Configuring JIT (Just In Time) provisioning with WSO2 Identity Server (v. 5.0.0)

Recent WSO2IS 5.0.0 release compromised authenticating users through many federated authenticators such as Google, Facebook, Yahoo, Windows live, etc. Here I'm going to explain how to configure Google authenticator to enable the users who has Google accounts to get authenticated to access their web applications via WSO2IS. Meanwhile I will explain how to configure JIT provisioning which allows to create user accounts automatically for the sign-on users in the Identity Server.

Prerequisites

 - Download the WSO2IS 5.0.0 from here. 

Step 1

- Since Google authenticator is going to use email as a claim, we need to Enable Email as a UserName attribute which is at {IS_home}/repository/conf/carbon.xml.

<EnableEmailUserName>true</EnableEmailUserName>  

- Start the WSO2IS server ({IS_home}/bin/wso2server.sh)

Step 2

In order to do allow user authenticating using Google authenticator you need to Register Google authenticator as a new IDP following below steps;

- Home > Identity > Identity Providers > Add

-  Fill the Basic information 

- Click on Claim Configuration tab and select “Use Local Claim Dialect" as claim mapping dialect. Also select email address as the User ID claim URI.

 - Then go to Federated Authenticators tab and select “Google Configuration” menu there. Enable the given options as shown in the below image.

- Then you can configure JIT provisioning to automatically create users in the specified User Store Domain as show in the below image.

- I have specified my secondary User Store (created in MySql database) from the domain list as I need to add users in to the secondary User Store.

 
 - Click on Register button.

Step 3

Next you need to register a service provider following the steps given below.

- Home > Identity > Service Providers > Add

- Give a Service provider name and a description then click on “Register” button. i.e. Service provider Name as travelocity.com.

- Then you will redirect to the registered Service Providers editable view.

- Tick on the Saas Application (Software as a Service) option given in the Basic information section and select the “Inbound Authentication Configuration” there. (So you can use the travelocity.com service provider from tenant domains as well.)

- Among the given options, select “SAML2 Web SSO Configuration” option and click on given “Configure” link.

- Then you will redirect to SSO configuration view.

- Fill the given fields accordingly.

  

Issuer - travelocity.com

Assertion Consumer URL - http://localhost:8080/travelocity.com/home.jsp

Tick on following options too;

- Use fully qualified username in the NameID

- Enable Response Signing

- Enable Assertion Signing

- Enable Single Logout

- Then click on “Local & Outbound Authentication Configuration” tab and select “Federated Authentication” as the Authentication type. Select the created IDP from the available drop down menu.

 

And then click on “Register” button.

Step 4

- Placed the travelocity.com.war file inside the webapp folder of the tomcat server and start the tomcat server (version 7. +). (Get the travelocity sample svn checkout from here.)

- Access the travelocity.com webapp using following link.

http://localhost:8080/travelocity.com/index.jsp

- Since we have configured our service provider for a SAML request, select the SAML option as shown in the given image.

- Then it will redirect you to Google sign in page as shown below.

 
















- Once you have entered valid Google credentials you will get authorized and get permitted to access the requested travelocity webapp. 

Step 5

- Once you have logged in to the travelocity web app, you can go back to your Identity server management console and follow the below link.

Home -> Configure -> Users and Roles -> Users

- then verify whether the Google sign-on user account has created in the selected User Store in the Identity server.

How do I increase the open files limit for a non-root user

Recently, I have tried to increase the number of open files allowed for a user, as for carrying out a load test for a Java application server where the current limit of 1024 is not enough.

As the beginning you have to change the SOFT limit and the HARD limit, by changing following file as follows;
/etc/security/limits.conf.

* soft nofile 4096
* hard nofile 4096

The first column describes WHO the limit is to apply for. '*' is a wildcard, meaning all users. To raise the limits for root, you have to explicitly enter 'root' instead of '*'.

You also need to edit /etc/pam.d/common-session* and add the following line to the end:

session required pam_limits.so

This will help you to get rid of "Too many Open File" exception!.

Configuring WSO2 API Manager 1.5.0 with WSO2BAM to support for Load Balanced data publishing

Here I'm going to explain about how to configure WSO2BAM (Download here)to collect, analyze and display the statistics from WSO2 API Manager. (Download here)

Configuring WSO2 API Manager

Step 1: Configure the <APIUsageTracking> in the <APIM_home>/repository/ conf/api-manager.xml as follows;

<APIUsageTracking>

<!-- Enable/Disable the API usage tracker. -->

<Enabled>true</Enabled>

<!-- API Usage Data Publisher. --> <PublisherClass>org.wso2.carbon.apimgt.usage.publisher.APIMgtUsageDataBridgeDataPublisher</PublisherClass>

<!-- Thrift port of the remote BAM server. ->

<ThriftPort>7612</ThriftPort>

<!-- Server URL of the remote BAM/CEP server used to collect statistics. Must

be specified in protocol://hostname:port/ format.

-->

<BAMServerURL>tcp://192.168.1.3:7612,tcp://192.168.1.3:7613</BAMServerURL>

<!-- Administrator username to login to the remote BAM server. -->

<BAMUsername>admin</BAMUsername>

<!-- Administrator password to login to the remote BAM server. -->

<BAMPassword>admin</BAMPassword>

<!-- JNDI name of the data source to be used for getting BAM statistics.This data source should be defined in the master-datasources.xml file in conf/datasources directory. -->

<DataSourceName>jdbc/WSO2AM_STATS_DB</DataSourceName>

</APIUsageTracking>

Make sure to mention both of BAM server URL's in <BAMServerURL> separated by a (,). Also give JNDI name of the data source to be used for getting BAM statistics in later part of the config <DataSourceName> as mention above.

Step 2: Configure the data source definition in master-datasources.xml. Here I have point the db to a MySql database.

<datasource>

<name>WSO2AM_STATS_DB</name>

<description>The datasource used for getting statistics to API Manager</description>

<jndiConfig>

<name>jdbc/WSO2AM_STATS_DB</name>

</jndiConfig>

<definition type="RDBMS">

<configuration>

<url>jdbc:mysql://localhost:3306/BAMDB</url>

<username>root</username>

<password>root</password>

<driverClassName>com.mysql.jdbc.Driver</driverClassName>

<maxActive>50</maxActive>

<maxWait>60000</maxWait>

<testOnBorrow>true</testOnBorrow>

<validationQuery>SELECT 1</validationQuery>

<validationInterval>30000</validationInterval>

</configuration>

</definition>

</datasource>

Configuring WSO2BAM

Step 1: If you’re running a multiple WSO2 products in same host, change the port offset of BAM, carbon.xml in <BAM_home>/repository/conf/carbon.xml

<!-- Ports offset. This entry will set the value of the ports defined below to the define value + Offset. e.g. Offset=2 and HTTPS port=9443 will set the effective HTTPS port to 9445 -->

<Offset>1</Offset>

Step 2: Copy the file <APIM_HOME>/statistics/API_Manager_Analytics.tbox to directory, <BAM_HOME>/repository/deployment/server/bam-toolbox. If you use Oracle DB to store statistical data, copyAPI_Manager_Analytics_Oracle.tbox instead.

Step 3: Configure the data source definition in master-datasources.xml.

<datasource>

<name>WSO2AM_STATS_DB</name>

<description>The datasource used for getting statistics to API Manager </description>

<jndiConfig>

<name>jdbc/WSO2AM_STATS_DB</name>

</jndiConfig>

<definition type="RDBMS">

<configuration>

<url>jdbc:mysql://localhost:3306/BAMDB</url>

<username>root</username>

<password>root</password>

<driverClassName>com.mysql.jdbc.Driver</driverClassName>

<maxActive>50</maxActive>

<maxWait>60000</maxWait>

<testOnBorrow>true</testOnBorrow>

<validationQuery>SELECT 1</validationQuery>

<validationInterval>30000</validationInterval>

</configuration>

</definition>

</datasource>

If you have change the default BAM port as mentioned in the step 1, you must have to change the Cassandra port accordingly in the JDBC connection url as well.

<datasource>

<name>WSO2BAM_CASSANDRA_DATASOURCE</name>

<description>The datasource used for Cassandra data</description>

<definition type="RDBMS">

<configuration>

<url>jdbc:cassandra://localhost:9161/EVENT_KS</url>

<username>admin</username>

<password>admin</password>

</configuration>

</definition>

</datasource>

For load balanced data publishing, follow the same steps mention in the Configuring WSO2BAM section and specify the correct URL in the <BAMServerURL> section in the <APIM_home>/repository/conf/api-manager.xml.

Restart WSO2BAM server by running <BAM_HOME>/bin/wso2server.[sh/bat].

And then the APIM server by running <APIM_home>/bin/wso2server.[sh/bat].

Fail Over testing

Once the APIM busy, serving requests, check the statistics mentioned in the APIM publisher. Then stop one BAM server instance and once the JVM stops, check whether the statistics still updating fine in the publisher. Since the APIM set up is configured to serve load balanced data publishing, statistics should be update correctly even from one BAM node. (refer this article to setup a BAM cluster setup.)