I have using wso2 IS with another configured identity provider like: google,yahoo.
when i logged form IDP and redirect back to callback URL my application
call /outh2/token API to fetch id_token base on authorization_code but the problem is not getting remote claim (IDP custom claim attribute) which i have configured in service provider mapping.I have facing this issues randomly not for all user.
Success claims Log:TID: [-1234] [] [2018-04-24 07:25:03,300] DEBUG {org.wso2.carbon.identity.application.authentication.framework.handler.claims.impl.DefaultClaimHandler} - Returning claims from claim handler = [middle_name:M,given_name:abc,family_name:xyz,email:abc.xyz#domain.com,]
Failure claims Log: 07:32:19,062] DEBUG {org.wso2.carbon.identity.application.authentication.framework.handler.claims.impl.DefaultClaimHandler} - Returning claims from claim handler = []
Seems like you are facing the issue mentioned in [1]. This issue is fixed in master branch and also the fix is available as wum update for IS-5.4.0 and IS-5.5.0. You can either try the latest milestone of WSO2 Identity Server or get a wum updated pack of IS 5.4.0 or IS 5.5.0.
[1] https://github.com/wso2/carbon-identity-framework/issues/1494
Related
I'm unable login into Wso2 APIM and showing invalid login details but yesterday it was working fine and able to login.
Apim version: 3.2.0.
Identity server wso2 is-km: 5.10.0
I have not changed any of the configuration.
My Wso2 APIM is integrated with wso2 Is.
Below error:
2022-03-07 13:58:07,464] INFO - TimeoutHandler This engine will expire all callbacks after GLOBAL_TIMEOUT: 120 seconds, irrespective of the timeout action, after the specified or optional timeout
[2022-03-07 13:58:07,749] ERROR - OAuth2Service Error while finding application state for application with client_id: oYDtSc**************
After that tried logging into Wso2 Identify server with admin as usually but not data it showing like list of users and list of identity providers but previously I saw list of providers etc.
Please help me in this situation.
Our ws02 metadata that is available via the url (https://ourserver:9443/identity/metadata/saml2) has a "validUntil" date on it that is only a few hours long. This causes some issues with Service providers that only refresh the metadata url periodically. Is there a way to change the validUntil time on the metadata in the url so it can be longer?
WSO2 Identity Server 5.3.0
WSO2 IS 5.3.0 does not support configuring SAML metadata validity time out of the box. But this feature has been added through a WUM update. You can find the public PRs for this feature in [1] and [2]. If you don't have WUM you can get the this fix by building the product from the public branch[3].
[1] https://github.com/wso2/carbon-identity-framework/pull/1980
[2] https://github.com/wso2-extensions/identity-metadata-saml2/pull/29
[3] https://github.com/wso2/product-is
Having WSO2 API Manager 2.1.0 and WSO2 IS 5.3.0 KM (with prepackaged Key Manager) I set up the Key Manager as described in the documentation.
The main intention is authenticate and authorize users with other federated IdPs and add some authorization capabilities. My assumption is that users auhorized with WSO2IS will receive an OAuth token valid for the defined APP and API.
So far all on localhost with IS offset 1. I created an API, an application and that is usable from the API Store.
When trying to authorize a client through WSO2 IS using the code grant_type authorization:
https://localhost:9444/oauth2/authorize?response_type=code&client_id=KJTbkbFmcDvslo2fjhzfQkaBH3Ea&redirect_uri=http%3A//localhost%3A8080/test2/callback
I am asked for credentials and authorization grant (looks ok) and then I receive an exception on IS:
[2018-03-27 10:43:51,822] ERROR {org.apache.catalina.core.StandardWrapperValve} - Servlet.service() for servlet [OAuth2Endpoints] in context with path [/oauth2] threw exception
java.lang.RuntimeException: org.apache.cxf.interceptor.Fault
at org.apache.cxf.interceptor.AbstractFaultChainInitiatorObserver.onMessage(AbstractFaultChainInitiatorObserver.java:116)
...
Caused by: java.lang.NullPointerException
at org.wso2.carbon.identity.oauth.endpoint.authz.OAuth2AuthzEndpoint.authorize(OAuth2AuthzEndpoint.java:251)
at org.wso2.carbon.identity.oauth.endpoint.authz.OAuth2AuthzEndpoint.sendRequestToFramework(OAuth2AuthzEndpoint.java:1163)
at org.wso2.carbon.identity.oauth.endpoint.authz.OAuth2AuthzEndpoint.authorize(OAuth2AuthzEndpoint.java:135)
at org.wso2.carbon.identity.oauth.endpoint.authz.OAuth2AuthzEndpoint.authorizePost(OAuth2AuthzEndpoint.java:574)
What I assume I misconfigured some endpoint, however - any idea which service is invoked by the OAuth2AuthzEndpoint implementation or potential cause for this exception?
This is already reported in https://wso2.org/jira/browse/IDENTITY-5581.
You can WUM update the WSO2 IS 5.3.0 to resolve the issue.
I've been trying to configure WSO2is to accept a SAML auth request from Spring Security and pass it along to an external IDP for authentication. I've configured the SP and IDP on WSO2 correctly enough to have my request be redirected to SSOCircle, but when Circle sends the SAML response back to WSO2 it gives a "Not a valid SAML 2.0 Request Message!" error page. Which this makes sense as it's not a request being sent to the server.
I think my problem revolves around the AssertionConsumerService in the metadata I've uploaded to Circle "https://MyLocalHost:8080/samlsso" which is the url for the Resident Identity Provider. I've been hunting around different end point to use for, but have not been find anything.
The closest I've been able to get was following the example here https://docs.wso2.com/display/IS500/Configuring+Single+Sign-On+with+SAML+2.0 but this appears to be used for just logging into the WSO2 server itself.
EDIT after changing the endpoint to commonauth
Here are the logs after the request lands on the server.
DEBUG {org.wso2.carbon.identity.application.authentication.framework.handler.step.impl.DefaultStepHandler} - SAMLSSOAuthenticator returned: INCOMPLETE {org.wso2.carbon.identity.application.authentication.framework.handler.step.impl.DefaultStepHandler}
DEBUG {org.wso2.carbon.identity.application.authentication.framework.handler.step.impl.DefaultStepHandler} - SAMLSSOAuthenticator is redirecting {org.wso2.carbon.identity.application.authentication.framework.handler.step.impl.DefaultStepHandler}
DEBUG {org.wso2.carbon.identity.application.authentication.framework.handler.sequence.impl.DefaultStepBasedSequenceHandler} - Step is not complete yet. Redirecting to outside. {org.wso2.carbon.identity.application.authentication.framework.handler.sequence.impl.DefaultStepBasedSequenceHandler}
DEBUG {org.wso2.carbon.identity.application.authentication.framework.handler.request.impl.DefaultRequestCoordinator} - Session data key is null in the request {org.wso2.carbon.identity.application.authentication.framework.handler.request.impl.DefaultRequestCoordinator}
ERROR {org.wso2.carbon.identity.application.authentication.framework.handler.request.impl.DefaultRequestCoordinator} - Context does not exist. Probably due to invalidated cache {org.wso2.carbon.identity.application.authentication.framework.handler.request.impl.DefaultRequestCoordinator}
I have configured the sample travelocity.com webapp to work with saml2 SSO following link configure SSO web app
But when i try to login using account i get following error message on browser
Here is what i get in logs:
TID: [0] [IS] [2015-03-10 21:06:26,835] WARN {org.wso2.carbon.identity.sso.saml.processors.SPInitSSOAuthnRequestProcessor} - Signature validation for Authentication Request failed. {org.wso2.carbon.identity.sso.saml.processors.SPInitSSOAuthnRequestProcessor}
After again i tried without restart of server i got this error:
TID: [0] [IS] [2015-03-10 20:30:51,261] ERROR {org.wso2.carbon.identity.application.authentication.framework.handler.request.impl.DefaultRequestCoordinator} - Context does not exist. Probably due to invalidated cache {org.wso2.carbon.identity.application.authentication.framework.handler.request.impl.DefaultRequestCoordinator}
I am not sure what is wrong. I have also installed latest service pack . I am using wso2is-5.0.0
Please help.
This same web application is working fine with WSO2IS. I have already tried out it..Details can be found from here as well
According to the error, it says Signature validation for Authentication Request failed it means that SAML2 Auth request that is sent by Web application has been signed and WSO2IS tries to validate the signature of it. WSO2IS does not validate the signature by default, you may have probably tick on following configuration in the SAML2 SSO configuration.
Enable Signature Validation in Authentication Requests and Logout Requests
Please verify it and un-tick it and see.
If you want to really validate the signature of SAML2 Auth requests, you need to tick it. Then you must chose the proper Certificate Alias value from the combo box. Please note proper value is NOT the wso2carbon.cert. Proper value is wso2carbon. Then it would work for you.
Second error may be related to browser cache, just clear the browser cache and try out.. (or open new browser)
Most probably this is a mismatch in the keystores.
Just copy
$WSO2IS/repository/resources/security/keystore.jks
To
$TOMCAT/saml2-web-app-pickup-dispatch.com/WEB-INF/classes
This way, both keystores are the same. Restart Tomcat and it should work fine.