wso2 : Can't log in API publisher and store via tenant admin

Question

Environment : wso2 API-M + wso2 Identity server (Key manager) and they shared the same user store.

1.I set SSO with publisher and store. (done)

2.I integrate Social account to the environment. (done)

3.I create 2 tenants which called TA, TB. (done)

4.TA admin try to log in to publisher and store. (Fail)

Error logs:

TID: [-1234] [] [2016-06-14 15:08:24,615] ERROR {org.wso2.carbon.identity.application.authentication.framework.handler.step.impl.DefaultStepHandler} - Service Provider tenant domain must be equal to user tenant domain for non-SaaS applications 
org.wso2.carbon.identity.application.authentication.framework.exception.AuthenticationFailedException: Service Provider tenant domain must be equal to user tenant domain for non-SaaS applications 
        at org.wso2.carbon.identity.application.authentication.framework.AbstractApplicationAuthenticator.process(AbstractApplicationAuthenticator.java:73) 
        at org.wso2.carbon.identity.application.authenticator.basicauth.BasicAuthenticator.process(BasicAuthenticator.java:78) 
        at org.wso2.carbon.identity.application.authentication.framework.handler.step.impl.DefaultStepHandler.doAuthentication(DefaultStepHandler.java:432) 
        at org.wso2.carbon.identity.application.authentication.framework.handler.step.impl.DefaultStepHandler.handleResponse(DefaultStepHandler.java:406) 
        at org.wso2.carbon.identity.application.authentication.framework.handler.step.impl.DefaultStepHandler.handle(DefaultStepHandler.java:117)
 at org.wso2.carbon.identity.application.authentication.framework.handler.sequence.impl.DefaultStepBasedSequenceHandler.handle(DefaultStepBasedSequenceHandler.java:171) 
        at org.wso2.carbon.identity.application.authentication.framework.handler.request.impl.DefaultAuthenticationRequestHandler.handle(DefaultAuthenticationRequestHandler.java:115) 
        at org.wso2.carbon.identity.application.authentication.framework.handler.request.impl.DefaultRequestCoordinator.handle(DefaultRequestCoordinator.java:135) 
        at org.wso2.carbon.identity.application.authentication.framework.CommonAuthenticationHandler.doPost(CommonAuthenticationHandler.java:46) 
        at org.wso2.carbon.identity.application.authentication.framework.CommonAuthenticationHandler.doGet(CommonAuthenticationHandler.java:37) 
        at org.wso2.carbon.identity.sso.saml.servlet.SAMLSSOProviderServlet.sendRequestToFramework(SAMLSSOProviderServlet.java:974) 
        at org.wso2.carbon.identity.sso.saml.servlet.SAMLSSOProviderServlet.handleRequest(SAMLSSOProviderServlet.java:159) 
        at
org.wso2.carbon.identity.sso.saml.servlet.SAMLSSOProviderServlet.doPost(SAMLSSOProviderServlet.java:107) 
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:646) 
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:727) 
        at org.eclipse.equinox.http.helper.ContextPathServletAdaptor.service(ContextPathServletAdaptor.java:37) 
        at org.eclipse.equinox.http.servlet.internal.ServletRegistration.service(ServletRegistration.java:61) 
        at org.eclipse.equinox.http.servlet.internal.ProxyServlet.processAlias(ProxyServlet.java:128) 
        at org.eclipse.equinox.http.servlet.internal.ProxyServlet.service(ProxyServlet.java:60) 
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:727) 
        at org.wso2.carbon.tomcat.ext.servlet.DelegationServlet.service(DelegationServlet.java:68) 
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303) 
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) 
        at.....

org.wso2.carbon.tomcat.ext.valves.CarbonContextCreatorValve.invoke(CarbonContextCreatorValve.java:57) 
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116) 
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:421) 
        at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1074) 
        at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:611) 
        at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1739) 
        at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1698) 
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) 
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) 
        at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) 
        at java.lang.Thread.run(Thread.java:745)

Questions:

1.About : Service Provider tenant domain must be equal to user tenant domain for non-SaaS applications

How should I change Service Provider tenant domain in the Service provider?

Thanks

Tom

farasath farasath · Accepted Answer · 2016-06-14T17:59:38

Actually, you can't change the service provider's tenant domain. It will be same as the tenant domain of the user who created it.

So say you created a service provider in tenant TA and want to allow tenant admin (or any other user) from TB to use the service provider to do SSO, then you should enable SaaS application option in the service provider. This allows the Service Provider to be used by users who are not from the same tenant domain as the service provider.

As shown above, simply tick the SaaS application in the Service Provider configuration. Then users from TB also can SSO using the Service Provider in TA

wso2 : Can't log in API publisher and store via tenant admin

1 Answers