Identity Related Tables¶

This section lists out all the identity related tables and their attributes in the MWARE IAM database.

IDN_BASE_TABLE

This table is used to provide information related to the server setup. It has only one column, PRODUCT_NAME, which contains a row with the value MWARE IAM.

IDN_OAUTH_CONSUMER_APPS

This table is used when adding OAuth/OpenID Connect configuration as the inbound authentication configuration for a service provider. The following table lists out the columns and the values they contain.

IDN_OAUTH1A_REQUEST_TOKEN

When using OAuth 1.0a, OAuth clients need to send the consumer key, consumer secret, and scope to the OAuth service and obtain a request token. When MWARE IAM returns a request token to such a client, it adds a record to this table. The client will then receive the request token and the OAuth verifier. The client can send these values back to the service and obtain the OAuth access token. Then the record in this table will be deleted and a new row will be added to the IDN_OAUTH1A_ACCESS_TOKEN table. The following table lists out the columns and a description of the values it contains.

IDN_OAUTH1A_ACCESS_TOKEN

When using OAuth 1.0a and receiving an OAuth 1.0a request token, the client application can obtain the access token by authorizing the request token. The following table lists out the columns and a description of the values it contains.

IDN_OAUTH2_AUTHORIZATION_CODE

When a client application is used with OAuth 2 authorization code grant type, after the authentication, MWARE IAM returns the authorization code to the client. When this occurs, a record is added to this table. The client application can then request the OAuth access token using the authorized code. When the access token is returned, the record with that authorization code is deleted from this table.The following table lists out the columns and a description of the values it contains.

IDN_OAUTH2_ACCESS_TOKEN

When an OAuth2 access token is returned to a client, a record will be added to this table. The following table lists out the columns and a description of the values it contains.

IDN_OAUTH2_SCOPE

When MWARE IAM is used with a product such as the WSO2 API Manager, custom OAuth scopes can be defined. The following table lists out the columns and a description of the values it contains.

IDN_OAUTH2_RESOURCE_SCOPE

When MWARE IAM is used with a product such as WSO2 API Manager, the custom scopes defined for the APIs will be stored in the IDN_OAUTH2_SCOPE table. These scopes can be mapped with the resources in the API and these resources and scopes mapping are stored in this table. The following table lists out the columns and a description of the values it contains.

IDN_SCIM_GROUP

When creating a new role in the userstore, the SCIM attributes for the created role are stored in this table.  For each role that is created, there are multiple rows stored since multiple SCIM attributes are associated with a role (GROUP). The following table lists out the columns and a description of the values it contains.

IDN_SCIM_PROVIDER

This table is not used in the latest version of MWARE IAM.

• CONSUMER_ID
• PROVIDER_ID
• USER_NAME
• USER_PASSWORD
• USER_URL
• GROUP_URL
• BULK_URL

IDN_OPENID_REMEMBER_ME

This table is not used in the latest version of MWARE IAM because the 'Remember Me' feature is handled from the authentication framework.

• USER_NAME
• TENANT_ID
• COOKIE_VALUE
• CREATED_TIME

IDN_OPENID_USER_RPS

When users log in to OpenID relying party applications where the OpenID authentication is provided by MWARE IAM, the login details are stored in this table. The following table lists out the columns and a description of the values it contains.

IDN_OPENID_ASSOCIATIONS

The OpenID associations are stored in this table. The following table lists out the columns and a description of the values it contains.

IDN_STS_STORE

When MWARE IAM is used as a Security Token Service which issues access tokens, such records are stored in following table. Following are the columns of the table.

• ID
• TOKEN_ID
• TOKEN_CONTENT
• CREATE_DATE
• EXPIRE_DATE
• STATE

IDN_IDENTITY_USER_DATA

When using a JDBC userstore, the user attributes of a user are stored in the UM_USER_ATTRIBUTE table for the supported claims. There are some claims used for Identity Management features that should be handled specifically. Claims used for Identity Management feature will be stored in the userstore which is specified in the <IS_HOME>/repository/conf/security/identity-mgt.properties file. The property, Identity.Mgt.User.Data.Store is used to define what kind of store it uses to store these reserved claims. Upon updating the user profile, these claims and their mapped attribute values will be inserted to this table.

The reserved claims are as follows:

• Any claim that contains the part : http://wso2.org/claims/challengeQuestion for its claim URI

  • http://wso2.org/claims/challengeQuestion1
  • http://wso2.org/claims/challengeQuestion2
  • http://wso2.org/claims/challengeQuestionUris

• Any claim that contains part http://wso2.org/claims/identity for its claim URI

  • http://wso2.org/claims/identity/accountLocked
  • http://wso2.org/claims/identity/failedLoginAttempts
  • http://wso2.org/claims/identity/unlockTime
  • http://wso2.org/claims/identity/passwordTimestamp

The following table lists out the columns and a description of the values it contains.

IDN_IDENTITY_META_DATA

• USER_NAME
• TENANT_ID
• METADATA_TYPE
• METADATA
• VALID

IDN_THRIFT_SESSION

This table is used to store the authenticated thrift session. Once the user is authenticated to the thrift authenticator, it creates a thrift session. This is mainly used in the XACML feature in WSO2 Identity Server. The Entitlement Service of MWARE IAM is exposed via Thrift transport and in order to access this admin service, it must be authenticated. The following table lists out the columns and a description of the values it contains.

IDN_ASSOCIATED_ID

Users can associate their social identity (i.e. Facebook, Yahoo, Google, Microsoft ) with the user account created in MWARE IAM. The following table lists out the columns and a description of the values it contains.

IDN_AUTH_SESSION_STORE

When the remember me option is selected when logging in to either a service provider or MWARE IAM, session data is persisted provided that the session data persistence is enabled from configuration. The following table lists out the columns and a description of the values it contains.