0

I am using WSO2 Identity Server as the identity provider for our websites. The websites are being developed in ASP.net and we are using in-built Owin-Katana framework along with Oauth 2 to authenticate users. I could access SCIM REST Api's to create new users and their claims into WSO2. The claims were added under the dialect "urn:scim:schemas:core:1.0". I need to retrieve those claims while authenticating the user via Oauth 2. The service provider setup doesn't allow me to select claims from the dialect "urn:scim:schemas:core:1.0".

Is there an way I can retrieve the claims I have added to the user? The answer here suggest that we install an upgraded version of WSO2. Is that the only solution?

My Owin setup is (using NuGet package Owin.Security.Providers.WSO2):

app.UseWSO2Authentication(new WSO2AuthenticationOptions()
{
    BaseUrl = "https://identityserver:9443/",                
    CallbackPath = new PathString("/Account/ExternalLoginConfirmation"),
    ClientId = "xxxxxxxxx",
    ClientSecret = "yyyyyyyyy"
});

2 Answers 2

0

You can retrieve a user's claims via the SCIM API.

Example of a get request :

curl -X GET -H "Authorization: Basic (base64 adminUsername:adminPassword)" "https://ishost:ismgtport/wso2/scim/Users?filter=userNameEquserstoredomain/userId"

{
  "schemas": [
    "urn:scim:schemas:core:1.0",
    "urn:scim:schemas:extension:wso2:1.0"
  ],
  "totalResults": 1,
  "Resources": [
    {
      "wso2Extension": {
        "nodeId": "2800",
        "employeeNumber": "TEST01"
      },
      "id": "e8a1791f-af81-4d61-ad33-51fd80c4d716",
      "roles": [
        "STORE_MANAGER"
      ],
      "name": {
        "familyName": "Manager",
        "givenName": "Mr"
      },
      "userName": "userstoredomain/userId",
      "phoneNumbers": [
        "0000000000"
      ],
      "externalId": "1_TEST01",
      "meta": {
        "lastModified": "2017-03-27T14:33:05",
        "created": "2017-03-27T14:33:05",
        "location": "https://localhost:9443/wso2/scim/Users/e8a1791f-af81-4d61-ad33-51fd80c4d716"
      }
    }
  ]
}

https://docs.wso2.com/display/IS510/SCIM+APIs

The above example is retrieved via version 5.0.0

1
  • Yes, I can do and it will be my last resort. But I want to use OAuth2 protocol and get claims as a part of authenticated result.
    – TejSoft
    Mar 30, 2017 at 0:48
0

As point 1 says in this link you need to pick claims that have a mapping between the "http://wso2.org/oidc/claim" dialect to "http://wso2.org/claims" dialect.

Mapping is checked from Mapped Attribute value of each claim. Say Email claim in http://wso2.org/oidc/claim dialect and Email claim in http://wso2.org/claims dialect has the Mapped attribute as mail, try mapping the mail attribute to the required claim in urn:scim:schemas:core:1.0 dialect. When requesting claims in the service provider, request the claim in http://wso2.org/oidc/claim dialect which has the Mapped Attribute value to your claim.

Hope this would help.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.