon.super&sessionDataKey=5bf0069a-2b7b-4101-8678-cfb63d80ac9e&relyingParty=wso2is&type=samlsso&sp=wso2is&isSaaSApp=true&authenticators=BasicAuthenticator:LOCAL HTTP/1.1"



The tenant domain of the sso landing page as well as in the sso request is clearly incorrect , -1234 is the carbon.super tenant.


-1234


<UseAuthenticatedUserDomainCrypto>true</UseAuthenticatedUserDomainCrypto>


identity.xml


Use tenant domain in local subject identifier


Use user store domain in local subject identifier


sso-idp-config.xml









By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

-

Popular posts from this blog

How to input without newline? (Python)

How to input without newline? (Python) I am trying to create a simple file editor in Python via the console (called PyCons). Here is my current program: def PyCons(f): file = open(f, "r") appe = open(f, "a") print("n=====nPyCons Editor, v1.2nPython 3.6.1n") global i i = 0 for line in file: i += 1 print(" {}| ".format(i) + line, end='') for k in range(10000000000000): print("n {}| ".format(i+1), end='') inp = input("") if inp == "@PyCons.save()": print("n=====") break else: i += 1 appe.write("n" + inp) I used the end method to make sure that the existing code in the file was printed properly in its line format, but the input function does not have an end attribute. So, when I go to enter code in the editor: end input end PyCons("magic.html") ... ===== PyCons Editor, v1.2 Python 3.6.1 1| <p>Hello!...
Read more

C++ thread error: no type named ‘type’ MINGW

C++ thread error: no type named ‘type’ MINGW I'm currently doing a project for my operational systems class and I have to make a program to find prime numbers to run in threads. So I did this: #include <iostream> #include <cmath> #include <thread> #define THREADNUMBER 100 using namespace std; int CONTADOR = 0; int CONTADORTHREADEXECUTADA = 0; int primeRange(int v1, int v2) { int a, limit; bool isprime; for (int i = v1; i <= v2; i++) { if (i % 2 != 0 && i % 3 != 0) { isprime = true; limit = i / 2; if(i == 1) isprime =false; limit = (int)sqrt(i); //General case for(a=2; a <= limit; a++){ if(i % i == 0 && i != 2){ isprime = false; break; } } if (isprime) { CONTADOR++; } } } CONTADORTHREADEXECUTADA++; return 1; } int main(int argc, char *argv[ ] ) { int number1 = atoi(argv[1]); int num...
Read more

Analog for TagView in flutter

Image
Analog for TagView in flutter I want to have UI like this: With native Android it can be done with libraries like https://github.com/whilu/AndroidTagView, how can it be done with flutter? 2 Answers 2 you can make the same UI by combining the Wrap and Chip widget as @wasyl montioned . but this is a full example about what you need Wrap Chip Notes : spacing deleteIcon avatar Chip Shape new Column( crossAxisAlignment: CrossAxisAlignment.stretch, children: <Widget>[ new Wrap( children: <Widget>[ Chip( label: new Text("Java"), onDeleted: () {}, labelPadding: EdgeInsets.all(2.0), deleteIcon: Icon(Icons.clear), ), Chip( label: new Text("C++"), onDeleted: () {}, labelPadding: EdgeInse...
Read more