[prev in list] [next in list] [prev in thread] [next in thread]
List: wsas-java-dev
Subject: Re: [Dev] SSO Configuration
From: "Vazquez-Hidalgo, Javier" <Javier.Vazquez-Hidalgo () tdsecurities ! com>
Date: 2017-05-26 15:28:54
Message-ID: 4006b394f62c4a1bb68b15886fd7d217 () BLUPR27MB0067 ! 066d ! mgd ! msft ! net
[Download RAW message or body]
[Attachment #2 (multipart/alternative)]
[Attachment #4 (text/plain)]
Hi Abimaran,
I was able to get SSO working. It turns out I didn't have the default keystore, once \
I replaced it with the original one things worked.
Thanks for your help.
Regards,
Javier
From: Dev [mailto:dev-bounces@wso2.org] On Behalf Of Vazquez-Hidalgo, Javier
Sent: Friday, May 26, 2017 8:45 AM
To: Abimaran Kugathasan
Cc: dev@wso2.org
Subject: Re: [Dev] SSO Configuration
Hi Abimaran,
I am using the default keystore on both servers.
I don't think I have enabled signature verification on IDP and SP, do I have to?, if \
so, how do I do it? Docs don't seem to have that step.
Javier
From: Abimaran Kugathasan [mailto:abimaran@wso2.com]
Sent: Friday, May 26, 2017 12:21 AM
To: Vazquez-Hidalgo, Javier
Cc: dev@wso2.org<mailto:dev@wso2.org>
Subject: Re: [Dev] SSO Configuration
Hi Javier,
Have you enabled signature verification in both IDP and SP? Also, Are you using the \
default keystore in both servers?
On Fri, May 26, 2017 at 5:28 AM, Vazquez-Hidalgo, Javier \
<Javier.Vazquez-Hidalgo@tdsecurities.com<mailto:Javier.Vazquez-Hidalgo@tdsecurities.com>> \
wrote: Hello,
I'm trying to configure APIM store/publisher/carbon sites to use SSO by following the \
steps provided at
https://docs.wso2.com/display/AM210/Configuring+API+Manager+for+SSO
https://docs.wso2.com/display/AM210/Configuring+Identity+Server+as+IDP+for+SSO
Identity Server is acting as the SSO IDP.
The problem is that I'm getting signature verification failed on all sites. I see the \
redirection happening and in the carbon site I get the login screen but it fails to \
authenticate the user
Logs when trying to login to "carbon" site:
[2017-05-25 19:48:58,727] ERROR - SAML2SSOAuthenticator Authentication Request is \
rejected. Signature validation failed. [2017-05-25 19:48:58,730] WARN - \
CarbonAuthenticationUtil Failed Administrator login attempt 'admin[-1234]' at \
[2017-05-25 19:48:58,730-0400] [2017-05-25 19:48:58,734] ERROR - \
SAML2SSOUIAuthenticator Authentication failed.
Logs when trying to login to "publisher" site:
[2017-05-25 19:49:43,724] ERROR - jaggery_acs:jag SAML response signature is \
verification failed.
Any ideas?
Thanks,
Javier
If you wish to unsubscribe from receiving commercial electronic messages from TD Bank \
Group, please click here<http://www.td.com/tdoptout> or go to the following web \
address: www.td.com/tdoptout<http://www.td.com/tdoptout> Si vous souhaitez vous \
désabonner des messages électroniques de nature commerciale envoyés par Groupe \
Banque TD veuillez cliquer ici<http://www.td.com/tddesab> ou vous rendre à l'adresse \
www.td.com/tddesab<http://www.td.com/tddesab>
NOTICE: Confidential message which may be privileged. Unauthorized use/disclosure \
prohibited. If received in error, please go to \
www.td.com/legal<http://www.td.com/legal> for instructions. AVIS : Message \
confidentiel dont le contenu peut être privilégié. Utilisation/divulgation \
interdites sans permission. Si reçu par erreur, prière d'aller au \
www.td.com/francais/avis_juridique<http://www.td.com/francais/avis_juridique> pour \
des instructions.
_______________________________________________
Dev mailing list
Dev@wso2.org<mailto:Dev@wso2.org>
http://wso2.org/cgi-bin/mailman/listinfo/dev
--
Thanks
Abimaran Kugathasan
Senior Software Engineer - API Technologies
Email : abimaran@wso2.com<mailto:abimaran@wso2.com>
Mobile : +94 773922820
[Image removed by sender.]<http://stackoverflow.com/users/515034> [Image removed by \
sender.] <http://lk.linkedin.com/in/abimaran> [Image removed by sender.] \
<http://www.lkabimaran.blogspot.com/> [Image removed by sender.] \
<https://github.com/abimarank> [Image removed by sender.] \
<https://twitter.com/abimaran>
[Attachment #5 (text/html)]
<html xmlns:v="urn:schemas-microsoft-com:vml" \
xmlns:o="urn:schemas-microsoft-com:office:office" \
xmlns:w="urn:schemas-microsoft-com:office:word" \
xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" \
xmlns="http://www.w3.org/TR/REC-html40"> <head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"Comic Sans MS";
panose-1:3 15 7 2 3 3 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span \
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Hi \
Abimaran,<o:p></o:p></span></p> <p class="MsoNormal"><span \
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span \
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I \
was able to get SSO working. It turns out I didn't have the default keystore, once I \
replaced it with the original one things worked. <o:p></o:p></span></p>
<p class="MsoNormal"><span \
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span \
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Thanks \
for your help.<o:p></o:p></span></p> <p class="MsoNormal"><span \
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span \
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span \
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Javier<o:p></o:p></span></p>
<p class="MsoNormal"><span \
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span \
style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span \
style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Dev \
[mailto:dev-bounces@wso2.org] <b>On Behalf Of </b>Vazquez-Hidalgo, Javier<br>
<b>Sent:</b> Friday, May 26, 2017 8:45 AM<br>
<b>To:</b> Abimaran Kugathasan<br>
<b>Cc:</b> dev@wso2.org<br>
<b>Subject:</b> Re: [Dev] SSO Configuration<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span \
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Hi \
Abimaran,<o:p></o:p></span></p> <p class="MsoNormal"><span \
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span \
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I \
am using the default keystore on both servers.<o:p></o:p></span></p> <p \
class="MsoNormal"><span \
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span \
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I \
don't think I have enabled signature verification on IDP and SP, do I have to?, if \
so, how do I do it? Docs don't seem to have that step.<o:p></o:p></span></p> <p \
class="MsoNormal"><span \
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span \
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span \
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Javier<o:p></o:p></span></p>
<p class="MsoNormal"><span \
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span \
style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span \
style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> \
Abimaran Kugathasan [<a href="mailto:abimaran@wso2.com">mailto:abimaran@wso2.com</a>] \
<br> <b>Sent:</b> Friday, May 26, 2017 12:21 AM<br>
<b>To:</b> Vazquez-Hidalgo, Javier<br>
<b>Cc:</b> <a href="mailto:dev@wso2.org">dev@wso2.org</a><br>
<b>Subject:</b> Re: [Dev] SSO Configuration<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Hi Javier,<br>
<br>
Have you enabled signature verification in both IDP and SP? Also, Are you using the \
default keystore in both servers?<o:p></o:p></p> </div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Fri, May 26, 2017 at 5:28 AM, Vazquez-Hidalgo, Javier <<a \
href="mailto:Javier.Vazquez-Hidalgo@tdsecurities.com" \
target="_blank">Javier.Vazquez-Hidalgo@tdsecurities.com</a>> wrote:<o:p></o:p></p> \
<div> <div>
<p class="MsoNormal" \
style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Hello,<o:p></o:p></p> <p \
class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">I'm \
trying to configure APIM store/publisher/carbon sites to use SSO by following the \
steps provided at <o:p></o:p></p>
<p class="MsoNormal" \
style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p> <p \
class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><a \
href="https://docs.wso2.com/display/AM210/Configuring+API+Manager+for+SSO" \
target="_blank">https://docs.wso2.com/display/AM210/Configuring+API+Manager+for+SSO</a><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><a \
href="https://docs.wso2.com/display/AM210/Configuring+Identity+Server+as+IDP+for+SSO" \
target="_blank">https://docs.wso2.com/display/AM210/Configuring+Identity+Server+as+IDP+for+SSO</a><o:p></o:p></p>
<p class="MsoNormal" \
style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p> <p \
class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Identity \
Server is acting as the SSO IDP. <o:p></o:p></p>
<p class="MsoNormal" \
style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p> <p \
class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">The \
problem is that I'm getting signature verification failed on all sites. I see the \
redirection happening and in the carbon site I get the login screen but it fails to \
authenticate the user<o:p></o:p></p>
<p class="MsoNormal" \
style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p> <p \
class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Logs \
when trying to login to "carbon" site:<o:p></o:p></p> <p class="MsoNormal" \
style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">[2017-05-25 19:48:58,727] \
ERROR - SAML2SSOAuthenticator Authentication Request is rejected. Signature \
validation failed.<o:p></o:p></p> <p class="MsoNormal" \
style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">[2017-05-25 \
19:48:58,730] WARN - CarbonAuthenticationUtil Failed Administrator login \
attempt 'admin[-1234]' at [2017-05-25 19:48:58,730-0400]<o:p></o:p></p> <p \
class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">[2017-05-25 \
19:48:58,734] ERROR - SAML2SSOUIAuthenticator Authentication failed.<o:p></o:p></p> \
<p class="MsoNormal" \
style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p> <p \
class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Logs \
when trying to login to "publisher" site:<o:p></o:p></p> <p class="MsoNormal" \
style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">[2017-05-25 19:49:43,724] \
ERROR - jaggery_acs:jag SAML response signature is verification \
failed.<o:p></o:p></p> <p class="MsoNormal" \
style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p> <p \
class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" \
style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p> <p \
class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Any \
ideas?<o:p></o:p></p> <p class="MsoNormal" \
style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p> <p \
class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" \
style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Thanks,<o:p></o:p></p> <p \
class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Javier<o:p></o:p></p>
<p class="MsoNormal" \
style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p> \
</div> <p><span style="font-size:8.0pt;font-family:"Arial","sans-serif""><br>
<br>
If you wish to unsubscribe from receiving commercial electronic messages from TD Bank \
Group, please click <a href="http://www.td.com/tdoptout" target="_blank">here</a> or \
go to the following web address: <a href="http://www.td.com/tdoptout" \
target="_blank">www.td.com/tdoptout</a><br> Si vous souhaitez vous désabonner des \
messages électroniques de nature commerciale envoyés par Groupe Banque TD veuillez \
cliquer <a href="http://www.td.com/tddesab" target="_blank">ici</a> ou vous rendre à \
l'adresse <a href="http://www.td.com/tddesab" target="_blank">www.td.com/tddesab</a> \
</span> <o:p></o:p></p>
<p><span style="font-size:8.0pt;font-family:"Arial","sans-serif""><br>
NOTICE: Confidential message which may be privileged. Unauthorized use/disclosure \
prohibited. If received in error, please go to <a href="http://www.td.com/legal" \
target="_blank">www.td.com/legal</a> for instructions.<br> AVIS : Message \
confidentiel dont le contenu peut être privilégié. Utilisation/divulgation \
interdites sans permission. Si reçu par erreur, prière d'aller au <a \
href="http://www.td.com/francais/avis_juridique" \
target="_blank">www.td.com/francais/avis_juridique</a> pour des \
instructions.</span><o:p></o:p></p> </div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
_______________________________________________<br>
Dev mailing list<br>
<a href="mailto:Dev@wso2.org">Dev@wso2.org</a><br>
<a href="http://wso2.org/cgi-bin/mailman/listinfo/dev" \
target="_blank">http://wso2.org/cgi-bin/mailman/listinfo/dev</a><o:p></o:p></p> \
</div> <p class="MsoNormal"><br>
<br clear="all">
<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">-- <o:p></o:p></p>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal">Thanks<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Abimaran Kugathasan<o:p></o:p></p>
</div>
<p class="MsoNormal">Senior Software Engineer - API Technologies<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Email : <a href="mailto:abimaran@wso2.com" \
target="_blank">abimaran@wso2.com</a><o:p></o:p></p> </div>
<div>
<p class="MsoNormal"><span style="font-family:"Comic Sans MS"">Mobile : \
+94 773922820</span><o:p></o:p></p> </div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="http://stackoverflow.com/users/515034" \
target="_blank"><span style="border:solid windowtext \
1.0pt;padding:0in;text-decoration:none"><img border="0" width="100" height="100" \
id="_x0000_i1025" src="cid:image001.jpg@01D2D613.41225F20" alt="Image removed by \
sender."></span></a> <a href="http://lk.linkedin.com/in/abimaran" \
target="_blank"><span style="border:solid windowtext \
1.0pt;padding:0in;text-decoration:none"><img border="0" width="100" height="100" \
id="_x0000_i1026" src="cid:image001.jpg@01D2D613.41225F20" alt="Image removed by \
sender."></span></a> <a href="http://www.lkabimaran.blogspot.com/" \
target="_blank"><span style="border:solid windowtext \
1.0pt;padding:0in;text-decoration:none"><img border="0" width="100" height="100" \
id="_x0000_i1027" src="cid:image001.jpg@01D2D613.41225F20" alt="Image removed by \
sender."></span></a> <a href="https://github.com/abimarank" \
target="_blank"><span style="border:solid windowtext \
1.0pt;padding:0in;text-decoration:none"><img border="0" width="100" height="100" \
id="_x0000_i1028" src="cid:image001.jpg@01D2D613.41225F20" alt="Image removed by \
sender."></span></a> <a href="https://twitter.com/abimaran" \
target="_blank"><span style="border:solid windowtext \
1.0pt;padding:0in;text-decoration:none"><img border="0" width="100" height="100" \
id="_x0000_i1029" src="cid:image001.jpg@01D2D613.41225F20" alt="Image removed by \
sender."></span></a><o:p></o:p></p> </div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>
["image001.jpg" (image/jpeg)]
_______________________________________________
Dev mailing list
Dev@wso2.org
http://wso2.org/cgi-bin/mailman/listinfo/dev
--===============4306448823723914090==--
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic