Configuring WS-Trust Security Token Service¶
WSO2 Identity Server uses the security token service (STS) as the
WS-Trust implementation. The STS is capable of issuing
SAML 1.1 and 2.0 security tokens and has a SOAP/XML API for token
issuance. This API can be secured with the
UserNameToken or with any other WS-Security mechanism
as explained below.
Before you begin
WS-Trust authentication is no longer supported by default in WSO2 IS 5.11.0 and has been introduced as a connector. In order to use WS-Trust authentication, first you should download the connector from WSO2 Connector Store and install it.
Securing the Security Token Service¶
According to the Trust Brokering model defined in the WS-Trust specification, the users should authenticate themselves to the STS before obtaining a token. STS may use this authentication information when constructing the security token. For example, STS may populate the required claims based on the user name provided by the subject. Therefore, the STS service needs to be secured.
STS is configured under the Resident Identity Provider section of the WSO2 Identity Server Management Console.
To secure the Security Token Service:
On the Main tab, click Identity > Identity Providers > Resident.
The Resident Identity Provider page appears.
Enter the required values as given below.
Field Description Sample Value Home Realm Identifier This is the domain name of the identity provider. If you do not enter a value here, when an authentication request comes to WSO2 Identity Server, a user will be prompted to specify a domain. You can enter multiple identifiers as a comma-separated list.
Idle Session Time Out This is the duration in minutes for which an SSO session can be idle for. If WSO2 Identity Server does not receive any SSO authentication requests for the given duration, a session time out occurs. The default value is
Remember Me Period
This is the duration in weeks for which WSO2 Identity Server should remember an SSO session given that the Remember Me option is selected in the WSO2 Identity Server login screen.
The default value is
Under the Inbound Authentication Configuration section, click Security Token Service Configuration > Apply Security Policy .
Select Yes in the Enable Security? drop down and select a pre-configured security scenario according to your requirements. For this tutorial, use UsernameToken under the Basic Scenarios section.
You can find further details about security policy scenarios from the view scenario option .
Click Next. The user domain and user group selection appears.
Next steps may vary as per the security scenario that you have chosen under point (5) above. Below is for UsernameToken scenario.
Provide the required details as follows:
- Select ALL-USER-STORE-DOMAINS.
Select the role you created to grant permission to access secured service. In this example, the admin role is used. Next, click Finish.
The Select Domain drop-down lists many domains. The listed User Groups can vary depending on the domain selected.
- Click Ok on the confirmation dialog window that appears.
- Click Update to complete the process.
Now STS is configured and secured with a username and password. Only users with the Admin role can consume the service.
The next step is to add a service provider to consume the STS.
Adding a service provider for the STS client¶
Do the following steps if you are using a Holder of Key subject confirmation method. For more information, see Configuring STS for Obtaining Tokens with Holder-Of-Key Subject Confirmation.
The Subject confirmation methods define how a relying party (RP), which is the end service can make sure a particular security token issued by an STS is brought by the legitimate subject. If this is not done, a third party can take the token from the wire and send any request it wants including that token. The RP trusts that illegitimate party.
Before you begin
You must first register a service provider. To register a service provider:
- Sign in to WSO2 Identity Server Management Console as an admin.
- On the Main menu, click Identity > Service Providers > Add.
- Enter a service provider name.
- Click Register. The Service Provider Details page appears.
- Under the Inbound Authentication Configuration section, click
WS-Trust Security Token Service Configuration >
Configure. The STS Configuration page appears.
Enter the required details as given below.
Field Description Sample Value Endpoint AddressEnter the trusted relying party's endpoint address, which is the endpoint address of the Security Token Service. For more information, see Broker Trust Relationship with WSO2 Identity Server.
The endpoint must be used as the service
URLto which the token gets delivered by the STS client. Then select the public certificate imported. Tokens issued are encrypted using the public certificate of the trusted relying party. Therefore, the consumer who obtains this token, to invoke the RP service, will not be able to see the token.
NoteMake sure to upload the certificate of the relying party to the truststore. For instructions, see Adding CA-signed certificates to keystores.
Certificate Alias This is the alias of the certificate.
Click Update to save the changes made to the service provider.
Run the STS client after configuring the service provider. For instructions on trying out a sample STS client, see Running an STS Client.