Steps to configure SAML 2 on Weblogic Server 10.3.0

 

To setup SAML 2 with Weblogic 10.3.0 we need to create a security database even before creating domain.

Steps to use a pointbase database provided with Weblogic Installation :

• Copy ” pbembedded.lic ” located in ” C:\bea10.3\wlserver_10.3\common\eval\pointbase\lib ” to ” C:\bea10.3\wlserver_10.3\common\eval\pointbase\tools “
• We need to create two security database – one for the source side domain and another for the destination end domain.
• Now start the PointBase server ( run ” startPointBase.cmd ” located in ” C:\bea10.3\wlserver_10.3\common\eval\pointbase\tools “
• Start the PointBase console  ( run ” startPointBaseConsole.cmd ” located in ” C:\bea10.3\wlserver_10.3\common\eval\pointbase\tools “Login using the user name ” EXAMPLES ” and password ” EXAMPLES “, as shown below :

 

 

 

 

 

 

 

• Now lets create a database table using the sample ” rdbms_security_store_pointbase.sql ” located in ” C:\bea10.3\wlserver_10.3\server\lib “

 

 

 

 

 

 

 

 

 

 

 

 

 

• Now we need to create another database using the user name ” PUBLIC ” and password ” PUBLIC “

 

 

 

 

 

 

 

 

 

 

 

 

 

We have successfully created two security database, lets create the domains now, namely :

saml_2_source_post – Admin Server running on 7001 ( http ) and 7002 ( https )
saml_2_destination_post – Admin Server running on 7003 ( http ) and 7004 ( https )

• Run the ” Configuration Wizard ” On the ” Customize Environment and Services Settings ” screen select the option ” Yes “

 

 

 

 

 

 

 

• Select the option “I want to create, change, or remove RDBMS support” and make the changes as shown in the figure below, and also click on ” Test Connection ” button to make sure that the database is configured properly.

 

 

 

 

 

 

 

 

• Configure SSL on both the domians, below is a link which talks about configuring ” Custom Identity and Custom Trust ” :

Link : 
http://wls4mscratch.wordpress.com/2010/06/08/steps-to-configure-custom-identity-custom-trust-on-wls/

 

SAML Souce site configuration :

• We need to configure ” Credential Mapper ” on the IDP end.
• So to ” myrealm ” –> ” Providers ” –> ” Credential Mapping ” –> and add a ” SAML2CredentialMapper ” say ” SAML2_CredentialMapper ” as shown below :

 

 

 

 

 

 

 

Now click on the newly created SAML2CredentialMapper say ” SAML2_CredentialMapper ” and make the following changes :

• Issuer URI : http://www.souresite.com/saml
• Name Qualifier : sourcesite.com
• Web Service Assertion Signing Key Alias : cooldragon
• Web Service Assertion Signing Key Pass Phrase : **********
• Please type again To confirm : *********

 

 

 

 

 

 

 

 

Click on ” Servers ” –> Admin Server –> ” Federation Services ” –> ” SAML 2.0 Identity Provider ” and make the following changes :

• Enabled : check
• Only Accept Signed Authentication Request : check
• Preferred Binding : POST

 

 

 

 

 

 

 

 

 

• Click on ” Servers ” –> Admin Server –> ” Federation Services ” –> ” SAML 2.0 General ” and make the following changes :

Replicated Cache Enabled – Uncheck

Contact Person Given Name

Contact Person Surname

Contact Person Type

Contact Person Company

Contact Person Telephone Number

Contact Person Email Address

Organization Name

Organization URL

Published Site URL : http://<SourceSiteDNSName&gt;:<PORT>/saml2

Entity ID : ( Source Domain name)

Single Sign-on Signing Key Alias

Single Sign-on Signing Key Pass Phrase

Confirm Single Sign-on Signing Key Pass Phrase

 

 

 

 

 

 

 

 

 

 

 

 

 

 

• Save the changes and export the IDP metadata into a XML file –> Click on “ Publish Meta Data ” button. ( say idp_metadata.xml ). We need to copy this file to the destination domain later.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Destination Site Configuration :

 

Now we need to generate the SAML destination site ( SP ) metadata

• Click on ” myrealm ” –> ” Providers ” –> ” Authentication ” –> new ” SAML2IdentityAsserter “ say ” SAML2_IdentityAsserter :

 

 

 

 

 

Click on ” Servers ” –> Admin Server –> ” Federation Services ” –> ” SAML 2.0 Service Provider ” and make the following changes :

• Enabled : check
• Always Sign Authentication Requests : check
• Force Authentication : Check
• Preferred Binding : POST
• Default URL : http://<DestinationSiteDNSName>:<PORT>/samldest01App

 

 

 

 

 

 

 

• Now click on ” Servers ” –> Admin Server –> ” Federation Services ” –> ” SAML 2.0 General ” and make the following changes :

Replicated Cache Enabled : Uncheck

Contact Person Given Name

Contact Person Surname

Contact Person Type

Contact Person Company

Contact Person Telephone Number

Contact Person Email Address

Organization Name

Organization URL

Published Site URL : http://<DestinationSiteDNSName&gt;:<PORT>/saml2

Entity ID : ( Destination Domain name)

Single Sign-on Signing Key Alias

Single Sign-on Signing Key Pass Phrase

Confirm Single Sign-on Signing Key Pass Phrase

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

• Save the changes and export the IDP metadata into a XML file –> Click on “ Publish Meta Data ” button. ( say SP_metadata.xml ). We need to copy this file to the Source domain later.

 

 

 

 

 

 

• Copy service provider metadata ( SP_metadata.xml ) to Source Domain and identity provider metadata ( idp_metadata.xml ) to the destination Domain as shown below :

 

 

 

 

 

 

• Now configure Service Provider metadata on SAML Identity Provider in Source Site :
• Log in to the source site Admin Console and click on ” Security Realms ” –> ” myrealm ” –> ” Providers ” –> ” Credential Mapper ”  –> ” SAML2_CredentialMapper ” –> ” Management ” –> ” New ” –> ” New Web Single Sign-On Service Provider Partner ” :

• Name this ”New Web Single Sign-On Service Provider Partner” as “SAML_SSO_SP01″ and select the SP_metadata.xml file.

 

 

 

 

 

 

 

• Click on the newly created ” SAML_SSO_SP01 ” and enter the following :

Name :  SAML_SSO_SP01

Enabled :  Checked

Description  : SAML_SSO_SP01

Key Info Included  : Check

 

 

 

 

 

 

 

Click on Site info and verify the data :

 

 

 

 

 

 

 

• Now configure Identity Provider metadata on SAML Service Provider in Destination site :

Login to Destination Site Admin Console :

Click on ” Security Realms ” –> ” myrealm ” –> ” Providers ” –> ” Credential Mapper ” –> SAML2_IdentityAsserter –> ” Management ”                           –> ” New ” –> “ New Web Single Sign-On Identity Provider Partner ” say ” SAML_SSO_IDP01 ”  and then select ” idp_metadata.xml ” :

 

 

 

 

 

 

 

 

 

 

 

 

• Click on ” SAML_SSO_IDP01 ” and enter the following :

Name : SAML_SSO_IDP01

Enabled : Check

Description : SAML_SSO_IDP01

Redirect URIs : /samldest01App/restricted01/samldest01services.jsp

 

 

 

 

 

 

 

• Deploy the source and destination application
• Ufff..!! the configuration is now complete Test your SAML SSO now.

About these ads