diff --git a/modules/core/distribution/identity_config_change.xml b/modules/core/distribution/identity_config_change.xml new file mode 100644 index 00000000..2b56094e --- /dev/null +++ b/modules/core/distribution/identity_config_change.xml @@ -0,0 +1,32 @@ + + + + //s:Server/s:OAuth/s:OAuthScopeValidator + + + + //s:Server/s:OAuth/s:OAuthCallbackHandlers + ]]> + + + + //s:Server/s:OAuth/s:SupportedGrantTypes/s:SupportedGrantType[s:GrantTypeName='iwa:ntlm']/s:GrantTypeName + + org.wso2.carbon.identity.oauth.common.NTLMAuthenticationValidator]]> + + + //s:Server/s:OAuth/s:SupportedGrantTypes/s:SupportedGrantType[s:GrantTypeName='iwa:ntlm']/s:GrantTypeName + + org.wso2.carbon.identity.oauth.common.NTLMAuthenticationValidator]]> + + + //s:Server/s:OAuth/s:SupportedGrantTypes/s:SupportedGrantType[s:GrantTypeName='iwa:ntlm'] + + + urn:ietf:params:oauth:grant-type:jwt-bearer + org.wso2.carbon.identity.oauth2.grant.jwt.JWTBearerGrantHandler + org.wso2.carbon.identity.oauth2.grant.jwt.JWTGrantValidator + ]]> + + \ No newline at end of file diff --git a/modules/core/distribution/pom.xml b/modules/core/distribution/pom.xml index 4e8d95c3..ced1d3c1 100644 --- a/modules/core/distribution/pom.xml +++ b/modules/core/distribution/pom.xml @@ -90,6 +90,83 @@ + + com.google.code.maven-replacer-plugin + replacer + 1.5.2 + + + + replace-for-identity + prepare-package + + replace + + + ${basedir}/../p2-profile-gen/target/wso2carbon-core-${carbon.kernel.version}/repository/conf/identity/identity.xml + + + /Server/JDBCPersistenceManager/DataSource/Name + (jdbc/WSO2CarbonDB) + jdbc/WSO2AM_DB + + + /Server/OAuth/SupportedGrantTypes/SupportedGrantType + (org.wso2.carbon.identity.oauth2.token.handlers.grant.AuthorizationCodeGrantHandler) + org.wso2.carbon.apimgt.keymgt.handlers.ExtendedAuthorizationCodeGrantHandler + + + /Server/OAuth/SupportedGrantTypes/SupportedGrantType + (org.wso2.carbon.identity.oauth2.token.handlers.grant.PasswordGrantHandler) + org.wso2.carbon.apimgt.keymgt.handlers.ExtendedPasswordGrantHandler + + + /Server/OAuth/SupportedGrantTypes/SupportedGrantType + (org.wso2.carbon.identity.oauth2.token.handlers.grant.ClientCredentialsGrantHandler) + org.wso2.carbon.apimgt.keymgt.handlers.ExtendedClientCredentialsGrantHandler + + + /Server/OAuth/SupportedGrantTypes/SupportedGrantType + (org.wso2.carbon.identity.oauth2.token.handlers.grant.saml.SAML2BearerGrantHandler) + org.wso2.carbon.apimgt.keymgt.handlers.ExtendedSAML2BearerGrantHandler + + + /Server/OAuth/SupportedGrantTypes/SupportedGrantType + (org.wso2.carbon.identity.oauth2.token.handlers.grant.iwa.ntlm.NTLMAuthenticationGrantHandler) + org.wso2.carbon.identity.oauth2.token.handlers.grant.iwa.ntlm.NTLMAuthenticationGrantHandlerWithHandshake + + + /Server/OAuth/OAuthCallbackHandlers + (org.wso2.carbon.identity.oauth.callback.DefaultCallbackHandler) + org.wso2.carbon.apimgt.keymgt.util.APIManagerOAuthCallbackHandler + + + + + + + + + + replace-for-thrift + prepare-package + + replace + + + ${basedir}/../p2-profile-gen/target/wso2carbon-core-${carbon.kernel.version}/repository/conf/identity/thrift-authentication.xml + + + /Server/JDBCPersistenceManager/DataSource/Name + (jdbc/WSO2CarbonDB) + jdbc/WSO2AM_DB + + + + + + + com.google.code.maven-config-processor-plugin @@ -130,6 +207,43 @@ + + add-scope-validator + prepare-package + + process + + + false + + + ${basedir}/../p2-profile-gen/target/wso2carbon-core-${carbon.kernel.version}/repository/conf/identity/identity.xml + ../../p2-profile-gen/target/wso2carbon-core-${carbon.kernel.version}/repository/conf/identity/identity.xml + identity_config_change.xml + + + + http://wso2.org/projects/carbon/carbon.xml + + + + + init-claim-manager + prepare-package + + process + + + false + + + ${basedir}/../p2-profile-gen/target/wso2carbon-core-${carbon.kernel.version}/repository/conf/user-mgt.xml + ../../p2-profile-gen/target/wso2carbon-core-${carbon.kernel.version}/repository/conf/user-mgt.xml + user_mgt_config_change.xml + + + + @@ -444,6 +558,7 @@ + org.apache.maven.plugins maven-deploy-plugin @@ -451,52 +566,6 @@ true - - com.google.code.maven-replacer-plugin - replacer - 1.5.2 - - - - replace-for-api-manager - prepare-package - - replace - - - - ${basedir}/../p2-profile-gen/target/wso2carbon-core-${carbon.kernel.version}/repository/conf/api-manager.xml - - - - /APIManager/GatewayType - Synapse - None - - - - - - replace-for-api-store - prepare-package - - replace - - - - ${basedir}/../p2-profile-gen/target/wso2carbon-core-${carbon.kernel.version}/repository/deployment/server/jaggeryapps/api-store/site/conf/site.json - - - - (/store) - /api-store - - - - - - - diff --git a/modules/core/distribution/src/assembly/bin.xml b/modules/core/distribution/src/assembly/bin.xml index 233f1d0c..f6e54c1a 100644 --- a/modules/core/distribution/src/assembly/bin.xml +++ b/modules/core/distribution/src/assembly/bin.xml @@ -74,6 +74,7 @@ **/lib/encoder* **/plugins/jaxb* **/security/authenticators.xml + **/user-mgt.xml **/plugins/org.wso2.carbon.localentry.ui* **/plugins/org.wso2.carbon.mediation.security.ui* @@ -224,6 +225,7 @@ **/log4j.properties **/nhttp.properties **/passthru-http.properties + **/user-mgt.xml @@ -594,6 +596,8 @@ **/msg-mgt.properties **/entitlement.properties **/EndpointConfig.properties + **/identity.xml + **/thrift-authentication.xml @@ -850,24 +854,12 @@ true 644 - - src/repository/conf/identity/identity.xml - ${pom.artifactId}-${pom.version}/repository/conf/identity - - 644 - src/repository/conf/identity/application-authentication.xml ${pom.artifactId}-${pom.version}/repository/conf/identity 644 - - src/repository/conf/identity/thrift-authentication.xml - ${pom.artifactId}-${pom.version}/repository/conf/identity - true - 644 - src/repository/conf/identity/identity-providers/iot_default.xml diff --git a/modules/core/distribution/src/repository/conf/carbon.xml b/modules/core/distribution/src/repository/conf/carbon.xml index 9e856b84..40345945 100644 --- a/modules/core/distribution/src/repository/conf/carbon.xml +++ b/modules/core/distribution/src/repository/conf/carbon.xml @@ -47,12 +47,13 @@ This is will become part of the End Point Reference of the services deployed on this server instance. --> - + + localhost - + localhost - - - - - jdbc/WSO2AM_DB - - - - - false - - - - - - - - - - ${carbon.home}/repository/resources/security/userRP.jks - - - JKS - - wso2carbon - - wso2carbon - - - - ${carbon.home}/conf/keystores - - - - SelfAndManaged - CertValidate - - - - - - - - - - https://localhost:9443/openidserver - https://localhost:9443/openid/ - - false - - 7200 - - false - - false - - 36000 - - false - org.wso2.carbon.identity.provider.openid.claims.DefaultClaimsRetriever - - - - https://localhost:9443/oauth/request-token - https://localhost:9443/oauth/access-token - https://localhost:9443/oauth/authorize-url - https://localhost:${mgt.transport.https.port}/oauth2/token - - 300 - - 3600 - - 3600 - - 84600 - - 300 - - true - - true - - org.wso2.carbon.identity.oauth.tokenprocessor.PlainTextPersistenceProcessor - - - - false - - - - - - token - org.wso2.carbon.identity.oauth2.authz.handlers.TokenResponseTypeHandler - - - code - org.wso2.carbon.identity.oauth2.authz.handlers.CodeResponseTypeHandler - - - - - - authorization_code - org.wso2.carbon.identity.oauth2.token.handlers.grant.AuthorizationCodeGrantHandler - - - - password - org.wso2.carbon.apimgt.keymgt.handlers.ExtendedPasswordGrantHandler - - - refresh_token - org.wso2.carbon.identity.oauth2.token.handlers.grant.RefreshGrantHandler - - - client_credentials - org.wso2.carbon.identity.oauth2.token.handlers.grant.ClientCredentialsGrantHandler - - - urn:ietf:params:oauth:grant-type:saml2-bearer - org.wso2.carbon.identity.oauth2.token.handlers.grant.saml.SAML2BearerGrantHandler - - - iwa:ntlm - org.wso2.carbon.identity.oauth2.token.handlers.grant.iwa.ntlm.NTLMAuthenticationGrantHandler - - - urn:ietf:params:oauth:grant-type:jwt-bearer - org.wso2.carbon.identity.oauth2.grant.jwt.JWTBearerGrantHandler - org.wso2.carbon.identity.oauth2.grant.jwt.JWTGrantValidator - - - - - - - - - - - - false - - - - false - - - - - false - org.wso2.carbon.identity.oauth2.authcontext.JWTTokenGenerator - org.wso2.carbon.identity.oauth2.authcontext.DefaultClaimsRetriever - http://wso2.org/claims - SHA256withRSA - 15 - - - - - - org.wso2.carbon.identity.openidconnect.DefaultIDTokenBuilder - https://localhost:9443/oauth2endpoints/token - http://wso2.org/claims/givenname - org.wso2.carbon.identity.openidconnect.SAMLAssertionClaimsCallback - 3600 - http://wso2.org/claims - org.wso2.carbon.identity.oauth.endpoint.user.impl.UserInfoUserStoreClaimRetriever - org.wso2.carbon.identity.oauth.endpoint.user.impl.UserInforRequestDefaultValidator - org.wso2.carbon.identity.oauth.endpoint.user.impl.UserInfoISAccessTokenValidator - org.wso2.carbon.identity.oauth.endpoint.user.impl.UserInfoJSONResponseBuilder - false - - - - - - - gtalk - talk.google.com - 5222 - gmail.com - multifactor1@gmail.com - wso2carbon - - - - - - localhost - https://localhost:9443/samlsso - 5 - 60000 - false - 157680000 - 157680000 - 36000 - - org.wso2.carbon.identity.sso.saml.attributes.UserAttributeStatementBuilder - http://wso2.org/claims - false - org.wso2.carbon.identity.sso.saml.builders.claims.DefaultClaimsRetriever - org.wso2.carbon.identity.sso.saml.builders.assertion.DefaultSAMLAssertionBuilder - org.wso2.carbon.identity.sso.saml.builders.encryption.DefaultSSOEncrypter - org.wso2.carbon.identity.sso.saml.builders.signature.DefaultSSOSigner - org.wso2.carbon.identity.sso.saml.validators.SAML2HTTPRedirectDeflateSignatureValidator - - - - 5 - false - - - - - - - true - 36000 - - - true - - - true - ${Ports.ThriftEntitlementReceivePort} - 10000 - - ${carbon.home}/repository/resources/security/wso2carbon.jks - wso2carbon - - - localhost - - - - - - 5 - - - 10 - local://services - - - - - \ No newline at end of file diff --git a/modules/core/distribution/src/repository/conf/identity/thrift-authentication.xml b/modules/core/distribution/src/repository/conf/identity/thrift-authentication.xml deleted file mode 100644 index 646da0b1..00000000 --- a/modules/core/distribution/src/repository/conf/identity/thrift-authentication.xml +++ /dev/null @@ -1,44 +0,0 @@ - - - - - - - - - - jdbc/WSO2AM_DB - - - - - - org.wso2.carbon.identity.thrift.authentication.dao.DBThriftSessionDAO - - - 30000 - - - 10711 - - - 1800000 - - diff --git a/modules/core/distribution/src/repository/conf/security/Owasp.CsrfGuard.Carbon.properties b/modules/core/distribution/src/repository/conf/security/Owasp.CsrfGuard.Carbon.properties index 2b65f620..1dc9d20e 100644 --- a/modules/core/distribution/src/repository/conf/security/Owasp.CsrfGuard.Carbon.properties +++ b/modules/core/distribution/src/repository/conf/security/Owasp.CsrfGuard.Carbon.properties @@ -461,4 +461,12 @@ org.owasp.csrfguard.unprotected.publisherRestApi=%servletContext%/api/appm/publi org.owasp.csrfguard.unprotected.storeRestApi=%servletContext%/api/appm/store/* org.owasp.csrfguard.unprotected.certificateMgtRestApi=%servletContext%/api/certificate-mgt/* org.owasp.csrfguard.unprotected.deviceMgtRestApi=%servletContext%/api/device-mgt/* -org.owasp.csrfguard.unprotected.dcrRestApi=%servletContext%/dynamic-client-web/* \ No newline at end of file +org.owasp.csrfguard.unprotected.dcrRestApi=%servletContext%/dynamic-client-web/* + +#carbon +org.owasp.csrfguard.unprotected.Services=%servletContext%/services/* + +#identity +org.owasp.csrfguard.unprotected.acs=%servletContext%/acs/* +org.owasp.csrfguard.unprotected.iwa=%servletContext%/iwa/* +org.owasp.csrfguard.unprotected.oauthiwa=%servletContext%/commonauth/iwa/* \ No newline at end of file diff --git a/modules/core/distribution/src/repository/conf/user-mgt.xml b/modules/core/distribution/src/repository/conf/user-mgt.xml new file mode 100644 index 00000000..8a9afc53 --- /dev/null +++ b/modules/core/distribution/src/repository/conf/user-mgt.xml @@ -0,0 +1,260 @@ + + + + + + true + admin + + admin + admin + + everyone + true + true + jdbc/WSO2CarbonDB + + + + + org.wso2.carbon.user.core.tenant.JDBCTenantManager + false + true + true + ^[\S]{3,30}$ + ^[\S]{3,30}$ + Username pattern policy violated + ^[\S]{5,30}$ + ^[\S]{5,30}$ + Password length should be within 5 to 30 characters + ^[\S]{3,30}$ + ^[\S]{3,30}$ + true + false + true + SHA-256 + true + , + 100 + 100 + true + false + + + + + + + + + + + + + /permission + true + false + + + + + diff --git a/modules/core/distribution/user_mgt_config_change.xml b/modules/core/distribution/user_mgt_config_change.xml new file mode 100644 index 00000000..ededb309 --- /dev/null +++ b/modules/core/distribution/user_mgt_config_change.xml @@ -0,0 +1,9 @@ + + + //UserManager/Realm/Configuration/Property[@name='initializeNewClaimManager'] + + + //UserManager/Realm/Configuration/Property[@name='isCascadeDeleteEnabled'] + true]]> + + \ No newline at end of file diff --git a/modules/core/p2-profile-gen/pom.xml b/modules/core/p2-profile-gen/pom.xml index 73c5c237..271da5d0 100644 --- a/modules/core/p2-profile-gen/pom.xml +++ b/modules/core/p2-profile-gen/pom.xml @@ -221,6 +221,9 @@ org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.gateway.feature:${carbon.api.mgt.version} + + org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.keymanager.feature:${carbon.api.mgt.version} + org.wso2.carbon.apimgt:org.wso2.carbon.forum.server.feature:${carbon.api.mgt.version} @@ -1017,6 +1020,11 @@ + + + org.wso2.carbon.apimgt.keymanager.feature.group + ${carbon.api.mgt.version} + org.wso2.carbon.apimgt.core.feature.group ${carbon.api.mgt.version} @@ -1614,6 +1622,11 @@ org.wso2.carbon.mediation.configadmin.feature.group ${carbon.mediation.version} + + + org.wso2.carbon.mediator.cache.feature.group + ${carbon.mediation.version} + + + + org.wso2.carbon.dashboards.shindig.feature.group + ${carbon.dashboard.version} + + + org.wso2.carbon.dashboards.portal.feature.group + ${carbon.dashboard.version} + + + org.wso2.carbon.dashboard.deployment.feature.group + ${carbon.dashboard.version} + + + org.wso2.carbon.iot.device.statistics.dashboard.feature.group + ${carbon.device.mgt.plugin.version} + + + @@ -2573,6 +2630,10 @@ org.wso2.carbon.mediation.configadmin.feature.group ${carbon.mediation.version} + + org.wso2.carbon.mediator.cache.feature.group + ${carbon.mediation.version} + + + + org.wso2.carbon.identity.authenticator.saml2.sso.feature.group + ${identity.carbon.auth.saml2.version.iotcore} + + + org.wso2.carbon.identity.sso.saml.feature.group + ${identity.inbound.auth.saml.version.iotcore} + + @@ -3499,6 +3571,21 @@ org.wso2.carbon.analytics.api.client.feature.group ${carbon.analytics.version} + + org.wso2.carbon.mediator.cache.feature.group + ${carbon.mediation.version} + + + + + org.wso2.carbon.identity.authenticator.saml2.sso.feature.group + ${identity.carbon.auth.saml2.version.iotcore} + + + org.wso2.carbon.identity.sso.saml.feature.group + ${identity.inbound.auth.saml.version.iotcore} + + diff --git a/pom.xml b/pom.xml index e4f73bf2..1be2a1e5 100644 --- a/pom.xml +++ b/pom.xml @@ -1507,9 +1507,9 @@ 5.1.3 5.1.6 5.1.2 - 5.3.1 + 5.3.4 5.1.1 - 5.1.3 + 5.1.4 5.1.1 5.1.1 5.1.4