Enable Login for a WS-Federation Web Application¶

This page guides you through enabling login for a WS-Federation-based web application.

Prerequisites¶

• Download Apache Tomcat 8.x and install it. Tomcat server installation location will later be referred to as <TOMCAT_HOME> in this guide.

• It is recommended that you use a hostname that is not localhost to avoid browser errors. Modify your machine's /etc/hosts entry to reflect this.

  Info

  Note that wso2is.local is used in this documentation as an example, but you must modify this when configuring the authenticators or connectors with this sample application.

• Download the PassiveSTSSample application from the latest release assets.

Deploy the sample app¶

To deploy the sample web app on a web container:

1. Copy the application's downloaded .war file into the webapps directory of the Tomcat folder.

2. Start the Tomcat server.

Configure sample properties¶

To configure additional properties for the sample application:

1. Add the following configurations to the web.xml file in <TOMCAT_HOME>/apache-tomcat-<version>/webapps/PassiveSTSSampleApp/WEB-INF.

   • Specify idpUrl as the Identity Server's Passive STS URL.

     <init-param>
             <param-name>idpUrl</param-name>
             <param-value>https://localhost:9443/passivests</param-value>
     </init-param> 

   • Specify the replyURL as the URL of the web app.

     <init-param>
             <param-name>replyUrl</param-name>
             <param-value>http://localhost:8080/PassiveSTSSampleApp/index.jsp</param-value>
     </init-param>

   • Specify the realm as a unique identifier for the web app.

     <init-param>
             <param-name>realm</param-name>
             <param-value>PassiveSTSSampleApp</param-value>
     </init-param> 

   • Specify the tenantDomain for tenant user logins.

     <init-param>
             <param-name>requestParams</param-name>
             <param-value>tenantDomain=tenant4.com</param-value>
     </init-param>

2. Restart the tomcat server.

Configure the service provider¶

1. On the Management Console, go to Main > Identity > Service Providers and click Add.

2. Enter PassiveSTSSampleApp as the Service Provider Name, and click Register.

3. Expand the Inbound Authentication Configuration > WS-Federation (Passive) Configuration section, and enter the following values in the fields mentioned.

   Field name	Value	Description
   Passive STS Realm	PassiveSTSSampleApp	This should be a unique identifier for the web app. Provide the same realm name given to the web app you are configuring WS-Federation for.
   Assertion Consumer URL	http://localhost:8080/PassiveSTSSampleApp/index.jsp	Provide the URL of the web app you are configuring WS-Federation for. This endpoint URL will handle the token response.

4. Expand Claim Configuration and click Add Claim URI next to Requested Claims, and add the following claims:

   • http://wso2.org/claims/username
   • http://wso2.org/claims/emailaddress

5. Select http://wso2.org/claims/emailaddress as the Subject Claim URI.

6. Click Update to save your configurations.

[sts]
signature_algorithm = "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"
digest_algorithm = "http://www.w3.org/2001/04/xmlenc#sha256"

Try it out¶

1. Access one of the following links on your browser and click Login.

   • To get a SAML 1.1 token: http://localhost:8080/PassiveSTSSampleApp/index.jsp
   • To get a SAML 2.0 token: http://localhost:8080/PassiveSTSSampleApp?samlv=2-0

2. Login using your credentials.

3. Provide the required consent. You will be redirected to the MWARE IAM Passive STS Service and then redirected back to the configured replyUrl.

You will see the passive STS response with the requested claims on the screen.