WSO2 Identity Solution

• Content
• Home

Downloads

• Releases

Documentation

• Installation Guide
• Identity Provider Adminstrator Guide
• OpenID Provider Adminstrator Guide
• Identity Solution in Production Environment
• mod_cspace Configuration Guide
• Relying Party Developer Guide - I
• Relying Party Developer Guide - II
• Relying Party Developer Guide - III
• Idp User Guide
• OpenID User Guide

Samples

• Identity Provider
• PHP Relying Party
• Java Relying Party
• Access Control

API Documentation

• Java Docs

Get Involved

• Mailing Lists

Project Information

• Project Team
• Issue Tracking
• License

WSO2 Identity Solution, v1.5 : Java Servlet Filter Developer Guide : Part III

Introduction

This servlet filter org.wso2.solutions.identity.relyingparty.servletfilter.RelyingPartyFilter can be used with a servlet based web application to provide information card and OpenID login to that application.The Part III of this guide explains how you can add OpenID support to a relying party web application, with OpenID Attribute Exchange and OpenID Provider Authentication Policy Extension. The developer should follow the steps described below in intgrating this servlet filter:

Adding OpenID Attribute Exchange support

Step 1 : Add the servlet filter to your application

Include the following entry in the web.xml file of the application:

    <filter>
        <filter-name>TokenValidator</filter-name>
        <filter-class>org.wso2.solutions.identity.relyingparty.servletfilter.RelyingPartyFilter</filter-class>
        	<init-param>
	    	    <param-name> ................ </param-name>
		    <param-value> ............... </param-value>
  		</init-param>
		<init-param>
			......................
  		</init-param>
			......................
			......................
    </filter>
	
    <filter-mapping>
        <filter-name>TokenValidator</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

Step 2 : Add signin page

<form name="openidsignin" id="openidsignin" method="post" action="openidsubmit.jsp">
    Enter Your OpenID Url:<input type="text" name="openIdUrl"/>
    <input type="submit" name="submit" value="Login" />
</form>

As per above scenario openidsubmit.jsp page will accept the OpenID url and will do authentication using Identity Solution's relying parting components.

Step 3 : Create OpenID authentication request[openidsubmit.jsp]

// imports
<%@page import="org.wso2.solutions.identity.openid.relyingparty.OpenIDAuthenticationRequest"%>
<%@page import="org.wso2.solutions.identity.openid.relyingparty.OpenIDConsumer"%>
<%@page import="org.wso2.solutions.identity.relyingparty.openid.OpenIDRequestType"%>
<%@page import="org.wso2.solutions.identity.relyingparty.RelyingPartyException"%>
<%@page import="org.wso2.solutions.identity.IdentityConstants"%>

<%

try
{
   OpenIDAuthenticationRequest openIDAuthRequest = null;

   openIDAuthRequest = new OpenIDAuthenticationRequest(request,response);

   openIDAuthRequest.setOpenIDUrl((String)request.getParameter("openIdUrl"));

   // you need to set an absolute url as the return url.
   // once the user authenticated successfully or failed at the OpenID
   // Provider, the browser will be redirected to this url

   openIDAuthRequest.setReturnUrl("http://myapp.com/openidcallback.jsp");

   // Use OpenID Attribute Exchange
   openIDAuthRequest.addRequestType(OpenIDRequestType.ATTRIBUTE_EXCHANGE);

   // Set the required claims - I need these claims from the OpenID
   // Provider.
   openIDAuthRequest.addRequiredClaims(IdentityConstants.OpenId.ExchangeAttributes.NICK_NAME,IdentityConstants.OpenId.ExchangeAttributes.NICK_NAME_NS);
   openIDAuthRequest.addRequiredClaims(IdentityConstants.OpenId.ExchangeAttributes.FULL_NAME,IdentityConstants.OpenId.ExchangeAttributes.FULL_NAME_NS);
   openIDAuthRequest.addRequiredClaims(IdentityConstants.OpenId.ExchangeAttributes.EMAIL,IdentityConstants.OpenId.ExchangeAttributes.EMAIL_NS);
   openIDAuthRequest.addRequiredClaims(IdentityConstants.OpenId.ExchangeAttributes.DOB,IdentityConstants.OpenId.ExchangeAttributes.DOB_NS);
   openIDAuthRequest.addRequiredClaims(IdentityConstants.OpenId.ExchangeAttributes.GENDER,IdentityConstants.OpenId.ExchangeAttributes.GENDER_NS);
   openIDAuthRequest.addRequiredClaims(IdentityConstants.OpenId.ExchangeAttributes.POSTAL_CODE,IdentityConstants.OpenId.ExchangeAttributes.POSTAL_CODE_NS);
   openIDAuthRequest.addRequiredClaims(IdentityConstants.OpenId.ExchangeAttributes.COUNTRY,IdentityConstants.OpenId.ExchangeAttributes.COUNTRY_NS);
   openIDAuthRequest.addRequiredClaims(IdentityConstants.OpenId.ExchangeAttributes.LANGUAGE,IdentityConstants.OpenId.ExchangeAttributes.LANGUAGE_NS);
   openIDAuthRequest.addRequiredClaims(IdentityConstants.OpenId.ExchangeAttributes.TIMEZONE,IdentityConstants.OpenId.ExchangeAttributes.TIMEZONE_NS);


   // Performs authentication : this will redirect you to OpenID Provider for authentication
   OpenIDConsumer.getInstance().doOpenIDAuthentication(openIDAuthRequest);

}
catch(RelyingPartyException e)
{
   // handle exceptions
   out.println(e.getMessage());
}

%> 

Step 4 : Add OpenID callback page[openidcallback.jsp]

After being authenticated at the OpenID Provider, user will be redirected to this page.

// imports
<%@page import="org.wso2.solutions.identity.IdentityConstants"%>
<%@page import="org.wso2.solutions.identity.relyingparty.TokenVerifierConstants"%>
<%@page import="org.wso2.solutions.identity.openid.relyingparty.OpenIDConsumer "%>

<%

String nickname = null;
String auth = (String)request.getAttribute(TokenVerifierConstants.SERVLET_ATTR_STATE);

 if(auth != null && TokenVerifierConstants.STATE_SUCCESS.equals(auth)) {

    //user authenticated successfully at his OpenID Provider
    //let me get his nick name - which I requested.

    if (request.getAttribute(IdentityConstants.OpenId.ExchangeAttributes.NICK_NAME) != null)
    {
           nickname = request.getAttribute(IdentityConstants.OpenId.ExchangeAttributes.NICK_NAME);

    }else {

       // there can be OpenID Providers, who do not maintain a list of user
       // attributes. In such case you won't receive any value here -
       // though you requested.
    }
 }
 else
 {
  //user authentication failed at his OpenID Provider
 }
%> 

Step 5 : Add the following jars to your classpath

• axiom-api-1.2.4.jar
• axiom-dom-1.2.4.jar
• axiom-impl-1.2.4.jar
• wstx-asl-3.2.1.jar
• bcprov-jdk15-132.jar
• core-3.1.1.jar
• dom4j-1.6.1.jar
• opensaml-1.1.406.jar
• opensaml-2.0-rc1.jar
• openws-2.0-rc1.jar
• stax-api-1.0.1.jar
• wss4j-SNAPSHOT.jar
• xmlsec-534045-patched.jar
• wso2is-token-verifier-core-1.5.jar
• wso2is-base-1.5.jar
• openid4java-nodeps-0.9.3.1.jar
• icu4j-3.4.4.jar
• openxri-client-1.0.1.jar
• openxri-syntax-1.0.1.jar
• commons-pool-1.3.jar
• commons-dbcp-1.2.2.jar
• htmlparser-1.6.jar

Adding OpenID Provider Authentication Policy Extension support

Step 1 : Add the servlet filter to your application

Include the following entry in the web.xml file of the application:

    <filter>
        <filter-name>TokenValidator</filter-name>
        <filter-class>org.wso2.solutions.identity.relyingparty.servletfilter.RelyingPartyFilter</filter-class>
        	<init-param>
	    	    <param-name> ................ </param-name>
		    <param-value> ............... </param-value>
  		</init-param>
		<init-param>
			......................
  		</init-param>
			......................
			......................
    </filter>
	
    <filter-mapping>
        <filter-name>TokenValidator</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

Step 2 : Add signin page

<form name="openidsignin" id="openidsignin" method="post" action="openidsubmit.jsp">
    Enter Your OpenID Url:<input type="text" name="openIdUrl"/>
    <input type="submit" name="submit" value="Login" />
</form>

As per above scenario openidsubmit.jsp page will accept the OpenID url and will do authentication using Identity Solution's relying parting components.

Step 3 : Create OpenID authentication request[openidsubmit.jsp]

// imports
<%@page import="org.wso2.solutions.identity.IdentityConstants"%>
<%@page import="org.wso2.solutions.identity.relyingparty.openid.OpenIDAuthenticationRequest"%>
<%@page import="org.wso2.solutions.identity.relyingparty.openid.OpenIDConsumer"%>
<%@page import="org.wso2.solutions.identity.relyingparty.openid.AuthPolicyType"%>
<%@page import="org.wso2.solutions.identity.relyingparty.openid.OpenIDRequestType"%>
<%@page import="org.wso2.solutions.identity.relyingparty.RelyingPartyException"%>

<%

try
{
   OpenIDAuthenticationRequest openIDAuthRequest = null;

   openIDAuthRequest = new OpenIDAuthenticationRequest(request,response);

   openIDAuthRequest.setOpenIDUrl((String)request.getParameter("openIdUrl"));

   // you need to set an absolute url as the return url.
   // once the user authenticated successfully or failed at the OpenID
   // Provider, the browser will be redirected to this url

   openIDAuthRequest.setReturnUrl("http://myapp.com/openidcallback.jsp");

   // Use PAPE
   openIDAuthRequest.addRequestType(OpenIDRequestType.PAPE);

   String phishing= "true"; //In real implementation accept this from the user : (String)request.getParameter("phishing");
   String multifactor = null;//In real implementation accept this from the user : (String)request.getParameter("multifactor");
   String multifactorphysical= null; //In real implementation accept this from the user : (String)request.getParameter("multifactorphysical");


   if (phishing!= null && phishing.equalsIgnoreCase("true")) {
	  openIDAuthRequest.addAuthPolicy(AuthPolicyType.PAPE_POLICY_PHISHING_RESISTANT);
   }

   if (multifactor!= null && multifactor.equalsIgnoreCase("true")) {
	  openIDAuthRequest.addAuthPolicy(AuthPolicyType.PAPE_POLICY_MULTI_FACTOR);
   }

   if (multifactorphysical!= null && multifactorphysical.equalsIgnoreCase("true")) {
	  openIDAuthRequest.addAuthPolicy(AuthPolicyType.PAPE_POLICY_MULTI_FACTOR_PHYSICAL);
   }

   openIDAuthRequest.setMaxAuthAge(10);


   // Performs authentication : this will redirect you to OpenID Provider for authentication
   OpenIDConsumer.getInstance().doOpenIDAuthentication(openIDAuthRequest);

}
catch(RelyingPartyException e)
{
   // handle exceptions
   out.println(e.getMessage());
}

%> 

Step 4 : Add OpenID callback page[openidcallback.jsp]

After being authenticated at the OpenID Provider, user will be redirected to this page.

// imports
<%@page import="org.wso2.solutions.identity.IdentityConstants"%>
<%@page import="org.wso2.solutions.identity.relyingparty.TokenVerifierConstants"%>
<%@page import="org.wso2.solutions.identity.openid.relyingparty.OpenIDConsumer "%>

<%

String authPolcies = null;
String authLevel = null;
String authAge = null;

String auth = (String)request.getAttribute(TokenVerifierConstants.SERVLET_ATTR_STATE);

 if(auth != null && TokenVerifierConstants.STATE_SUCCESS.equals(auth)) {

    //user authenticated successfully at his OpenID Provider
    //let me get PAPE related attributes.

    if (request.getAttribute("auth_policies") != null) {	
	 authPolcies = request.getAttribute("auth_policies");
    }
	
    if (request.getAttribute("nist_auth_level") != null) {
	  authLevel = request.getAttribute("nist_auth_level");
    }

    if (request.getAttribute("auth_age") != null) { 
	  authAge = request.getAttribute("auth_age")%>
    }
 }
 else
 {
  //user authentication failed at his OpenID Provider
 }
%> 

Step 5 : Add the following jars to your classpath

• axiom-api-1.2.4.jar
• axiom-dom-1.2.4.jar
• axiom-impl-1.2.4.jar
• wstx-asl-3.2.1.jar
• bcprov-jdk15-132.jar
• core-3.1.1.jar
• dom4j-1.6.1.jar
• opensaml-1.1.406.jar
• opensaml-2.0-rc1.jar
• openws-2.0-rc1.jar
• stax-api-1.0.1.jar
• wss4j-SNAPSHOT.jar
• xmlsec-534045-patched.jar
• wso2is-token-verifier-core-1.5.jar
• wso2is-base-1.5.jar
• openid4java-nodeps-0.9.3.1.jar
• icu4j-3.4.4.jar
• openxri-client-1.0.1.jar
• openxri-syntax-1.0.1.jar
• commons-pool-1.3.jar
• commons-dbcp-1.2.2.jar
• htmlparser-1.6.jar