Steps to configure SAML 2.0 with Weblogic Server (using embedded LDAP as a security store - Only for Dev Environment)...

NOTE :

- A WebLogic Server instance that is configured for SAML 2.0 SSO cannot sent a request to a server instance configured for SAML 1.1, and vice-versa. 

- WebLogic Server does not support encrypted assertions in SAML. 

- It is always recommended to create a domain in which the RDBMS security store is configured. 

- The RDBMS security store is required by the SAML 2.0 security providers in production environments so that the data they manage can be synchronized across all the WebLogic Server instances that share that data. 

- Note that Oracle does not recommend upgrading an existing domain in place to use the RDBMS security store. If you want to use the RDBMS security store, you should configure the RDBMS security store at the time of domain creation. If you have an existing domain with which you want to use the RDBMS security store, create the new domain and migrate your existing security realm to it. 

- If you are configuring SAML 2.0 services in a cluster, each Managed Server in that cluster must be configured individually. 

- You cannot configure SAML 2.0 general services in a WebLogic Server instance until you have first configured either the SAML 2.0 Identity Assertion or SAML 2.0 Credential Mapping provider and restarted the server instance.

- Note that I have not used an RDBMS security store in the following configuration, ( I am using embedded LDAP ) This is only for demonstration purpose and is not recommended for production environments.

- While configuring SAML2 with Weblogic Server in production environment, please make sure you create a domain with RDBMS security store configured.

Prerequisite :

- In the following example I have created two domains " SAML2_IDP_Source_Domain " and " SAML2_SP_Destination_Domain " on Weblogic Server 12.1.1.

- I have created self signed certificates and configured SSL on both the domains.

- Source domain HTTP and HTTPS ports are 7001 and 7002 respectively.

- Destination domain HTTP and HTTPS ports are 7003 and 7004 respectively.

SAML Souce site configuration :

- Create a " Credential Mapper " on Weblogic Source domain, i.e on the IDP end.

- Login to Source domain - Weblogic console --> Click on ” myrealm ” –> ” Providers ” –> ” Credential Mapping ” –> and add a ” SAML2CredentialMapper ” say ” SAML2_CredentialMapper ” as shown below :

Credential Mapper

- Now click on the newly created SAML2CredentialMapper say ” SAML2_CredentialMapper ” and make the following changes :

Issuer URI : http://www.souresite.com/saml

Name Qualifier : sourcesite.com

">

- Click on ” Servers ” –> Admin Server –> ” Federation Services ” –> ” SAML 2.0 Identity Provider ” and make the following changes :

Enabled : check

Preferred Binding : POST

- Click on ” Servers ” –> Admin Server –> ” Federation Services ” –> ” SAML 2.0 General ” and make the following changes :

Replicated Cache Enabled – Uncheck / Check

Contact Person Given Name

Contact Person Surname

Contact Person Type

Contact Person Company

Contact Person Telephone Number

Contact Person Email Address

Organization Name

Organization URL

Published Site URL : http://<SourceSiteDNSName>:<PORT>/saml2

Entity ID : ( Source Domain name)

Single Sign-on Signing Key Alias

Single Sign-on Signing Key Pass Phrase

Confirm Single Sign-on Signing Key Pass Phrase

Save the changes and export the IDP metadata into a XML file –> Click on “ Publish Meta Data ” button. ( say idp_metadata.xml ). We need to copy this file to the destination domain later.

Destination Site Configuration : 

- Create an Identity Asserter on the destination domain, i.e SP end.

- Login to Destination domain - Weblogic console --> Click on ” myrealm ” –> ” Providers ” –> ” Authentication ” –> new ” SAML2IdentityAsserter “ say ” SAML2_IdentityAsserter :

Click on ” Servers ” –> Admin Server –> ” Federation Services ” –> ” SAML 2.0 Service Provider ” and make the following changes :

Enabled : check

Preferred Binding : POST

Default URL : http://<DestinationSiteDNSName>:<PORT>/samldest01App

Now click on ” Servers ” –> Admin Server –> ” Federation Services ” –> ” SAML 2.0 General ” and make the following changes :

Replicated Cache Enabled : Uncheck / Check

Contact Person Given Name

Contact Person Surname

Contact Person Type

Contact Person Company

Contact Person Telephone Number

Contact Person Email Address

Organization Name

Organization URL

Published Site URL : http://<DestinationSiteDNSName>:<PORT>/saml2

Entity ID : ( Destination Domain name)

Single Sign-on Signing Key Alias

Single Sign-on Signing Key Pass Phrase

Confirm Single Sign-on Signing Key Pass Phrase

Save the changes and export the IDP metadata into a XML file –> Click on “ Publish Meta Data ” button. ( say SP_metadata.xml ). 

Copy service provider metadata ( SP_metadata.xml ) to Source Domain and identity provider metadata ( idp_metadata.xml ) to the Destination Domain as shown below :

--

Now configure Service Provider metadata on SAML Identity Provider in Source Site :

Log in to the source site Admin Console and click on ” Security Realms ” –> ” myrealm ” –> ” Providers ” –> ” Credential Mapper ”  –> ” SAML2_CredentialMapper ” –> ” Management ” –> ” New ” –> ” New Web Single Sign-On Service Provider Partner ” :

">

Name this ”New Web Single Sign-On Service Provider Partner” as “SAML_SSO_SP01″ and select the SP_metadata.xml file.

Click on the newly created ” SAML_SSO_SP01 ” and enter the following :

Name :  SAML_SSO_SP01

Enabled :  Checked

Description  : SAML_SSO_SP01

Key Info Included  : Check

">


Click on Site info and verify the data :

------

Now configure Identity Provider metadata on SAML Service Provider in Destination site :

Login to Destination Site Admin Console :

Click on ” Security Realms ” –> ” myrealm ” –> ” Providers ” –> Authentication -> SAML2_IdentityAsserter –> ” Management ” –> ” New ” –> “ New Web Single Sign-On Identity Provider Partner ” say ” SAML_SSO_IDP01 ” and then select ” idp_metadata.xml ” :


Click on ” SAML_SSO_IDP01 ” and enter the following :

Name : SAML_SSO_IDP01

Enabled : Check

Description : SAML_SSO_IDP01

Redirect URIs : /samldest01App/restricted01/samldest01services.jsp


We have successfully configured SAML 2 with Weblogic Server...!!

Deploy the source and destination application and check if SAML 2.0 works fine.

DOWNLOAD : Source Application. ( NEW )

DOWNLOAD : Destination Application. ( NEW )

Note :

- To test this sample application login using " weblogic " user.

The principal I have used in weblogic.xml file of this application is :

<security-role-assignment>
<role-name>SamlTrainee</role-name>
<principal-name>Administrators</principal-name>
</security-role-assignment> 

- So you should be able to login to this application with a user " Administrators " or any user who is part of a group called " Administrators ". 

- When you access the Source application, you will get a challenge, enter username " weblogic " and its password. Now click on the redirect URL and you should not be asked for a challenge while accessing the Destination app.

-  In the application jsp pages I have specified " localhost " in the URL, change it to your respective host / IP address.

- If you have the Source and Destination domain on the same machine, then make sure you edit the jsp page and change the redirect URL to IP / host, donot use " localhost " as it may go into a loop.  


Comments:

Hi Puneeth

Thanks for the info. I was able to setup and test fine.

Just to clarify, I found that the test user and the group needs to be setup both on the Source and Destination domains ? It does authenticate (I had created with different passwords) with the setup on the source (IDP) domain. If I did not do that, on entering the credentials, it gives me a 403 error.

regards
Anup

Posted by Anup on September 13, 2013 at 06:41 AM IST #

Hi Anup,

Yes, your understanding is correct.

We need to create the test user and the group on both the domains.

However, you need to login with the username and password just once. On successfull login a token/assertion would be created and this would be used to login to the second application ( without the user entering the username and password again).

Regards,
Puneeth

Posted by Puneeth on September 16, 2013 at 05:54 PM IST #

Puneeth:
thank you for the detail post. Although I had yet to setup a test system that prototypes saml2 authentication. you had stated that in the note section that " To test this sample application create a user " SAML_SSO_GRP " ( or a group named " SAML_SSO_GRP " and add any user to this group ) in embedded LDAP on both source and destination domain."
Can you elabrate more on this? how can I create user/group using embeded ldap? How can I accomplish this from a basic installation of wls. Do I enable the ldap from Home >Summary of Security Realms >myrealm >Users and Groups >Providers? TIA
Ed

Posted by guest on October 17, 2013 at 05:12 AM IST #

Hi Ed,

To create users/groups in embedded LDAP :
Login to console -> security realm -> myrealm -> " Users and Groups " tab --> new and create the user.

Regards,
Puneeth

Posted by Puneeth on October 17, 2013 at 06:55 PM IST #

Hi,

Just one domain in the Weblogic is possible to configure SSO with SAM?

Tks

Posted by Gustavo on October 26, 2013 at 02:44 AM IST #

It is not recommended to have both the SP and IDP on the same Domain, however it works I have tried it at my end.

Have a look at the following Oracle KM :

Can SAML SSO Be Configured In a Single WebLogic Server Domain? (Doc ID 1571946.1)

Posted by Puneeth on October 28, 2013 at 06:11 PM IST #

Hello,

the source app indeed is protected by a Basic authentication.
the target app no. There is no restriction for the target app.
Additionally there is a null for the username when we go from the source app (logged in) to the target app.

The idea of the SSO is to login once for all apps.
I made some changes to the web.xml (changed <url-pattern>) of the target app and managed to make it ask for password at both apps. But again both apps require a login :)

Obviously I made something wrong in the previous steps. Could you please help me?

Thank you in advance

Posted by guest on November 28, 2013 at 06:51 PM IST #

Hi,

I just tried accessing the source and Dest app separately ( without any SAML SSO configured ) and it asks for challenge.

There is <security-constraint> defined in web.xml files of both the source and Dest apps.

and
<login-config>
<auth-method>BASIC</auth-method>

Can you please check again.

Also, in the above setup, SP initiated SSO and IDP initiated SSO works fine.

The concept here is :

IDP Initiated :

- If you access the source app first it will ask for a challenge
- Then after providing a valid username and password
- You will be able able to login to a restricted page in Source app.

- Now you have link in the restricted page of source app which is actually a URL which points to a restricted page on the Destination app.

- When you click on this link you will be redirected to the Destination app along with a valid SAML token which is used to login to Destination app and access the page.

-----

SP Initiated :

- Access the Destination app first --> This should ask for a challenge. ( If it doesnt then clear your cache / use a different browser ).

- Now after you enter the valid username and password - It will be validated and a SAML token will be created at the IDP / source end and this token is used to login to the restricted page in the destination end.

- Now you will have a link in this page ( Destination page ) which maps to a restricted page in Source app end.

- When you click on this link the SAML token is used to login to the Source app and you will be able to see the restricted page in Source App.

Posted by Puneeth on December 06, 2013 at 09:00 PM IST #

Intro to SAML :

http://wls4mscratch.wordpress.com/2010/07/06/saml/

Posted by Puneeth on December 06, 2013 at 09:06 PM IST #

Hi Puneeth,

Thanks for providing the step by step guidance for "Steps to configure SAML 2.0 with Weblogic Server (using embedded LDAP as a security store - Only for Dev Environment".

I have gone through all the steps given above and Posts as well:
- Prerequisite
- SAML Source site configuration
- SAML Destination Site Configuration
- Deployed the source and destination applications
- created a user group "SAML_SSO_GRP" in embedded LDAP on both domain
- Edited the jsp page and changed the redirect URL to IP

Apparently, The aforementioned action items have properly been performed but obviously something is still missing. Consequently I am facing the problem in accessing the Source and Destination Application.

Application Access Error: Error 403--Forbidden

Could you please help me?
Thank you in advance.

Posted by Imran Shabbir on January 23, 2014 at 09:57 PM IST #

Answer to:
guest wrote:

I deploy source and destination application after configuring Source and destination domains. But when i access source/destination application it give me the error below. Can you help me that what is missing.

10.4.4 403 Forbidden

The server understood the request, but is refusing to fulfill it. Authorization will not help and the request SHOULD NOT be repeated. If the request method was not HEAD and the server wishes to make public why the request has not been fulfilled, it SHOULD describe the reason for the refusal in the entity. This status code is commonly used when the server does not wish to reveal exactly why the request has been refused, or when no other response is applicable.

Regards

----
Respond to this comment at:
https://blogs.oracle.com/blogbypuneeth/entry/steps_to_configure_saml_2#comments

Hi guest,

please edit the setDomainEnv.bat (or sh) and set the following line:

set JAVA_PROPERTIES=-Dwls.home=%WLS_HOME% -Dweblogic.home=%WLS_HOME% -Dweblogic.debug.DebugSecuritySAML2Atn=true -Dweblogic.debug.DebugSecuritySAML2CredMap=true -Dweblogic.debug.DebugSecuritySAML2Lib=true -Dweblogic.debug.DebugSecuritySAML2Service=true

This will enable the SSO debug properties. You should normally receive an exception. This must be related with the clocks of your IDP and SP servers.

These clocks must be fully synchronised. Ideally both macines should be in synch with a time server.
If this is the case then the exception that you will receive will be something like NotBeforeException (or NotValidAfter)

Regards,
other guest!

Posted by guest on January 24, 2014 at 05:07 PM IST #

Yes, please enable the SAML debugs from console.

You should get an error trace in the logs. Make sure you have increased the logging severity to DEBUG.

Login to console --> servers --> logging --> +advanced --> change the logging severity to DEBUG from the drop down menu.

Login to console --> servers --> debug --> +weblogic --> security --> SAML ( enable ).

Posted by Puneeth on January 24, 2014 at 07:43 PM IST #

how to achieve both SSO and Non SSO user logins in weblogic in a single application

Posted by guest on March 20, 2014 at 05:43 PM IST #

Hi Puneeth,
Firstly thank you much for the information.

Coming straight to the point - as mentioned by 1 of the guests, I am facing the same issue --- on clicking on link to destination site, redirection happens alright but I think that is only because protection in destination site is only for <url-pattern>samldest01App/restricted01/*</url-pattern> and not <url-pattern>/restricted01/*</url-pattern> - this means there is no protection at all - hence redirection happening without asking for credentials is no surprise. Further evidence is user displays as null in the destination page.

Or I must have got my configuration wrong somewhere. Kindly guide.

Thank you,
guest_Karthikeyan

Posted by guest on April 08, 2014 at 10:51 PM IST #

Yes Karthikeyan, you are right I looked into the app now and yes there seems to be a problem.
I will fix it as soon as possible...

Thanks for pointing it out.. And thanks to the other user who initially found this problem..

Posted by Puneeth on April 09, 2014 at 01:30 AM IST #

OK I have fixed the app now...!!! ( Uploaded latest fixed app to the post )

Two changes I had to make in web.xml file of the destination application were :

1)

<url-pattern>/restricted01/*</url-pattern>

2)

<login-config>
<auth-method>CLIENT-CERT,BASIC</auth-method>
<realm-name>myrealm</realm-name>
</login-config>

Posted by Puneeth on April 10, 2014 at 09:59 PM IST #

NOte :

If you have used Demo Identity and Demo Trust to configure SSL for your servers then below is the information you need to provide in SAML 2.0 Federation proerties :

Single Sign-ON --> Single Sign-on Signing Key Alias: DemoIdentity
Single Sign-on Signing Key Pass Phrase: DemoIdentityPassPhrase
Confirm Single Sign-on Signing Key Pass Phrase: DemoIdentityPassPhrase

Posted by Puneeth on April 10, 2014 at 10:02 PM IST #

Post a Comment:
  • HTML Syntax: NOT allowed
About

Oracle Fussion Middleware - WebLogic

Search

Archives
« April 2014
SunMonTueWedThuFriSat
  
1
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
   
       
Today