Pushpalanka's Blog

This is the third of a series of posts on extension points available in WSO2 Identity Server, with relevance to separate protocols. Previous posts can be found at, WSO2 Identity Server - Extension Points - Part 1 - SAML WSO2 Identity Server - Extension Points - Part 2 - OAuth With the XACML architecture there are 4 main separate components as, PIP (Policy Information Point) - serves information required for policy evaluation. PAP (Policy Administration Point) - serves capabilities to govern the policies. PDP (Policy Decision Point) - make decision on incoming requests whether to permit or deny based on the defined policies and information collected from PIP. PEP (Policy Enforcement Point) - the interception point which checks and honors the policy decision. WSO2 Identity Server can act as all these 4 components. In this post we will check on the extendability of these components and their usages. Policy Information Point(PIP) modules Usage: When t...

OAuth2 is widely used in the enterprise today for authorization aspects of APIs. This is the second post on the extension points available in WSO2 Identity Server after WSO2 Identity Server - Extension Points - Part 1 - SAML All the implementation using following extension point needs to be configured at <IS_HOME>/repository/conf/identity/identity.xml file under the element OAuth. 1. Custom OAuth grant handler Usage: When we need to support an OAuth flow that is different from standard grant types. Validates the grant, scopes, and access delegation. Sample: https://docs.wso2.com/display/IS510/Writing+a+Custom+OAuth+2.0+Grant+Type Interface: org.wso2.carbon.identity.oauth2.token.handlers.grant.AuthorizationGrantHandler 2. Client Auth Handler Usage: When the client credential authentication needs to be customized. By default we validate the client id and secret. Interface: org.wso2.carbon.identity.oauth2.token.handlers.clientauth.ClientAuthenticationHan...

This is the first post of a series of post to come, to serve as a catalog of extension points available within WSO2 Identity Server as of IS 5.1.0 version which is to be released soon. Most of them are available in 5.0.0 version as well. We have quite a lot of flexibility provided for the users to shape Identity Server to serve exactly what they require via these extension points. There are 2 types of extensions available in WSO2 Identity Server as of now. Most of these require a restart of the server in order to be effective, but can be configured dynamically without a restart of the server. Few of the extensions like UI theming can be made without a server restart. Drop the extension developed as an OSGI bundle, followed by a server restart,  configure it dynamically eg: custom user store managers Drop the extension developed as a Java component, configure in a configuration file, then restart the server. Configure it dynamically via the UI. eg: custom a...

With this post I am to share the steps of a popular solution using WSO2 Identity Server and WSO2 API Manager. Following diagram will give an initial insight on this solution. Overview 1.  Webapp that requires single sign on(SSO) facility with some other applications.                  - To achieve this we are using WSO2 Identity Server(IS) as the Identity Provider(IDP).  2.  Webapp needs to consume some APIs secured with OAuth tokens.                  - To expose the APIs secured with OAuth tokens we are using WSO2 API Manager(AM) here.                 - Since we already have the SAML Response received at SSO step, SAML2 Bearer grant type is ideal to use at this scenario to request an OAuth token to access the required APIs.                 - Allowing AM to properly issue an OAuth...

This is the 3rd post I am writing to explain the use of extension points in WSO2 Identity Server. WSO2 Identity Server has so many such extension points which are easily configurable and arm the server with lot of flexibility. With this, we can support so many domain specific requirements with minimum efforts. Firstly I have shared the usage and steps of writing a custom user store manager .  Secondly a custom claim handler which is also related with SAML SSO Response.  Now this third post deals with writing a custom SAML SSO Assertion signer. What we can customize? Credentials used to sign the SAML Assertion (The private key) Signing Algorithm This sample can be extended to customize how we sign the SAML Response and validate the signature as well. How? We have to write a class extending  The class 'org.wso2.carbon.identity.sso.saml.builders.signature.DefaultSSOSigner' or Implementing, The interface 'org.wso2.carbon.identity...