Easy Step: Other

Showing posts with label Other. Show all posts

Thursday, March 21, 2013

Website hacking XSS attack

[youtube=http://youtu.be/q_a39I82hqk]

[youtube=http://youtu.be/5F1omU4bo4g]

Thursday, March 7, 2013

Most of the people cannot find the way to connect to the Cassandra DB process through the JConsole. Let me explain how to do in simple way.

1. First you have to download the Cassandra DB and do the following changes on $Cassandra_Home/conf/cassandra-env.sh

JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.ssl=false"
JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.authenticate=false"
JVM_OPTS="$JVM_OPTS -Djava.rmi.server.hostname=ec2-54-242-183-160.compute-1.amazonaws.com"

2. Now Start the Cassandra DB now you can connect to the Cassandra Process through the JConsole.

URL - service:jmx:rmi:///jndi/rmi://:7199/jmxrmi
ex/ service:jmx:rmi:///jndi/rmi://ec2-54-242-183-160.compute-1.amazonaws.com:7199/jmxrmi

You don't need to put Username and Password to connect.

Monday, March 4, 2013

How to attach JProfiler with WSO2 Products

JProfiler is very useful software for developers to monitor the memory usage, CPU usage, etc. of Java program. With in this post I'll explain how to attached the JProfiler to the Carbon products. I'll take latest Identity server 4.1.0 version as a Carbon product.

1. First thing is you need to download the JProfiler and install in to your machine. I have downloaded the JProfiler and installed in the following location.
[sourcecode language="xml"]
/home/dinuka/jprofiler7/
[/sourcecode]

2. Then you have to put the following line into the wso2server.sh file located at $IS_HOME/repository/bin/
[sourcecode language="xml"]
-agentpath:/home/dinuka/jprofiler7/bin/linux-x64/libjprofilerti.so=port=8849 \
[/sourcecode]

3.Now go to $IS_HOME/repository/bin and start the wso2server.sh

You can see Its waiting for connection from JProfiler.

4. Go to the location of JProfiler "/home/dinuka/jprofiler7/bin" and run the "jprofiler" file to start the JProfiler

Now go to Session->Start Center and select the tab "New Session" then click New Session

Select "Attach to Profiled JVM (local or remote)" and fill the details of Identity Server then click ok

5. You can select one of the following categories (Instrumentation or Sampling)

Then you can see Identity Server is Starting up.

Now JProfiler is connected Successfully

Cassandra DB as Secondary user store in IS

The Apache Cassandra database is the right choice when you need scalability and high availability without compromising performance. So now the Cassandra User Store manager is available in IS from 4.1.0 release and we support the multiple credentials with Cassandra DB.

What is multiple credential support? see the following picture you can take some idea about this.

Lets look at the configuration of Cassandra user as a secondary user store.

1. Extract the Cassandra DB and edit the following file $Cassandra_Home/conf/cassandra.yaml
Replace the following values with existing directory

data_file_directories: /home/dinuka/cassandra/data
commitlog_directory: /home/dinuka/cassandra/commitlog
saved_caches_directory: /var/lib/cassandra/saved_caches

2. Go to $Cassandra_Home/bin and run the cassandra file to start the Cassandra DB

3. Go to $IS_HOME/repository/conf/carbon.xml and do the following changes.
Enable HTTP transport for All Admin Services
i. Please uncomment following element
[sourcecode language="xml"]<HttpAdminServices>*</HttpAdminServices>[/sourcecode]
Enable Email usernames support
i. Please uncomment following element
[sourcecode language="xml"]<EnableEmailUserName>true</EnableEmailUserName>[/sourcecode]

4. Now you need to go to $IS_HOME/repository/conf/user-mgt.xml and do the configuration as follows. I'm running IS and Cassandra both in Same machine.

[sourcecode language="xml"]
<UserStoreManager class="org.wso2.carbon.user.core.ldap.ReadWriteLDAPUserStoreManager">
<Property name="defaultRealmName">WSO2.ORG</Property>
<Property name="kdcEnabled">false</Property>
<Property name="ConnectionURL">ldap://localhost:${Ports.EmbeddedLDAP.LDAPServerPort}</Property>
<Property name="ConnectionName">uid=admin,ou=system</Property>
<Property name="ConnectionPassword">admin</Property>
<Property name="passwordHashMethod">SHA</Property>
<Property name="UserNameListFilter">(objectClass=person)</Property>
<Property name="UserEntryObjectClass">identityPerson</Property>
<Property name="UserSearchBase">ou=Users,dc=wso2,dc=org</Property>
<Property name="UserNameSearchFilter">(&(objectClass=person)(uid=?))</Property>
<Property name="UserNameAttribute">uid</Property>
<Property name="PasswordJavaScriptRegEx">^[\\S]{5,30}$</Property>
<Property name="ServicePasswordJavaRegEx">^[\\S]{5,30}$</Property>
<Property name="ServiceNameJavaRegEx">^[\\S]{2,30}/[\\S]{2,30}$</Property>
<Property name="UsernameJavaScriptRegEx">^[\\S]{3,30}$</Property>
<Property name="UsernameJavaRegEx">[a-zA-Z0-9._-|//]{3,30}$</Property>
<Property name="RolenameJavaScriptRegEx">^[\\S]{3,30}$</Property>
<Property name="RolenameJavaRegEx">[a-zA-Z0-9._-|//]{3,30}$</Property>
<Property name="ReadLDAPGroups">true</Property>
<Property name="WriteLDAPGroups">true</Property>
<Property name="EmptyRolesAllowed">true</Property>
<Property name="GroupSearchBase">ou=Groups,dc=wso2,dc=org</Property>
<Property name="GroupNameListFilter">(objectClass=groupOfNames)</Property>
<Property name="GroupEntryObjectClass">groupOfNames</Property>
<Property name="GroupNameSearchFilter">(&(objectClass=groupOfNames)(cn=?))</Property>
<Property name="GroupNameAttribute">cn</Property>
<Property name="MembershipAttribute">member</Property>
<Property name="UserRolesCacheEnabled">true</Property>
<Property name="UserDNPattern">uid={0},ou=Users,dc=wso2,dc=org</Property>
<Property name="SCIMEnabled">true</Property>
<Property name="maxFailedLoginAttempt">0</Property>
</UserStoreManager>

<UserStoreManager class="org.wso2.carbon.user.cassandra.CassandraUserStoreManager">
<Property name="Keyspace">User_KS</Property>
<Property name="Host">localhost</Property>
<Property name="Port">9160</Property>
<Property name="PasswordDigest">SHA-256</Property>
<Property name="StoreSaltedPassword">true</Property>
<Property name="AuthenticateWithAnyCredential">true</Property>
<Property name="DomainName">multipleCredentialUserStoreDomain</Property>
<MultipleCredentials>
<Credential type="Default">org.wso2.carbon.user.cassandra.credentialtypes.EmailCredential</Credential>
<Credential type="Email">org.wso2.carbon.user.cassandra.credentialtypes.EmailCredential</Credential>
<Credential type="PhoneNumber">org.wso2.carbon.user.cassandra.credentialtypes.PhoneNumberCredential</Credential>
<Credential type="Device">org.wso2.carbon.user.cassandra.credentialtypes.DeviceCredential</Credential>
<Credential type="External">org.wso2.carbon.user.cassandra.credentialtypes.ExternalProviderCredential</Credential>
</MultipleCredentials>
</UserStoreManager>
[/sourcecode]

5. Now you successfully done the configuration for secondary user store. for more details follow this configuration doc.

6. You can use the MultipleCredentialsUserAdmin service and write your own Java client to talk to IS and authenticate the users. IS 4.1.0 doesn't support the UI functionality but it will be available with future releases.

7. I have created some Jmeter client to talk to IS to authenticate the users with multiple credentials.you can download it here.

Wednesday, February 13, 2013

WSO2 Identity Server Clustering with WSO2 Elastic Load Balancer

Wso2 IS is most useful product in the world, so many people are using this to achieve their day to day security operations. So once we go to the hi available and high scalable system we need have multiple IS instances. So I'm going to explain how to make the IS cluster with two nodes.

First of all we need know about the high level scenarios so lets look at following diagram.

There is two proxy ports in LB to communicate the different transports According to the above diagram so we need to do this mapping in the IS nodes.
Here we are using one of clustering mechanism call "Well-Known Address based multicasting"

Lets look at the LB configuration

1. By default it has two proxy ports exposed for http(8290) and https(8243) in $WSO2_ELB/repository/conf/axis2/axis2.xml
[sourcecode language="xml"]




<transportReceiver name="http" class="org.apache.synapse.transport.passthru.PassThroughHttpListener">
<parameter name="port">8290</parameter>
<parameter name="non-blocking"> true</parameter>
<parameter name="httpGetProcessor" locked="false">org.wso2.carbon.transport.nhttp.api.PassThroughNHttpGetProcessor</parameter>
</transportReceiver>
<transportReceiver name="https" class="org.apache.synapse.transport.passthru.PassThroughHttpSSLListener">
<parameter name="port" locked="false">8243</parameter>
<parameter name="non-blocking" locked="false">true</parameter>
<parameter name="httpGetProcessor" locked="false">org.wso2.carbon.transport.nhttp.api.PassThroughNHttpGetProcessor</parameter>


<parameter name="keystore" locked="false">
<KeyStore>
<Location>repository/resources/security/wso2carbon.jks</Location>
<Type>JKS</Type>
<Password>wso2carbon</Password>
<KeyPassword>wso2carbon</KeyPassword>
</KeyStore>
</parameter>
<parameter name="truststore" locked="false">
<TrustStore>
<Location>repository/resources/security/client-truststore.jks</Location>
<Type>JKS</Type>
<Password>wso2carbon</Password>
</TrustStore>
</parameter>

</transportReceiver>
[/sourcecode]

2. You have to go to $WSO2_ELB/repository/conf/loadbalancer.conf and define the cluster details as follows.
[sourcecode language="xml"]
identity {
hosts is.cloud.wso2.com;
domains {
wso2.is.domain {
tenant_range *;
}
}
}
[/sourcecode]

3. Now you can put the entry into the hosts file in linux to map the "is.cloud.wso2.com" and your IP

4. Start the load balancer.

5. Now go to IS node 1 and do the following configuration on $WSO2_IS_node/repository/conf/axis2/axis2.xml
* first you have to enable the clustering in node 1.
[sourcecode language="xml"]
<clustering class="org.apache.axis2.clustering.tribes.TribesClusteringAgent" enable="true">
[/sourcecode]
* put membership schema as "wka"
[sourcecode language="xml"]
<parameter name="membershipScheme">wka</parameter>
[/sourcecode]
* Domain specification
[sourcecode language="xml"]
<parameter name="domain">wso2.is.domain</parameter>
[/sourcecode]
* Local member port - this should be unique for each node. Local member port in ELB is 4000 by default
[sourcecode language="xml"]
<parameter name="localMemberPort">4100</parameter>
[/sourcecode]
* You have to define the well known member as well.
[sourcecode language="xml"]
<members>
<member>
<hostName>is.cloud.wso2.com</hostName>
<port>4000</port>
</member>
</members>
[/sourcecode]
* You have to map the http and https to the ELB proxy ports.
[sourcecode language="xml"]



<transportReceiver name="http"
class="org.wso2.carbon.core.transports.http.HttpTransportListener">

<parameter name="port">9763</parameter>


<parameter name="proxyPort">8290</parameter>
</transportReceiver>

<transportReceiver name="https"
class="org.wso2.carbon.core.transports.http.HttpsTransportListener">

<parameter name="port">9443</parameter>


<parameter name="proxyPort">8243</parameter>
</transportReceiver>
[/sourcecode]

* Put the offset as 5 in $WSO2_IS_node/repository/conf/carbon.xml and start the IS node 1
[sourcecode language="xml"]
<Offset>5</Offset>
[/sourcecode]

In ELB side you can see this

Same as you have to do the configuration in IS node 2 download the axis2.xml here for node 2

6. Now you can start the identity server node 2

7. Then you can access the Identity server through the "https://is.cloud.wso2.com:8243/carbon/admin/login.jsp"

Authentication and Authorization with WSO2ESB and WSO2IS

This is very impotent post because I'm going to discuss how to secure the proxy service with Username Token as well as Authorization with XACML policies.

For Authorization we are using the WSO2 Identity server and Inbuilt Entitlement mediator in WSO2 ESB.

You can see the high level view of the ESB and IS communication. Let me explain the scenario.

1. User going to access the proxy service with the user credentials.
2. ESB authenticate the user first
3. If the authentication pass then go to Identity Server through the Entitlement Mediator and call the get decision method with above credentials
4. Identity Server will look the XACML policies and return the decision.
5. If decision is "Permit" then proxy service allow to access the echo service
6. If decision is "Deny" or "Not applicable" proxy service not allow to access the echo service.

Lets look at the configuration of this setup. We are using ESB-4.6.0 and IS-4.1.0

1. You have to share the same User store with WSO2ESB and WSO2IS
refer the ESB user-mgt.xml and IS user-mgt.xml - this is done for Embedded LDAP coming with WSO2IS but you can configure any DB as your user store and share with both ESB and IS

2. Start the IS first and then ESB with port offset 1
3. Create "In sequence" in ESB
here you need to add the entitlement mediator as a first child of In Sequence

Select the entitlement and set the entitlement server url, username and password.
entitlement server url = https://localhost:9443/services/
username = admin
password = admin

Set the Fault mediators under OnReject as well as set the Send mediator under OnAccept

Set the Header mediator as follows and remove the security headers.

Click on the Namespaces and put the following entry.
Prefix - wsse
URI - http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd

3. Create "Out sequence" in ESB
just put send and log mediators as follows

4. Now we need create the proxy service for echo service already in WSO2ESB
Add new proxy -> custom proxy then you can see the following window and you have to specify the following details.
Name - EchoProxy
Publishing WSDL - Specify source URI
then put the wsdl of the echo service as "http://localhost:8281/services/echo?wsdl"

Move next and select the "InSequence" that we created before.

Move next again and select the "OutSequence" as well.

finally click the finish
Now you have to create the new role "testRole" with admin permission and new user "testuser" with password "testuser" and assign the "testRole" because we are using this to control the access . then secure the created proxy with Username Token as follows

Now you complete the proxy service creation and lets move to Identity server configurations.

5. In Identity server we need to add the XACML Policy
Here I'm going to create the simple User base XACML policy.

Name - EchoServicePolicy
Specify the Role name as "testRole" as well as you have to specify the action as "read" because our Entitlement mediator send the action string as "read"

Finish the policy and enable the policy to test.

Now you can evaluate the policy through the Tryit.

But if you click on the "Evaluate with PDP" you will not get Premit because still you not promote the XACML policy to the PDP.

to promote XACML policy to the PDP you can click on the button in front of the policy "sync with PDP". Now try to "Evaluate with PDP".

Now we done the configuration on Identity Server.

6. Go to ESB and select the EchoProxy service and go to TryIt.

Here we are using "testuser" which is under the role "testRole" so the XACML engine will permit to access the resource

Now go and remove the "testRole" form user "testuser" and try to access the service. Now you can see XACML engine is not permit to user to access the resource.

Saturday, January 19, 2013

Legacy systems as Services

Lets look at simple example.

Following organization using different systems to achieve their day to day operations (ex- Inventory controlling , HR management , Sales monitoring ..etc). By the time this organization reach the huge market and operating as a large company.

Inventory controlling , HR management , Sales monitoring all those systems are independently operating. When the company need to use some of the data with in the two different system it will not possible with above existing system because those are tightly coupled.

Lets look at following system,

The same system once expose with defined interface to communicate with each other then the above three components act as services. Services may also be wrappers for existing Legacy systems to achieve the organization expectation.

With in the Organization system follows the global standard interface to communicate to each other then the system can expose to the out side world as well then it will improve the interoperability among organizations.

Friday, January 11, 2013

Multiple User Stores configuration in WSO2 Identity Server

You know wso2 products are very smart and customizable products. Here I'm going to explain one of another smart features came up with wso2 products. As a example will take WSO2 Identity server as a product.

Lets look at one of simple business scenarios.

1. I need connect multiple user stores.
ex/ different domain users in different databases to one single product.
2. All users can access same wso2 product (IS).

First of all we need to do some configuration in Identity Server. Refer this post for additional information about data base configuration with wso2 products.

You have to create two databases in Mysql as FOO and BAR with database table structure. You can simply do this as follows.
Go to mysql command line and create two databases.
[sourcecode language="sql"]
mysql > create database FOO;
mysql > create database BAR;
[/sourcecode]

Go to command line and run the following commands to create the table structure.
[sourcecode language="bash"]
> mysql -u username -p FOO < $IS_HOME/dbscripts/mysql.sql
[/sourcecode]

[sourcecode language="bash"]
> mysql -u username -p BAR < $IS_HOME/dbscripts/mysql.sql
[/sourcecode]

Now we created databases properly.

1. master-datasource.xml - we have to configure three data sources for H2, FOO, BAR databases.

[sourcecode language="xml"]
<datasources>
<datasource>
<name>WSO2_CARBON_DB</name>
<description>The datasource used for registry and user manager</description>
<jndiConfig>
<name>jdbc/WSO2CarbonDB</name>
</jndiConfig>
<definition type="RDBMS">
<configuration>
<url>jdbc:h2:repository/database/WSO2CARBON_DB;DB_CLOSE_ON_EXIT=FALSE;LOCK_TIMEOUT=60000</url>
<username>wso2carbon</username>
<password>wso2carbon</password>
<driverClassName>org.h2.Driver</driverClassName>
<maxActive>50</maxActive>
<maxWait>60000</maxWait>
<testOnBorrow>true</testOnBorrow>
<validationQuery>SELECT 1</validationQuery>
<validationInterval>30000</validationInterval>
</configuration>
</definition>
</datasource>

<datasource>
<name>WSO2_MySQL_FOO_DB</name>
<description>The datasource used for user manager bar.com</description>
<jndiConfig>
<name>jdbc/WSO2MySqlFooDB</name>
</jndiConfig>
<definition type="RDBMS">
<configuration>
<url>jdbc:mysql://localhost:3306/FOO</url>
<username>root</username>
<password>root</password>
<driverClassName>com.mysql.jdbc.Driver</driverClassName>
<maxActive>50</maxActive>
<maxWait>60000</maxWait>
<testOnBorrow>true</testOnBorrow>
<validationQuery>SELECT 1</validationQuery>
<validationInterval>30000</validationInterval>
</configuration>
</definition>
</datasource>

<datasource>
<name>WSO2_MySQL_BAR_DB</name>
<description>The datasource used for user manager bar.com</description>
<jndiConfig>
<name>jdbc/WSO2MySqlBarDB</name>
</jndiConfig>
<definition type="RDBMS">
<configuration>
<url>jdbc:mysql://localhost:3306/BAR</url>
<username>root</username>
<password>root</password>
<driverClassName>com.mysql.jdbc.Driver</driverClassName>
<maxActive>50</maxActive>
<maxWait>60000</maxWait>
<testOnBorrow>true</testOnBorrow>
<validationQuery>SELECT 1</validationQuery>
<validationInterval>30000</validationInterval>
</configuration>
</definition>
</datasource>
[/sourcecode]

2. user-mgt.xml - Have to refer created data sources for specific domains.
The first user store configuration take as primary user store and others are secondary.
In the primary user store we are not going to specify the domain name.

[sourcecode language="xml"]
<UserStoreManager class="org.wso2.carbon.user.core.ldap.ReadWriteLDAPUserStoreManager">
<Property name="defaultRealmName">WSO2.ORG</Property>
<Property name="kdcEnabled">false</Property>
<Property name="ConnectionURL">ldap://localhost:${Ports.EmbeddedLDAP.LDAPServerPort}</Property>
<Property name="ConnectionName">uid=admin,ou=system</Property>
<Property name="ConnectionPassword">admin</Property>
<Property name="passwordHashMethod">SHA</Property>
<Property name="UserNameListFilter">(objectClass=person)</Property>
<Property name="UserEntryObjectClass">scimPerson</Property>
<Property name="UserSearchBase">ou=Users,dc=wso2,dc=org</Property>
<Property name="UserNameSearchFilter">(&(objectClass=person)(uid=?))</Property>
<Property name="UserNameAttribute">uid</Property>
<Property name="PasswordJavaScriptRegEx">^[\\S]{5,30}$</Property>
<Property name="ServicePasswordJavaRegEx">^[\\S]{5,30}$</Property>
<Property name="ServiceNameJavaRegEx">^[\\S]{2,30}/[\\S]{2,30}$</Property>
<Property name="UsernameJavaScriptRegEx">^[\\S]{3,30}$</Property>
<Property name="UsernameJavaRegEx">[a-zA-Z0-9._-|//]{3,30}$</Property>
<Property name="RolenameJavaScriptRegEx">^[\\S]{3,30}$</Property>
<Property name="RolenameJavaRegEx">[a-zA-Z0-9._-|//]{3,30}$</Property>
<Property name="ReadLDAPGroups">true</Property>
<Property name="WriteLDAPGroups">true</Property>
<Property name="EmptyRolesAllowed">true</Property>
<Property name="GroupSearchBase">ou=Groups,dc=wso2,dc=org</Property>
<Property name="GroupNameListFilter">(objectClass=groupOfNames)</Property>
<Property name="GroupEntryObjectClass">groupOfNames</Property>
<Property name="GroupNameSearchFilter">(&(objectClass=groupOfNames)(cn=?))</Property>
<Property name="GroupNameAttribute">cn</Property>
<Property name="MembershipAttribute">member</Property>
<Property name="UserRolesCacheEnabled">true</Property>
<Property name="UserDNPattern">uid={0},ou=Users,dc=wso2,dc=org</Property>
<Property name="SCIMEnabled">true</Property>
<Property name="maxFailedLoginAttempt">0</Property>
</UserStoreManager>

<UserStoreManager class="org.wso2.carbon.user.core.jdbc.JDBCUserStoreManager">
<Property name="ReadOnly">false</Property>
<Property name="MaxUserNameListLength">100</Property>
<Property name="IsEmailUserName">false</Property>
<Property name="DomainCalculation">default</Property>
<Property name="PasswordDigest">SHA-256</Property>
<Property name="StoreSaltedPassword">true</Property>
<Property name="UserNameUniqueAcrossTenants">false</Property>
<Property name="PasswordJavaRegEx">^[\S]{5,30}$</Property>
<Property name="PasswordJavaScriptRegEx">^[\\S]{5,30}$</Property>
<Property name="UsernameJavaRegEx">[a-zA-Z0-9._-|//]{3,30}$</Property>
<Property name="UsernameJavaScriptRegEx">^[\\S]{3,30}$</Property>
<Property name="RolenameJavaRegEx">[a-zA-Z0-9._-|//]{3,30}$</Property>
<Property name="RolenameJavaScriptRegEx">^[\\S]{3,30}$</Property>
<Property name="UserRolesCacheEnabled">true</Property>
<Property name="maxFailedLoginAttempt">0</Property>
<Property name="dataSource">jdbc/WSO2MySqlFooDB</Property>
<Property name="DomainName">foo.com</Property>
</UserStoreManager>

<UserStoreManager class="org.wso2.carbon.user.core.jdbc.JDBCUserStoreManager">
<Property name="ReadOnly">false</Property>
<Property name="MaxUserNameListLength">100</Property>
<Property name="IsEmailUserName">false</Property>
<Property name="DomainCalculation">default</Property>
<Property name="PasswordDigest">SHA-256</Property>
<Property name="StoreSaltedPassword">true</Property>
<Property name="UserNameUniqueAcrossTenants">false</Property>
<Property name="PasswordJavaRegEx">^[\S]{5,30}$</Property>
<Property name="PasswordJavaScriptRegEx">^[\\S]{5,30}$</Property>
<Property name="UsernameJavaRegEx">[a-zA-Z0-9._-|//]{3,30}$</Property>
<Property name="UsernameJavaScriptRegEx">^[\\S]{3,30}$</Property>
<Property name="RolenameJavaRegEx">[a-zA-Z0-9._-|//]{3,30}$</Property>
<Property name="RolenameJavaScriptRegEx">^[\\S]{3,30}$</Property>
<Property name="UserRolesCacheEnabled">true</Property>
<Property name="maxFailedLoginAttempt">0</Property>
<Property name="dataSource">jdbc/WSO2MySqlBarDB</Property>
<Property name="DomainName">bar.com</Property>
</UserStoreManager>
[/sourcecode]

Once you done above configurations you can start the Identity server.

3. Log in to the IS (username :admin, password : admin)
Configuration ->Users and Roles

Select Users->Add new Users

Now you can create the user in different domains.

[username :test password :test123] - it will store at primary user store.
as well as you can create User with specifying the domain. then it will store at specified domain user store.
[username :foo.com/dinuka password:dinuka ]
[username :bar.com/malinda password:malinda]

once you done this you have to go to Roles and give the login permission to everyone role.

Now you can log in to the IS with any user in primary or secondary user store either specifying the domain name or without domain name.

[username :foo.com/dinuka password : dinuka] or
[username :dinuka password : dinuka]
Once you try to log in to the system with specifying the domain, IS will look at the specified domain user store to authenticate the user.
other wise it will go through all the define user stores starting from primary user store.

Friday, January 4, 2013

Stratos2 Demo Setup Alpha - with Open Stack

This blog post is going to explain how to setup the Stratos2 Demo Setup in VirtualBox

first you have to download our image from here (This will take some time because of the size 17.3GB)
Now double click on it to install.
Once you done with the installation you have to go to configure the "virtual host only interface" with following details
1. go to file->preferences in VirtualBox
2. Select Network tab and add new "Host only network"

IPV4 address: 172.14.0.254
IPV4 network mask :255.255.0.0

3. Now start this image and login to the Instance
[sourcecode language="bash"]
username: wso2
password: g
[/sourcecode]

4. Go to /demo_setup/conf/ and view setup.conf

If you have any changes in configuration according to your environment you can do it in setup.conf

5. Move to demo_setup folder and type "sudo bash" to move to root and run the setup-demo.sh
Press enter when the following questions are coming

================================================================================
[sourcecode language="bash"]
Enter new UNIX password:
Retype new UNIX password:
No password supplied
Enter new UNIX password:
Retype new UNIX password:
No password supplied
Enter new UNIX password:
Retype new UNIX password:
No password supplied
passwd: Authentication token manipulation error
passwd: password unchanged
Try again? [y/N] N

Changing the user information for git
Enter the new value, or press ENTER for the default
Full Name []:
Room Number []:
Work Phone []:
Home Phone []:
Other []:
Is the information correct? [Y/n] Y
do ssh-keygen without password for git user. press enter to continue...

Generating public/private rsa key pair.
Enter file in which to save the key (/home/git/.ssh/id_rsa):
Created directory '/home/git/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/git/.ssh/id_rsa.
Your public key has been saved in /home/git/.ssh/id_rsa.pub.
The key fingerprint is:
83:55:ac:2b:ae:6d:4a:58:98:b9:11:46:2a:7d:cf:f5 git@s2demo
The key's randomart image is:
+--[ RSA 2048]----+
| . .. |
| + .. |
|o + . o. |
|.. * o +.. |
| = . + S.E |
| = . .. |
| o .. . |
| . .o |
| o+. |
+-----------------+
Reading package lists... Done
Building dependency tree
Reading state information... Done
git is already the newest version.
gitolite is already the newest version.
gitweb is already the newest version.
apache2 is already the newest version.
bind9 is already the newest version.
apache2-suexec is already the newest version.
0 upgraded, 0 newly installed, 0 to remove and 56 not upgraded.
Adding entries to gitolite... Please do :wq after gitolite.rc file open. Press enter to continue...

The default settings in the rc file (/home/git/.gitolite.rc) are fine for most
people but if you wish to make any changes, you can do so now.

hit enter...
[/sourcecode]
================================================================================

Once you reached here, it will open the file with details then you have to save the file by doing the ":wq" command

Again you can see the following commands in console - just press enter to proceed
================================================================================
[sourcecode language="bash"]
creating gitolite-admin...
Initialized empty Git repository in /home/git/repositories/gitolite-admin.git/
creating testing...
Initialized empty Git repository in /home/git/repositories/testing.git/
[master (root-commit) 390bc9e] start
2 files changed, 6 insertions(+)
create mode 100644 conf/gitolite.conf
create mode 100644 keydir/git.pub
Cloning into 'gitolite-admin'...
Warning: Permanently added 'localhost' (ECDSA) to the list of known hosts.
remote: Counting objects: 6, done.
remote: Compressing objects: 100% (4/4), done.
Receiving objects: 100% (6/6), 709 bytes, done.
remote: Total 6 (delta 0), reused 0 (delta 0)
do ssh-keygen without password for wso2 user. press enter to continue...
Generating public/private rsa key pair.
Enter file in which to save the key (/home/wso2/.ssh/id_rsa):
/home/wso2/.ssh/id_rsa already exists.
Overwrite (y/n)? y

Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/wso2/.ssh/id_rsa.
Your public key has been saved in /home/wso2/.ssh/id_rsa.pub.
The key fingerprint is:
03:80:76:55:c0:ea:9f:04:3c:e9:38:d8:bd:9e:09:11 wso2@s2demo
The key's randomart image is:
+--[ RSA 2048]----+
| ..ooo. |
| o ... |
| .Eo o. |
| .* . |
| o.= o S |
|. +.+ . . |
| .. + . |
| ..oo |
| .+ |
+-----------------+
[master a6087aa] Check in by git
3 files changed, 10 insertions(+), 4 deletions(-)
create mode 100644 conf/repos/testing.conf
create mode 100644 keydir/wso2.pub
Already up-to-date.
Counting objects: 12, done.
Compressing objects: 100% (7/7), done.
Writing objects: 100% (8/8), 927 bytes, done.
Total 8 (delta 0), reused 0 (delta 0)
remote: creating testingt...
remote: Initialized empty Git repository in /home/git/repositories/testingt.git/
To git@localhost:gitolite-admin
390bc9e..a6087aa master -> master
Cloning into 'gitolite-admin'...
remote: Counting objects: 14, done.
remote: Compressing objects: 100% (11/11), done.
Receiving objects: 100% (14/14), 1.57 KiB, done.
remote: Total 14 (delta 0), reused 0 (delta 0)
ln: failed to create symbolic link `/etc/apache2/mods-enabled/appfactory.load': File exists
-D AP_DOC_ROOT="/var/www"
-D AP_GID_MIN=100
-D AP_HTTPD_USER="www-data"
-D AP_LOG_EXEC="/var/log/apache2/suexec.log"
-D AP_SAFE_PATH="/usr/local/bin:/usr/bin:/bin"
-D AP_UID_MIN=100
-D AP_USERDIR_SUFFIX="public_html"
ln: failed to create symbolic link `/etc/apache2/mods-enabled/suexec.load': File exists
ln: failed to create symbolic link `/etc/apache2/sites-enabled/git': File exists
apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1 for ServerName
httpd (no pid file) not running
apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1 for ServerName
/opt/ADC ~/demo_setup
~/demo_setup
/opt/cloud_controller ~/demo_setup
In repository/conf/carbon.xml
rm: cannot remove `./repository/conf/service-topology.conf': No such file or directory
rm: cannot remove `./repository/conf/service-topology.conf.back': No such file or directory
~/demo_setup
/opt/wso2mb-2.0.1 ~/demo_setup
~/demo_setup
/opt/elb ~/demo_setup
~/demo_setup
/opt/agent ~/demo_setup
~/demo_setup
/opt/wso2is-4.0.0 ~/demo_setup
~/demo_setup

Import the wso2.pub into openstack (With the same name mentioned in /opt/cloud_controller/repository/deployment/server/cartridges/)
cat /home/wso2/wso2.pub.
Cut and paste the output into the box that you get when execute import keys of the openstack dashboard
When you are ready press any key to continue starting servers
[/sourcecode]
================================================================================
once you come here in the command line you have to take another console and login to the VM as follows
[sourcecode language="bash"]
ssh wso2@172.14.0.1
password : g
[/sourcecode]

then follow this command to view the public key
cat /home/wso2/wso2.pub and copy the public key

Then open the OpenStack buy using the IP address http://172.14.0.1/

[sourcecode language="bash"]
username : admin
password : openstack
[/sourcecode]

Go to Project -> Access and Security then go to section Key Pairs

Delete the already exist "stratos-demo" key and import it again

once you finish this again you can go to earlier command line and press enter to start servers

when it finished you can see the command line as follows

Now the stratos demo environment ready for use

6. Go to https://172.14.0.1:9445/carbon/admin/login.jsp
[sourcecode language="bash"]
username : admin
password : admin
[/sourcecode]

Create new tenant with following details

Domain : stratos.com
FirstName : statos2
LastName : alpha
Admin Username : dinuka
Password : dinuka123
Email : dinukam@wso2.com

Now we are done with the Stratos2 Demo Setup