Sun(TM) Microsystems, Inc.
Jump Over Tab Navigation Area. Current Selection is: Access Control

< Client Samples Main Page

 

Introduction

This sample demonstrates the usage of Security Token Service (STS) Client API for obtaining security tokens from a Security Token Service hosted on OpenAM server. STS client API makes WS-Trust request to STS service in order to get Security Token from STS service. The communication between STS client and STS service is secured using Authentication token of STS client. This Authentication token used in the sample is X509 token. STS service authenticates STS client based on its X509 authentication token and issues SAML 1.1 or SAML 2.0 token.

Setup

STS service :

  1. Deploy OpenAM war

  2. Configure OpenAM web application

STS client :

  1. This OpenAM client web application

  2. This page → <OpenAM client web application protocol://host:port>/<client-deployment-uri>/sts/index.html

JSP pages

There are two sample JSP pages included in this STS client sample.

  1. <OpenAM client web application protocol://host:port>/<client-deployment-uri>/sts/sts-client-user.jsp

    Accessing this page will redirect to authentication service of OpenAM server.

    Login with any existing OpenAM user.

    After successful user authentication and valid user's SSOToken, the page will redirect back to sts-client-user.jsp.

    sts-client-user.jsp will display SAML assertion obtained from OpenAM Security Token Service, in exchange of end user's SSOToken.

    Description :

    There are two parties involved in this Sample :

    1) Security Token Service Client (STS client)

    2) Security Token Service (STS)

    The Security Token Service (STS) issues security tokens on behalf of authenticated end user. Here JSP page selects the default STS client profile to talk to STS service. Then STS client makes WS-Trust request to STS service with its X509 certificate as the Authentication token. STS service authenticates this X509 certificate and issues SAML 1.1 or SAML 2.0 (this token type of SAML1.1 or SAML 2.0 is dictated by WSP's profile). This WS-Trust request also carries the end user's authenticated SSOToken as “On Behalf Of” token element. The owner of STS service issued SAML token would be the authenticated End user and its identity (name id) would be the End user's user identity.

  2. <OpenAM client web application protocol://host:port>/<client-deployment-uri>/sts/sts-client-wsc.jsp

    Login to OpenAM Administration console <OpenAM web application protocol://host:port>/<opensso deploy uri> as “amadmin” user and its password.

    Go to Access Control → Default realm → Agents → Web Service Client → click “wsc” agent profile

    Select Security Mechanism as “STSSecurity”, STS Configuration as “SecurityTokenService” and Web Service End Point as “default”.

    Save changes and Logout of OpenAM Administration console.

    Access <OpenAM client web application protocol://host:port>/<client-deployment-uri>/sts/sts-client-wsc.jsp

    Enter web service client name as "wsc" and click "GetToken".
    If successful, this will display SAML Assertion obtained from OpenAM Security Token Service, in exchange of WSC's token.

    Description :

    There are four parties involved in this Sample :

    1) Web Services Client (WSC)

    2) Web Services Provider (WSP)

    3) Security Token Service Client (STS client)

    4) Security Token Service (STS)

    The Security Token Service (STS) issues security tokens for Web Services Client (WSC) so that WSC could present it to the Web Services Provider (WSP) for authentication purposes. Here WSC selects to get security token from STS, in order to present that token to WSP. When WSC selects the STS issues token, it also selects the STS client profile required to talk to STS service. Then STS client makes WS-Trust request to STS service with its X509 certificate as the Authentication token. STS service authenticates this X509 certificate and issues SAML 1.1 or SAML 2.0 (this token type of SAML1.1 or SAML 2.0 is dictated by WSP's profile). The owner of this SAML token would be STS client and its identity (name id) would be certificate subject DN of the STS client's X509 certificate.

NOTEs

1) How to change WSP's profile to dictate SAML 1.1 or SAML 2.0 token ?

Login to OpenAM Administration console <OpenAM web application protocol://host:port>/<opensso deploy uri> as “amadmin” user and its password.
Go to Access Control → Default realm → Agents → Web Service Provider → click “wsp” agent profile

For SAML 2.0 token type, select Security Mechanism as
- “SAML2-HolderOfKey” if the token is to be retrieved for WSC's own identity (sample 2 - sts-client-wsc.jsp)
- “SAML2-SenderVouches” if the token is to be retrieved for end user's identity (sample 1 - sts-client-user.jsp)

For SAML 1.1 token type, select Security Mechanism as
- “SAML-HolderOfKey” if the token is to be retrieved for WSC's own identity (sample 2 - sts-client-wsc.jsp)
- “SAML-SenderVouches” if the token is to be retrieved for end user's identity (sample 1 - sts-client-user.jsp)

Save changes and Logout of OpenAM Administration console.

If both, SAML 2.0 and SAML 1.1 security mechanisms are selected, then SAML 2.0 takes the precedence.

2) How to create agent profiles for WSC, STS client and WSP (if not created out of box) ?

    Login to OpenAM Administration console <OpenAM web application protocol://host:port>/<opensso deploy uri> as “amadmin” user and its password.

    Go to Access Control → Default realm → Agents →

    a) Create "STS Client" profile
    Select STS Client → under Agent, click "new" → select "STS Agent" -> enter name as "SecurityTokenService" and other required fields → Save.
    Click on above saved profile to edit → Select Security Mechanism as “X509Token” and "Is Request Signed" as true (checked).
    Save changes.
b) Create "WSC" profile
Select Web Service Client → under Agent, click "new" → enter name as "wsc" and other required fields → Save.
Click on above saved profile to edit → Select Security Mechanism as “STSSecurity”, STS Configuration as “SecurityTokenService”, Web Service End Point as “default” and "Is Request Signed" as true (checked).
Save changes.

c) Create "WSP" profile
Select Web Service Provider → under Agent, click "new" → enter name as "wsp" and other required fields → Save.
Click on above saved profile to edit → Select Security Mechanism as "SAML2-HolderOfKey", “SAML-HolderOfKey” and "X509Token".
Select Web Service End Point as “default” and "Is Request Signature Verified" as true (checked).
Save changes.

    Logout of OpenAM Administration console.