WSO2 Basic Authentication returns error

0
votes

I'm trying to use the authenticationendpoint application that comes with WSO2 as the new only login entry point of an old application. For testing purposes I just did a page that redirects to thi URL

https://localhost:9443/authenticationendpoint/login.do?relyingParty=My-Issuer&sp=Test-App&sessionDataKey=14792551&authenticators=BasicAuthenticator:LOCAL

The login page appears as expected, but once I set the user and password shows this message:

Authentication Error ! Attention: Something went wrong during the authentication process. Please try signing in again.

Seeing the output in the console on debug mode, this is what is shown

... Many of the same error saying that Authentication Context is null [2017-01-06 15:40:08,836] DEBUG {org.wso2.carbon.identity.application.authentication.framework.util.FrameworkUtils} - Authentication Context is null [2017-01-06 15:40:08,836] DEBUG {org.wso2.carbon.identity.application.authentication.framework.util.FrameworkUtils} - Authentication Context is null [2017-01-06 15:40:08,836] DEBUG {org.wso2.carbon.identity.application.authentication.framework.util.FrameworkUtils} - Authentication Context is null [2017-01-06 15:40:08,837] DEBUG {org.wso2.carbon.identity.application.authentication.framework.handler.request.impl.DefaultRequestCoordinator} - Session data key : 22451696 [2017-01-06 15:40:08,837] ERROR {org.wso2.carbon.identity.application.authentication.framework.handler.request.impl.DefaultRequestCoordinator} - Context does not exist. Probably due to invalidated cache

I thing I'm doing something wrong, maybe there are not enough parameters sent, or they are the wrong ones, the user and password are correct because I can login into the carbon itself with it, and it is also a valid user for the testing SP.

The SP config is described:

Basic Information

Service Provider Name: Test-App

Claim configuration

Use Local Claim Dialect Subject Claim URI http://wso2.org/claims/username

Role/Permission Configuration Permissions AdminTest Role Mapping AdminTest->Admin

Inbound Authentication Configuration

  • SAML2 Web SSO Configuration Issuer: My-Issuer

    Assertion Consumer URLs: https : //localhost/Test/main.asp Default Assertion Consumer URL: https : //localhost/Test/main.asp NameID format: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress Certificate alias: wso2carbon Response Signing Algorithm: ...#rsa-sha1 Response Digest Algorithm: ...#sha1

Checked values Enable Response Signing Enable Single Logout Enable Attribute Profile Include Attributes in the Response Always Enable IdP Initiated SSO Enable IdP Initiated SLO

Others are in blank OAuth, OpenID, etc (let me know if that is maybe the problem, so which should be filled out.

Local and Outbound Authentication Configuration

Authentication Type: I tried with Default and Local Authentication = basic and password-reset-enforcer

This is checked:

  • Assert identity using mapped local subject identifier
  • Use tenant domain in local subject identifier

  • Use user store domain in local subject identifier

    Request Path Authentication Configuration basic-auth

Inbound Provisioning Configuration SCIM Configuration PRIMARY Dumb Mode is not enabled

The rest is left blank

I have spent many days tracking this problem but no answers or are for older versions.

I tested with JDK 7 and 8 (latest of them) I'm working with WSO2 IS 5.2.0. Someone can lead me to a solution to use this application as the only entry point for my SPs? The idea after is to send back a SAML2 response to a page in the SP side that read the information and control the authorization part.

Thanks in advance.

1
authenticationwso2is

1 Answers

1
votes

You have configured for a SAML SSO scenario. Therefore your SP have to call the SAML SSO endpoint of WSO2 Identity Server with a valid SAMLRequest. That is https://hostname:port/samlsso.

AuthenticationEndpoint is just an intermediary application. SAML SSO endpoint is the one that should redirect the user to AuthenticationEndpoint after first processing the SAMLRequest. You must not call it directly.

Refer this to learn how to run a sample SAML SSO application with WSO2 IS. While running that, you can monitor the HTTP Request/Response flow using a tool like SSOTracer for Firefox and understand how the communication works.

In similar to SAML SSO flow, if you are using any other authentication protocol, you first have to call the protocol specific endpoint. E.g. If you are using OAuth2 or OpenIDConnect, then you should call /oauth2 endpoint. Never /authenticationendpoint directly.