WSC Sample

Introduction

This explains how to deploy and run the WSC sample to query and modify Liberty Discovery Service and ID-SIS Personal Profile Service.
There are five parties involved in this sample:
* Liberty Service Provider (SP)
* Liberty Identity Provider (IDP)
* Web Service Consumer (WSC)
* Liberty Discovery Service (DS)
* Liberty ID-SIS Personal Profile Service (ID-SIS-PP)

Here is the general flow of the sample :
1. Complete the Liberty Single-Sign-On Process, obtain Discovery Service Boot Strapping Resource Offering.
2. Register user's Resource Offering at the ID-SIS-PP instance using Discovery Service Modification.
3. Send Discovery Service Lookup request, discovery service returns discovery lookup response to the WSC which contains the resource offering for the user's ID-SIS-PP instance.
4. Send Data Service Query to the ID-SIS-PP Instance to retrieve user attributes.
5. Send Data Service Modification to the ID-SIS-PP Instance to modify user attributes.

Setup

In the following instructions we use unix path seperator '/'. For windows enviroment please change '/' to '\'.

1. Deploy OpenAM server WAR (openam.war) on machine A, and configure the IDFF sample to run as IDP. This instance will also act as DS and ID-SIS-PP role in the sample scenario.
2. Deploy OpenAM server WAR (openam.war) on machine B, and configure the IDFF sample to run as SP.
3. Create a user on IDP and a user on SP. Federate and signle sign on the users.
4. Deploy OpenAM client sample WAR (opensso-client-jdk14.war for web container running JDK 1.4.x or opensso-client-jdk15.war for web container running JDK 1.5.x) on machine C.
5. Click here to configure Client SDK. If you have done it, skip to next step. Enter SP information and save.
6. If you changed your SP cookie name, you need to set property "com.iplanet.am.cookie.name" value to the new cookie name in "<your_home_dir>/OpenSSOClient/<normalized_web_app_path>AMConfig.properties" file, where "<your_home_dir>" is the home directory of the web container running user, "<normalized_web_app_path>" is a path string (e.g. "_opt_tomcat_webapps_openam_") by replacing the file separator (e.g. "/") with "_" in the absolute file path (e.g. "/opt/tomcat/webapps/openam/") the web application is deployed.
7. Click here to configure.
8. If you want to enable interaction for IDPP query and modify please see the section "Enable interaction for IDPP query and modify"
9. If you want to enable name id encryption in session context of discovery bootstrap, please see the section "Enable name id encryption in session context of discovery bootstrap".

Demonstration

After you have setup your machines, single sign on IDP and SP users then visit this link to try out this sample.

Enable interaction for IDPP query and modify

On IDP machine turn on IDPP policy evaluation:
1. Bring up a browser and go to "<IDP protocol>://<IDP hostname>:<IDP port><IDP depoly uri>" and login into console as user 'amadmin'
2. Click 'Web Services' tab.
3. Click 'Personal Profile' tab.
4. Click check box 'Require Query PolicyEval'
5. Click check box 'Require Modify PolicyEval'
6. Click 'Save'.

Create policy for IDPP query and modify:
1. Bring up a browser and go to "<IDP protocol>://<IDP hostname>:<IDP port><IDP depoly uri>" and login into console as user 'amadmin'
2. Click 'Access Control' tab.
3. Click realm '/ (Top-Level Realm)'.
4. Click 'Policies' tab.
5. Click 'New Policy ...'
6. Enter any policy name in the 'Name' text field.
7. Click 'New...' under 'Rules' section.
8. Select 'Liberty Personal Profile Service (with resource name) then click 'Next'.
9. Enter any rule name in the 'Name' text field.
10. Enter '*' in the 'Resource Name' text field.
11. Click both check boxes next to action 'MODIFY' and 'QUERY' and select 'interactForConsent' in both drop down menus under 'Value' then click 'Finish'.
12. Click 'New...' under 'Subjects' section.
13. Select 'Authenticated Users' then click 'Next'.
14. Enter user name of IDP user you created before (e.g. idp) in the 'Name' text field then click 'Finish'.
15. Click 'OK' to save this policy.

Enable name id encryption in session context of discovery bootstrap

Set up IDP machine:
1. Bring up a browser and go to "<IDP protocol>://<IDP hostname>:<IDP port><IDP depoly uri>" and login into console as user 'amadmin'
2. Click 'Web Services' tab.
3. Click 'Discover Service' tab.
4. Change "Provider ID" to <IDP protocol>://<IDP hostname>:<IDP port><IDP depoly uri>.
5. Click check box "Encrypt Name Identifier in Session Context for Bootstrapping".
6. Click "Save".
7. Click "urn:liberty:disco:2003-08" under "Resource Offerings for Bootstrapping".
8. Click "edit" next to "urn:liberty:security:2003-08:null:null" under "Service Description".
9. Select "urn:liberty:security:2003-08:null:SAML" from "Available" and click "Add".
10. Select "urn:liberty:security:2003-08:null:null" from "Selected" and click "Remove".
11. Click "Save".
12. Change "Provider ID" under "Service Instance" to
%SERVER_PROTO%://%SERVER_HOST%:%SERVER_PORT%%SERVER_URI%
13. Click check box "AuthorizeRequester" and select "urn:liberty:security:2003-08:null:SAML" under the check box.
14. Click "Save".
15. Click "Save".
16. Click "Configuration" tab.
17. Click "Global" tab.
18. Click "Liberty ID-WSF Security Service".
19. Enter "test" in "Default WSC certificate alias" and "Trusted Authority signing certificate alias" and "Trusted CA signing certificate aliases" text fields.
20. Click "Save".
21. Download or build ssoAdminTools.zip and install.
22. Run
ssoadm delete-entity -y <IDP protocol>://<IDP hostname>:<IDP port><IDP depoly uri> -u amadmin -f <admin password file name> -c idff
23. Run
ssoadm delete-entity -y <SP protocol>://<SP hostname>:<SP port><SP depoly uri> -u amadmin -f <admin password file name> -c idff
24.Run
ssoadm create-metadata-templ -u amadmin -f <admin password file name> -y <IDP protocol>://<IDP hostname>:<IDP port><IDP depoly uri> -m /tmp/idpm -x /tmp/idpx -i /idp -b test -g test -c idff
25. Edit file '/tmp/idpx'
Change the value of attribute "enableNameIDEncryption" to "true"
26. Run
ssoadm import-entity -u amadmin -f <admin password file name> -m /tmp/idpm -x /tmp/idpx -t sampleidffcot -c idff
27. Copy '/tmp/spm' and '/tmp/spx'(generated at step 4 in section "Set up SP machine" below) from SP machine to '/tmp/spm' and '/tmp/spx' on this machine
28. Edit file '/tmp/spx'
Change the value of "hosted" to "0"
29. Run
ssoadm import-entity -u amadmin -f <admin password file name> -m /tmp/spm -x /tmp/spx -t sampleidffcot -c idff

Set up SP machine:
1. Download or build ssoAdminTools.zip and install.
2. Run
ssoadm delete-entity -y <IDP protocol>://<IDP hostname>:<IDP port><IDP depoly uri> -u amadmin -f <admin password file name> -c idff
3. Run
ssoadm delete-entity -y <SP protocol>://<SP hostname>:<SP port><SP depoly uri> -u amadmin -f <admin password file name> -c idff
4. Run
ssoadm create-metadata-templ -u amadmin -f <admin password file name> -y <SP protocol>://<SP hostname>:<SP port><SP depoly uri> -m /tmp/spm -x /tmp/spx -s /sp -a test -r test -c idff
5. Run
ssoadm import-entity -u amadmin -f <admin password file name> -m /tmp/spm -x /tmp/spx -t sampleidffcot -c idff
6. Copy '/tmp/idpm' and 'tmp/idpx' (generated at step 24 in section "Set up IDP machine" above) from IDP machine to '/tmp/idpm' and '/tmp/idpx' on this machine
7. Edit file '/tmp/idpx'
Change the value of "hosted" to "0"
8. Run
ssoadm import-entity -u amadmin -f <admin password file name> -m /tmp/idpm -x /tmp/idpx -c idff -t sampleidffcot

Restart web containers on IDP and SP machines.