Tricky way to modify the userName SCIM claim in WSO2 Identity Server ( IS )

SCIM is an open standard for Identity Provisioning. In simple words SCIM is designed to create, maintain (read,update) and deactivate (delete) user accounts and related identities which reside in one or more systems/applications.

In this blog post, I'm going to explain a tricky way to modify the userName claim. Why I said a tricky way is because you will not be able to simply update it via a curl command as userName claim in carbon user stores is immutable. If you have ever tried updating the userName claim, you might have ended up with an error like this.

{"Errors":[{"description":"User name is immutable in carbon user store.","code":"500"}]}

In order to test this, start a WSO2 IS (tested with IS 4.5.0) connected to Active Directory as back-end data store. (You can do it by modifying the user-mgt.xml to connect to a AD instance.)

And then go to Configure --> Claim Management and select urn:scim:schemas:core:1.0

Now we have to map the SCIM claims to the existing attributes of the Active Directory. Because when we add a user via SCIM, apart from the userName SCIM claim there are four other SCIM attributes that is being added behind the scene.
( Make sure that you map String type attributes from the AD with the SCIM claims. You can find the AD attributes here. )

CLAIM URI	AD Attribute
urn:scim:schemas:core:1.0:userName	mail
urn:scim:schemas:core:1.0:meta.location	streetAddress
urn:scim:schemas:core:1.0:meta.created	homePhone
urn:scim:schemas:core:1.0:meta.lastModified	pager
urn:scim:schemas:core:1.0:id	homePostalAddress

Apart from the above mapping add the following mappings as well. (This is for better explanation of this post.)

CLAIM URI	AD Attribute
urn:scim:schemas:core:1.0:name.givenName	givenName
urn:scim:schemas:core:1.0:name.familyName	company

First of all let's Create a user via SCIM. 

curl -v -k --user username:password --data "{"schemas":[],"name":{"familyName":"Madurapperuma", "givenName":"Tani"},"userName":"tanya@wso2.com","password":"testing123@"}" --header "Content-Type:application/json" https://localhost:9443/wso2/scim/Users

You will get a response payload as follows.

{"id":"5c05a64c-4f9b-44c7-9092-27cd4dc15640","schemas":["urn:scim:schemas:core:1.0"],"name":{"familyName":"Madurapperuma","givenName":"Tani"},"userName":"tanya@wso2.com","meta":{"lastModified":"2013-10-20T09:47:35","location":"https://localhost:9443/wso2/scim/Users/5c05a64c-4f9b-44c7-9092-27cd4dc15640","created":"2013-10-20T09:47:35"}}

As I have mentioned above, you will not be able to update the userName SCIM claim after the creation of the user since the userName claim is immutable in carbon user store.

So with this tricky method you will be able to modify it.
Map the AD attribute that you have mapped to the userName claim to another SCIM claim and try modifying the newly mapped claim. 

In our case we have mapped AD attribute "mail" to SCIM claim "userName". So we will map it to SCIM claim "Emails" as well.

Now we have the following additional mapping as well.

CLAIM URI	AD Attribute
urn:scim:schemas:core:1.0:emails	mail

Now let's try updating SCIM claim "emails".

curl -v -k --user username:password -X PUT -d "{"schemas":[],"userName":"tanya@wso2.com", "emails":"tani@wso2.com"}" --header "Content-Type:application/json" https://localhost:9443/wso2/scim/Users/5c05a64c-4f9b-44c7-9092-27cd4dc15640

At this point, you might be worrying that it did not work seeing the response payload. Wait !!! The response payload that I got is as follows. 

{"id":"5c05a64c-4f9b-44c7-9092-27cd4dc15640","schemas":["urn:scim:schemas:core:1.0"],"userName":"tanya@wso2.com","emails":"tani@wso2.com","meta":{"lastModified":"2013-10-20T09:54:20","location":"https://localhost:9443/wso2/scim/Users/5c05a64c-4f9b-44c7-9092-27cd4dc15640","created":"2013-10-20T09:47:35"}} 

So hasn't the trick worked ? 

Let's get the updated user and see what has happenned.

curl -v -k --user username:password https://localhost:9443/wso2/scim/Users/5c05a64c-4f9b-44c7-9092-27cd4dc15640

Response payload is as follows. 

{"id":"5c05a64c-4f9b-44c7-9092-27cd4dc15640","schemas":["urn:scim:schemas:core:1.0"],"name":{"familyName":"Madurapperuma","givenName":"Tani"},"userName":"tani@wso2.com","emails":["tani@wso2.com"],"phoneNumbers":[{"value":"2013-10-01T09:54:20","type":"pager"},{"value":"2013-10-01T09:47:35","type":"home"}],"addresses":[{"value":"https://localhost:9443/wso2/scim/Users/5c05a64c-4f9b-44c7-9092-27cd4dc15640","type":"streetAddress"}],"meta":{"lastModified":"2013-10-20T09:54:20","created":"2013-10-20T09:47:35","location":"https://localhost:9443/wso2/scim/Users/5c05a64c-4f9b-44c7-9092-27cd4dc15640"}}

No more worries :) It has worked. You may notice that it is the same user that we created a while ago. See the familyName and the giveName values if you are not sure. 

So in summing up, all you have to do is just map the AD attribute that you mapped to SCIM claim userName to another AD attribute that is mutable.

Acknlowlegement

• Venura and Ishara at WSO2 
• Two blog posts by Hasini and Suresh

Configure WSO2 Identity Server SAML2 IDP with Oracle Weblogic as Service Provider

This blog post explains How to configure WSO2 Identity Server as SAML2 IDP and Oracle Weblogic as Service Provider.

You might already know that there are two parties engaged in a single sign on system.

1. Identity Providers (IDP)
2. Service Providers (SP)

So there should be a mechanism for the identity provider to know that this is an authentic service provider and at the same time service provider needs to know that authentication response came from a trusted identity provider. This secure transaction between IDP and SP is ensured by sharing metadata files of the two parties.

First let's see How can we configure Weblogic as a Service Provider.

First you need to download and install Weblogic server. You can download it from here and follow the README.txt for the installation. 

NOTE: Make sure you configure a new domain if you do not have one already.

Start a browser and log in to Oracle weblogic server administration console at http://localhost:7001/console

We will be using appB as the sample test application which you can download from here. 

Deploy appB in the Weblogic server. 

1. Go to Deployments under <mydomain> and click install.
   
2. Click upload your file(s) and browse appB.
3. Keep all the default options and finish deployment.

Create a user in security realms.

1. Go to Security Realms --> myrealm
   
2. Select Users and Groups tab and Add a New user. (If you are using above appB, create your user as ssouser, because in weblogic.xml file of appB <principal-name> is defined as ssouser.)
   

Create SAML2 Identity Asserter.

1. Go to Security Realms --> myrealm
2. Providers tab --> Authentication tab and select New.
3. Create an Identity Asserter choosing the type as SAML2IdentityAsserter
   
   
4. Click on the just created SAML2IdentityAsserter and select Management tab. (You need to restart the admin server before this step to get the changes affected.)
   
   
5. Click on New and select New Web Single Sign-On Identity Provider Partner.
   
6. Browse and give the metadata file of WSO2 Identity Server. (NOTE : At the moment with IS 4.5.0 , it is not possible to auto generate the metadata file. The below given metadata file is one I created manually following the spec. )

   
      
          
            
               
                  MIICNTCCAZ6gAwIBAgIES343gjANBgkqhkiG9w0BAQUFADBVMQswCQYDVQQGEwJVUzELMAkGA1UE
   CAwCQ0ExFjAUBgNVBAcMDU1vdW50YWluIFZpZXcxDTALBgNVBAoMBFdTTzIxEjAQBgNVBAMMCWxv
   Y2FsaG9zdDAeFw0xMDAyMTkwNzAyMjZaFw0zNTAyMTMwNzAyMjZaMFUxCzAJBgNVBAYTAlVTMQsw
   CQYDVQQIDAJDQTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzENMAsGA1UECgwEV1NPMjESMBAGA1UE
   AwwJbG9jYWxob3N0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCUp/oV1vWc8/TkQSiAvTou
   sMzOM4asB2iltr2QKozni5aVFu818MpOLZIr8LMnTzWllJvvaA5RAAdpbECb+48FjbBe0hseUdN5
   HpwvnH/DW8ZccGvk53I6Orq7hLCv1ZHtuOCokghz/ATrhyPq+QktMfXnRS4HrKGJTzxaCcU7OQID
   AQABoxIwEDAOBgNVHQ8BAf8EBAMCBPAwDQYJKoZIhvcNAQEFBQADgYEAW5wPR7cr1LAdq+IrR44i
   QlRG5ITCZXY9hI0PygLP2rHANh+PYfTmxbuOnykNGyhM6FjFLbW2uZHQTY1jMrPprjOrmyK5sjJR
   O4d1DeGHT/YnIjs9JogRKv4XHECwLtIVdAbIdWHEtVZJyMSktcyysFcvuhPQK8Qc/E/Wq8uHSCo=
               
            
         
        
   
        
   
        
   
   
   
   
   

   
7. Click on the just created Identity Provider Partner and fill the details, tick the options as below and Click Save.
   
8. Verify whether your metadata file has parsed correctly by navigating to Single Sign-On Signing Certificate tab and Single Sign-On Service Endpoints tab.

Configure at server level.

1. Go to Environment --> Servers and Click on myserver(admin).
   
2. Tick the SSL Listen Port Enabled option and Save.
   

NOTE: We will be using the demo Keystore and if you need you can have your own custom keystore.

SAML2 General Tab configurations.

1. Go to Federation Services tab --> SAML 2.0 General tab. 
2. Fill the fields with relevant information as shown below and Save.
   

SAML2 Service Provider Tab configurations.

1. Go to Federation Services tab --> SAML 2.0 Service Provider tab.
2. Enable it and Save.
   

Publish Metadata. (Incase your IDP requires a metadata file from Weblogic server.)

1. Go back to SAML2 General tab and Click on Publish Meta Data.
   
2. Provide a location to save the Weblogic metadata file.

Create SAML Authentication Provider.

1. Go to Security Realms --> myrealm
2. Providers tab --> Authentication tab and select New.
3. Create SAML Authenticator choosing the type as SAMLAuthenticator. 
   
4. Click on the just created SAMLAuthenticator.
5. Go to Configuration tab --> Common tab and select Control Flag as Sufficient.
   
   
   

Go to DefaultAuthenticator and select Control Flag as Sufficient as well.

Now we have done with configuring Weblogic server as the service provider.

Let's have a look how can we configure WSO2 IS to serve as the Identity provider.

Start WSO2 Identity server (tested in IS 4.5.0) and login as admin.

Create the same user you created in Weblogic server in Identity Server.

1. Go to Configure tab and click on Users.
2. Click on Add New User and add the same user.
3. Give Login permission to that user.

Register new Service Provider.

1. Go to Main tab and select SAML SSO under Manage.
2. Click on Register New Service Provider.
3. Fill the data as below and click Register.
   

Now we have done with configuring both IDP and SP and it's the time to test the SAML2 Application.

Restart the weblogic server + WSO2 IS and go to http://localhost:7001/appB/admin/services.jsp  and you will be redirected to WSO2 Identity server SAML sso page.

Log in with the created user ( in our case ssouser )

If you see the below page, Congratulations !!! You have configured WSO2 IS as SAML2 IDP and Weblogic as SP.

Acknowledgement

• My thanks goes to Prabath and Dulanja at WSO2.
• Gilles for this excellent blog post.