Configuring WSO2 Identity Server as Key Manager with API Manager

1
votes

I'm looking for some guidance about two specific WSO2 products, API Manager and Identity Server and for the best solution to solve the problem I'm going to explain below.

In my company, we are using ADFS 3.0 for Single Sign On support in our applications. However we are now building applications that will require OpenID Connect Specification (SPA's+Rest API's) and ADFS does not support this out of the box so we've decided to use WSO2 products for that purpose.

I already managed to install WSO2 Identity Server 5.0.0 SP1 and configured ADFS as a federated Identity Provider (the new applications will still have to authenticate users using ADFS). I also installed WSO2 API Manager 1.9.1 and configured it to use WSO2 Identity Server as the Key Manager (Configuration tutorial).

Now the problem:

Using WSO2 Identity Server 5.0.0 SP1 I couldn't get the Logout feature to work due to the issue reported here. It seems that this issue has been solved in version 5.1.0M4 so I tried to install version 5.1.0-alpha and managed to make the logout to work with ADFS (I tested it by enabling SSO for the carbon administration). However, now I'm not able to install the Key Manager feature through the carbon repositories due to incompatibilities.

As a result, with the first combination (wso2is 5.0.0 SP1/wso2am 1.9.1) I had the logout issue with ADFS and with the second combination (wso2is 5.1.0-alpha/wso2am 1.9.1), I'm not able to install the Key Manager feature in Identity Server.

Is there any way to apply a patch to solve the logout issue in the first combination? Is there a way to install the key manager feature on WSO2IS 5.1.0-alpha? Or can someone point me to another solution to solve this issue?

1
wso2wso2isadfswso2-am

1 Answers

1
votes

The issue you pointed above, marked as it type as "Patch". Usually that means WSO2 have fixed this issue for a earlier version and provided a patch to its customer. Easiest thing would be, if you are already a customer of WSO2 ask for the patch directly from their support.

If you are not a paid customer of WSO2 you are in bit of a trouble. As per this question, the source of the Service Pack also not available in public.

But luckily in your case, the component which need to have this fix not a core component. So you wouldn't be in trouble if you change the authenticator code bit. But the warning is, it would lose any fixes done for org.wso2.carbon.identity.application.authenticator.samlsso_4.2.1.jar in the service pack.

Anyway, these are the steps you should follow.

  1. Checkout the source. Lazy path would be checkout the whole source from here. That is the most easy way which you will face less troubles when you try to build the source but the downside of that is, it would take bit of time to checkout. If you know how to build specific component from WSO2 source, you can directly checkout component it needed to changed.
  2. Try to build the component without doing any change just to make sure there are not any issues upto this point.
  3. Goto the class DefaultSAML2SSOManager and do the same change done in the PR.
  4. Build the component again.
  5. Create folder named like "patch9000" inside the <IS_HOME>/repository/components/patches/ folder.
  6. Copy build jar (org.wso2.carbon.identity.application.authenticator.samlsso-4.2.1.jar ) in step 4 from the target folder to the <IS_HOME>/repository/components/patches/patch9000 folder.
  7. Restart the server. If you have done everything to the point, in the server startup it would print a log like, org.wso2.carbon.server.extensions.PatchInstaller - Patch changes detected

Now retry the your flow and it would work as expected.

If you too lazy to do all above, you can wait until Identity Server Service Pack 2, which will have your fix.