Prerquisites for adaptive authentication¶
This section guides provides you the prerequisites to try out the adaptive authentication scenarios configurable on Identity Server.
Set up the sample¶
This section guides you on how to set up the sample SAML application.
Download Apache Tomcat 8.x and install it. Tomcat server installation location will later be referred to as
<TOMCAT_HOME>in this guide.
It is recommended that you use a hostname that is not
localhostto avoid browser errors. Modify your machine's
/etc/hostsentry to reflect this.
wso2is.localis used in this documentation as an example, but you must modify this when configuring the authenticators or connectors with this sample application.
Download the SAML pickup dispatch application from the latest release assets.
Deploy the sample web app¶
To deploy the sample web app on a web container:
Copy the downloaded
.warfile of the SAML application into the
webappsdirectory of the Tomcat folder.
Start the Tomcat server.
Add CORS configuration¶
SAML2 POST Binding requires CORS configurations to be set up.
Before configuring the service provider, add the following configurations to the
deployment.toml file found in
<IS_HOME>/repository/conf/. Adding this configuration allows
HTTP POST requests.
``` toml [cors] allow_generic_http_requests = true allow_any_origin = false allowed_origins = [ "http://localhost:8080" ] allow_subdomains = false supported_methods = [ "GET", "POST", "HEAD", "OPTIONS" ] support_any_header = true supported_headers =  exposed_headers =  supports_credentials = true max_age = 3600 tag_requests = false ```
Register a service provider¶
On the Management Console, go to Main > Identity > Service Providers and click Add.
saml2-web-app-pickup-dispatchas the Service Provider Name, and click Register.
Expand the Inbound Authentication Configuration > SAML2 Web SSO Configuration section and, click Configure.
Enter the following values in the fields mentioned.
Field name Value Issuer
Assertion Consumer URL
Click Yes on the dialog that appears after you add the Assertion Consumer URL. This dialog appears when you add an
Enable the following by selecting the corresponding checkboxes:
- Enable Response Signing
- Enable Signature Validation in Authentication Requests and Logout Requests
- Enable Single Logout
- Enable Attribute Profile
- Include Attributes in the Response Always
For more information on the advanced configurations, see Advanced SAML Configurations.
Click Register to add the service provider and save the configurations.
Adaptive authentication scenarios¶
- User Store-Based
- With Function Library
- Limiting Active User Sessions