+

Search Tips   |   Advanced Search

Configure OpenID authentication

Identity providers include sites such as, but not limited to, Google, Yahoo, Twitter, and Facebook. As an Administrator, we can select how to configure authentication to work with these identity providers.

Set the system time to match the local time.

Users can always register and log in with WebSphere Portal credentials. With the enable-identityprovider-tai task, we can choose between the following configurations:

  • Google and Yahoo use OpenID.
  • Facebook and FAce book use OAuth.

If we configure portal to use OpenID authentication with YAHOO as the identity provider, attribute exchange does not work. This limitation means that user attributes from the YAHOO OpenID account are not transferred to the portal user account.

  • Configure Facebook only, use the parameters that are designated as Facebook
  • Configure OpenID only, use the parameters that are designated as OpenID
  • Configure Facebook and OpenID, use the parameters that are designated as Facebook and OpenID


Configure OpenID authentication

  1. To configure Facebook, register the WebSphere Portal server instances as Facebook applications. Register two applications. One application is the protected path: /wps/myportal. One application is the public, unprotected path: /wps/portal.

    After registering, Facebook provides us with an application ID and an application secret. Use this information when running the enable-identityprovider-tai task.

    Your Facebook application has a private and public URL. The private URL is http://yourserver:yourport/wps/myportal/. The public URL is http://yourserver:yourport/wps/portal/.

  2. Run...

    Cluster note: Complete this step only on the primary node.

    CAUTION: If you rerun the enable-identityprovider-tai task, the task sets new properties and does not preserve the old configuration data. To keep the existing data, add the new values to the existing values before rerunning the task.

      cd WP_PROFILE\ConfigEngine
      ./ConfigEngine.sh enable-identityprovider-tai -DWasUserId=username -DWasPassword=foo

    Add the following parameters to customize the task for your business requirements:

      -Didp.providerlist

      Set the value to facebook,openid to configure both options. Set the value to facebook to configure Facebook only. Set the value to openid to configure only identity providers using the OpenID specifications. If you leave this field blank, the default value is facebook.

      -Dfacebook_apps

      Use Facebook for...

      • authentication (app)
      • self enrollment (pub)
      • both (app,pub)

      The default value is app.

      Set the value to one of the following values:

        app Configures authentication only.
        pub Configures self enrollment only.
        app,pub Configures both authentication and self enrollment.

      -Dfacebook_app_id

      To configure Facebook for authentication, set the value to yourprivatefacebookappid, received when you registered the Portal server as a private Facebook application. This value is for the private URL.

      -Dfacebook_app_secret

      To configure Facebook for authentication, set the value to yourprivatefacebookappsecret, received when you registered the Portal server as a private Facebook application. This value is for the private URL.

      -Dfacebook_app_site

      To configure Facebook for authentication, set the value to http://yourserver:yourport/wps/myportal/. This value is the URL for the private WebSphere Portal server that Facebook uses after a successful authentication. A protected area requires authentication to access and is not available to an anonymous user.

      -Dfacebook_pub_id

      To configure Facebook for self enrollment, set the value to yourpublicfacebookappid, which you received when you registered the Portal server as a Facebook application. This value is for the public URL.

      -Dfacebook_pub_secret

      To configure Facebook for self enrollment, set the value to yourpublicfacebookappsecret, received when you registered the Portal server as a Facebook application. This value is for the public URL.

      -Dfacebook_pub_site

      To configure Facebook for self enrollment, set the value to http://yourserver:yourport/wps/portal/. This value is the URL for the public WebSphere Portal server that Facebook uses after a successful authentication. A public area does not require authentication to access and is available to an anonymous user.

      -Dopenid.servicenames

      To configure identity providers using the OpenID specifications, enter a comma-separated list of the identity providers to configured; for example: Google,Yahoo.

      -Dopenid.servicenames.endpoints

      To configure identity providers using the OpenID specifications, enter a comma-separated list of OpenID endpoints (access addresses). These endpoints are for the identity providers in the openid.servicenames parameter. For example, type https://www.google.com/accounts/o8/id,https://me.yahoo.com/. There must be a one-to-one correspondence between the openid.servicenames and the openid.servicenames.endpoints parameters. If we entered three identity providers in the openid.servicenames parameter, we must enter three endpoints in the openid.servicenames.endpoints parameter and in the same sequence.

      -Dprovider.openid.nonce_valid_time

      To configure identity providers using the OpenID specifications, enter a value in seconds to protect old communications from being reused in replay attacks. If this parameter is not set, we might have nonce errors in the SystemOut.log file.

  3. Configure the Profile Management and Login portlets.

    Cluster note: Complete these steps on one node in the cluster.

    1. Log on to WebSphere Portal as the administrator.

    2. Click Administration > Portlet Management > Portlets.

    3. Locate the Login portlet and click the Configure portlet icon.

    4. Configure the Login portlet with the following parameters:

      During authentication, WebSphere Portal server retrieves attributes from the Identity Provider. Custom parameters, such as languages preferences, are not automatically retrieved. We must add these parameters to Portal. If the parameter does not exist, enter the parameter name in New Preference and the parameter value in New value. Then, click Add to add the new parameter to the Login portlet.

        show_idp_option

        Show the identity provider authentication feature on the portlet. Required. true or false

        show_idp_max

        Maximum number of identity providers shown on the portlet. Required. We define the list of providers when running the enable-identityprovider-tai task. If we defined five identity providers and want two to show on the portlet, set this parameter to 2. On the portlet, two identity providers are shown. Click More to show the complete list of identity providers.

        show_idp_freeform_field

        Use the full OpenID string and not restrict it to certain known services. If true, this option shows a free-form field on the portlet. Users can enter any OpenID identifier.

        providername.image

        Case-sensitive name of the identity provider. For example, create the parameter...

          Google.image parameter

        ...to define an image for the configured identity provider buttons. We can define whether a text button or an image is shown. Enter the URL of the identity provider image.

    5. Click OK to save your changes.

    6. Locate the Profile Management portlet and click the Configure portlet icon.

    7. Configure the Profile Management portlet with the following parameters:

      If the parameter does not exist, enter the parameter name in the New Preference field and the parameter value in the New value field. Then, click Add to add the new parameter to the Profile Management portlet.

        show_idp_option

        Show the identity provider authentication feature on the portlet. Required. true or false

        show_idp_max

        Maximum number of identity providers shown on the portlet. Required. We define the list of providers when running the enable-identityprovider-tai task. If we defined five identity providers and want two to show on the portlet, set this parameter to 2. On the portlet, two identity providers are shown. Click More to show the complete list of identity providers.

        show_idp_freeform_field

        Use the full OpenID string and not restrict it to certain known services. Required. true or false. This option shows a free-form field on the portlet. If set, users can enter any OpenID identifier.

        providername.image

        providername is the case-sensitive name of the identity provider. For example, we would create the Google.image parameter. Set this optional parameter to define an image for the configured identity provider buttons. We can define whether a text button or an image is shown. Enter the URL of the identity provider image.

        providername. required

        providername is the case-sensitive name of the identity provider service name. For example, we would create the Google. required parameter. Set this optional parameter to define the attribute mappings we want required between the identity provider and the Profile Management portlet. Enter a semicolon-separated list of attribute mapping pairs that are combined with a vertical bar (|); for example, attributename|openidattribute. Create a parameter for each supported identity provider; for example: Google. required and aol. required. Check the schema documentation of each identity provider for the supported attributes. Some mapping examples include:

          Google:

          ibm-primaryEmail|http://axschema.org/contact/email; preferredLanguage|http://axschema.org/pref/language; givenName|http://axschema.org/namePerson/first; sn|http://axschema.org/namePerson/last

          Facebook:

          ibm-primaryEmail|email; givenName|first_name; sn|last_name; uid|id; preferredLanguage|locale

        providername.optional

        providername represents the case-sensitive name of the identity provider. For example, we would create the Google.optional parameter. Set this parameter to define the attribute mappings we want optional between the identity provider and the Profile Management portlet. Enter a semicolon-separated list of attribute mapping pairs that are combined with a vertical bar (|). We can create a parameter for each supported identity provider; for example: Google.optional and aol.optional. Check the schema documentation of each identity provider for the supported attributes. Some mapping examples include:

          Google:

          ibm-primaryEmail|http://axschema.org/contact/email; preferredLanguage|http://axschema.org/pref/language; givenName|http://axschema.org/namePerson/first; sn|http://axschema.org/namePerson/last

          Facebook:

          ibm-primaryEmail|email; givenName|first_name; sn|last_name; uid|id; preferredLanguage|locale

        providername.protocol

        providername represents the case-sensitive name of the identity provider. Set this required parameter to define the Identity Provider Attribute Exchange protocol. Simple Registration (SREG) and Attribute Exchange (AX) are supported. The supported values for the parameters are openid.sreg for SREG or openid.ax for AX. Create a parameter for each supported identity provider service name; for example: Google.protocol and aol.protocol.

        facebook. required

        Set this parameter to define required attribute mappings between Facebook and the Profile Management portlet. Enter a semicolon separated list of attribute mapping pairs that are combined with a vertical bar (|).

        Some mapping examples include:

        • attributename|facebookattribute; attribute2|facebookattribute2

        The following item is a mapping example:

          uid|id;ibm-primaryEmail|email; givenName|first_name;sn|last_name; preferredLanguage|locale

    8. Click OK to save your changes.

  4. Verify the following .jar files were copied to the APPSERVER_ROOT\lib\ext directory:

    Cluster note: Complete this step on each node in the cluster.

    • PORTAL_HOME\prereqs.infra\prereq.commons.httpclient\lib\ext\commons-codec-1.6.jar

    • PORTAL_HOME\prereqs.infra\prereq.commons.httpclient\lib\ext\commons-httpclient-3.0.1.jar

  5. Add SSL certificates for the configured identity providers; some providers require multiple certificates.

    If an identity provider uses multiple server endpoints that require different SSL certificates, we might receive error message EJPAK0062E.

    Cluster note: In a clustered environment, complete these steps only on the dmgr.

    Farm note: In a farm environment, complete these steps on each server in the farm.

    1. Log on to the WAS admin console and go to...

        Security | SSL certificate and key management | Configuration settings | Manage endpoint security configurations | Outbound | hostname | nodes | node | servers | WebSphere_Portal server option | Related Items | Key stores and certificates | NodeDefaultTrustStore

      Cluster note: Click CellDefaultTrustStore instead of NodeDefaultTrustStore.

    2. Under Additional Properties, click...

        Signer certificates | Retrieve from port

    3. Enter the following information and then click Retrieve signer information:

        Host

        Enter the endpoint for the identity provider without specifying the protocol, for example, http:// or https://. Type www.google.com for Google or graph.facebook.com for Facebook.

        Port

        Enter the port number for the identity provider, for example, type 443.

        Alias

        Enter the certificate alias name, which is specified in the SSL configuration; for example type graph.facebook.com_cert for Facebook.

    4. Verify the Retrieved signer information and then click Apply.

    5. Click Save.

    6. If you receive error message EJPAK0062E, we might be missing a certificate. Open the SystemOut.log file and search for CWPKI0022E: SSL HANDSHAKE FAILURE. If this error message is present, import the certificate where the domainname is part of the SubjectDN.

  6. Stop and restart the WebSphere_Portal server:

    Cluster note: Recycle the server or cluster instance.

    1. Open a command prompt and change to the following directory:

        WP_PROFILE/bin

    2. Stop the WebSphere_Portal server, where WebSphere_Portal is the name of the WebSphere Portal server:

        ./stopServer.sh WebSphere_Portal -username admin_userid -password admin_password

    3. Start the WebSphere_Portal server, where WebSphere_Portal is the name of the WebSphere Portal server:

        ./startServer.sh WebSphere_Portal

  7. Complete the following steps in a clustered environment to configure the OpenidObjCache cache instance:

    1. Log on to the WAS admin console and go to...

        Resources | Cache instances | Object cache instances | OpenidObjCache | Consistency settings section

      ...and set the following values:

      • Select the Enable cache replication check box.

      • Select Both Push and Pull for the Replication type.

    2. Click OK.

    3. Click Save.

    4. Stop and restart the cluster servers to propagate the changes.

  8. Optional: Depending on the security settings for the identity providers, modify attributes for your identity provider trust association.

    Modify the trust association:

    Cluster note: Complete these steps on one node in the cluster.

    1. Log on to the WAS admin console and go to...

        Security | Global security | Web and SIP security | Trust association | Interceptors | com.ibm.portal.auth.OpenIDTAI

    2. Add or modify properties to change the default behavior. For example, we can add or modify the following properties:

        bindattribute

        This property stores the user profile attribute containing the identity provider user ID. The default value is labeledURI.

        loginattribute

        This property defines the attribute retrieved from the repository that uniquely identifies the user. The default value is uid.


Results

New users can register a new WebSphere Portal profile with a valid identity provider specified in labeledURI. Existing users can update their profile with a valid identity provider specified in labeledURI. To support the profile update, a writable user repository must exist. They can then log on to WebSphere Portal with the alternative login field. They are redirected to the identity provider login page.


Parent Integrate with OpenID authentication


Related information


Response Format
Federated Login for Google Account Users
User