I need that when a user log in wso2 is my account portal, by default, the second authentication factor based on OTP is enabled.
I have tried to modify it in the management console but it is not allowed. How can I modify the default configuration of myaccount in WSO2 IS 5.11?
Cheers
By default, Myaccount and Console are read-only system apps. Remove Myaccount from read-only system apps by adding the following to the deployment.toml at <wso2is-home>/repository/conf/deployment.toml location. (This config makes that only console is read-only)
[system_applications]
read_only_apps = ["Console"]
If you want to remove Myaccount and Console apps both out of the readonly apps, use the following.
[system_applications]
read_only_apps = []
Then restart the server. You will be able to do configuration changes now.
Refer: https://is.docs.wso2.com/en/5.11.0/setup/migrating-what-has-changed/#configurable-system-apps
Related
We're integrating our asp.net MVC client with WSO2's Identity Server v5.8.0.
Below are the steps we've followed:
1) Created a Service provider for our MVC application & configured Inbound authentication with OAuth/OpenID configuration, also configured Inbound provisioning with primary user store.
2) In our MVC application, we've set up a WSO2 configuration using OWIN's WSO2 NuGet package with the generated client-id & client-secret from the service provider.
3) We've configured MongoDB as our primary user store.
Now we're trying to add a user using SCIM2 API (https://localhost:9443/scim2/Users). Below is the response we're getting:
{"schemas":["urn:ietf:params:scim:api:messages:2.0:Error"],"detail":"Cannot add user through scim to user store . SCIM is not enabled for user store WSO2.COM","status":"500"}
I've even changed below config in user-mgt.xml
<Property name="SCIMEnabled">true</Property>
What else do we need to configure? Is there any other way to add user in WSO2 Identity server apart from using SCIM APIs?
It seems like you are having two user stores the primary user store and a secondary user store named wso2.com. By adding the
<Property name="SCIMEnabled">true</Property>
To the user-mgt.xml you are enabling SCIM2 to the primary user store. Not the secondary user store. But from the API you are adding the user to the secondary user store. Since you havent enabled SCIM in the secondary user store you are getting this error. You have two options.
1) Add the user to PRIMARY user store
By analyzing the error that you are getting the user name of the user that you are trying to add should be some thing like
WSO2.COM/Abhishek
Change this to
Abhishek
2) Enable SCIM2 in the secondary user store
Log in to the management console and click list in User Stores sub menu under identity menu.
The User Store Management page opens. There should be a user store named WSO2.COM
Click on edit. Click on advanced tick the enable scim
Reference: https://docs.wso2.com/display/IS580/Using+the+SCIM+2.0+REST+APIs
We recently migrated (registry and user store) from WSO2 IS 5.0 to WSO2 IS 5.1 as per instructions at WSO2 migration guide. After migrating and successfully bringing up the WSO2 IS server, when we are trying to authenticate existing user with /oauth2/token endpoint the authentication is failing. We can see user along with user attributes in user store.
On WSO2 server we are seeing error -
{org.wso2.carbon.identity.oauth2.token.handlers.grant.PasswordGrantHandler} - Token request with Password Grant Type received. Username : <username>#carbon.superScope : openid, Authentication State : false
This is migrated user so we can not change the user name. I tried googling to disable the multi tenancy with 5.1 as we do not use that feature, but no luck.
This is blocking us from moving to newer version of WSO2.
Has Any one fixed this?
Modified the SP to disable domain name as per instructions from Gusto2 -
enter image description here
But still same results.
on the duo identity provider configuration page, under federated authenticators, put "true" in the "disable tenant domain" box
This solution may help. You can go to your identity server and navigate to the service. Now click on edit button of your target service and go to Local & Outbound Authentication Configuration section and uncheck following options-
Use tenant domain in local subject identifier
Use user store domain in local subject identifier
I am showing in the image. Follow the red mark box -
I was wondering if there is an option for users who want to use the store but have forgotten their password
Currently the WSO2 sign-in page looks like this:
I have set the following in < APIM_HOME >/repository/conf/identity/identity-mgt.properties:
Identity.Listener.Enable=true
Notification.Sending.Enable=true
Notification.Expire.Time=3
Notification.Sending.Internally.Managed=true
UserAccount.Recovery.Enable=true
Captcha.Verification.Internally.Managed=true
I'm assuming the email settings for the same are in < APIM_HOME >/repository/conf/email/email-admin-config.xml
Anyhow, after applying the above settings and restarting the server, the sign-in page remained the same.
Is there some configuration to enable an option on the sign-in page (eg. Forgot password/Reset password)?
Also, are there any additional settings that need to be configured for it to work as expected?
API Manager Store/Publisher UIs do not support this out-of-the-box. But you can achieve this with WSO2 Identity server. (You can use the same identity server, as key manager node of the APIM setup)
Please refer to IS docs. A sample webapp also available here.
I'm trying to create a self-signup client application which is using WSO2 API Manager and Identity Server.
When I tried to call a web service provided by Identity Server, I've observed that some of the java classes are trying to get a tenant admin credential from a registry file called self-signup.xml.
Due to this I am forced to change the tenant's admin credential manually in self-signup.xml whenever I change the admin's credential through carbon UI.
My questions are:
Is there any specific reason that WSO2 Identity Sever gets a tenant admin credential from that registry file rather than retrieving it from a database?
Is there any way to automatically update the tenant admin's credential written on that registry file when the credential is updated in the database (e.g. changed through carbon UI)
Thanks in advance.
What is the web service you are using for self sign up here?
If you are using UserRegistrationAdminService you should not require any admin credential for self sign up.
You should not require to read admin credentials from a file in your client. Usually if you want to call a web service which require authentication from your client, you need an user logged in to your client and you need to use the cookie retrieved by that user.
I would like to disable the default wso2 identity server functionality that allows new users to sign themselves up (wso2is user guide description).
Instead, I would only like the administrator to be able to create new users. Is this possible? How do I configure this?
It is possible to disable users from registering themselves on the WSO2 identity server.
The steps to follow for disabling users from self registering can be found here