Configuring claims for a service provider¶

A service provider may need access to specific user claims to be able to provide its services to users. You can allow this by enabling the required claims for your service provider configuration in WSO2 Identity Server.

Listed below are the types of claims you will set up for the service provider.

Prerequisites¶

You need to register a service provider on the Management Console.

Configure claims¶

You can configure claims using the following methods:

• Use local claims
• Use custom claims

Use local claim dialect¶

To configure local claims for a service provider:

1. On the Management Console, go to Main > Identity > Service Providers.
2. Click List, select the service provider you want to configure, and click on the corresponding Edit link.
3. Expand the Claim Configuration section and enable the claims required by the service provider.

4. Select Use Local Claim Dialect, click Add Claim URI, and specify the following details:

   Field name	Description
   Local Claim	Select the local claim from the list.
   Mandatory Claim	Enable this if the claim should be mandatory for the service provider.

   

5. Select the Subject Claim URI from the list.

   Info

   This is the authenticated user identifier, which will return the authentication response to the service provider.

6. Click Update to save the configurations.

Use custom claim dialect¶

To define custom claims and enable them for the service provider:

1. On the Management Console, go to Main > Identity > Service Providers.
2. Click List, select the service provider you want to configure, and click on the corresponding Edit link.
3. Expand the Claim Configuration section and enable the claims required by the service provider.

4. Select Define Custom Claim Dialect, click Add Claim URI, and specify the following details:

   Field name	Description
   Service Provider Claim	Name of the service provider claim.
   Local Claim	Choose the local claim corresponding to the SP claim from the list.
   Requested Claim	Enable this if you want to allow the new claim to be shared with the service provider.
   Mandatory Claim	Enable this if the claim should be mandatory for the service provider

   

5. Select the Subject Claim URI from the list.

   Info

   This is the authenticated user identifier, which will return the authentication response to the service provider.

6. Select the Role Claim URI from the list of claims you mapped.

7. Click Update to save the configurations.

Cache service provider claims¶

Add the following configuration to the /repository/conf/deployment.toml` file if you want to cache claim data.

[cache.manager]
name = "LocalClaimInvalidationCache"
timeout = "300"
capacity = "5000"

Here, you need to specify values as follows:

• timeout: The cache timeout value in seconds.
• capacity: The maximum cache size.

Get user consent to share claims¶

When a user attempts to log in to the service provider, they will be prompted for consent to share the claims configured for the service provider.

The user will not be able to proceed with the authentication without providing consent. Learn more about managing user consent.