WSO2is use another WSO2is as identity provider

0
votes

I have 2 WSO2is version 5.0.0.

I would like WSO2is A use WSO2is B as identity Provider in an architecture like described here:

https://docs.wso2.com/display/IS500/Adding+a+Service+Provider+and+Identity+Provider+Using+Configuration+Files

I configured the WSO2is B (192.168.3.40) with a new service provider (that will be WSO2is A) using interface: Add Service Provider, Inbound Authentication Configuration, OAuth/OpenID Connect Configuration. In this section how have I to configure the callback URL? I try this: https://192.168.3.41:9443/oauth2/token/

I configured WSO2is A (192.168.3.41) with a new identity provider using interface: Add Identity provider, Federated Authenticators, OAuth2/OpenID Connect Configuration.

I have my application that have to login on WSO2is A via openid connect. I configured a Service provider for the application on WSO2is A and on WSO2is B.

Well when I try to login with my application using WSO2is A with a user defined on the user store of WSO2is A I logged in.

If I try to login with my application using WSO2is A with a user defined on the user store of WSO2is B I can't log in.

I would like to use the WSO2is B as Federated authenticator, and I would like to login with my application using WSO2is A with a user defined on the user store of WSO2is B.

Can I do this? How have I to configure my WSO2is A and B?

1
authenticationwso2wso2is
Hi Luke, Can you please explain your exact requirement. Its not clear some places. Are you trying to [1] register a 3rd part SP in a WSO2 IS node and use another WSO2 IS node as IDP or [2] Are you trying to use 1 WSO2 IS as SP and other WSO2 IS as IDP? Please clarify. Based on that can advice the exact steps. – Ushani
Of course you can use two Identity Servers. But, why? If you want to separate out data or just for to try out the federated authentication, I suggest you to use tenancy. In the same Server, you can create a new tenant. Each tenant's data is independent from others, you can also federate from one tenant to the other. – Nipun Thathsara

1 Answers

0
votes

indeed you can do that, your intuition and approach is good. Did you configure your application (SP) the Local authenticator to use the WSO2IS B as a federated IdP? (service provider / Local & Outbound Authentication Configuration)

g.