'WSO2: control user access with federated authentication
I'm trying to do limit access to my application using WSO2 identity server.
In summary, a contracting company will send us a list of authorized usernames and, using WSO2, we want to be able to federate access and authorize only those usernames into each application of ours.
The general setup is: my WSO2 server will act as a federation hub to various external identity providers (IdP). These IdPs will contain their own user tables with all the users of their third party company. However, only some of those users should have access to our application (to charge by user count), as demonstrated by this diagram.
So far I've been able to
- login into the application using WSO2;
- Federate authentication from WSO2 to the external IdP; and
- I'm able to restrict access to the application with XACML policies based on the user's role.
However, all the attributes currently come from the external identity provider, so in this scenario, they would actually be in control of who has access to the application. What I want is to be able to use their IdP for authentication, and my WSO2 instance for authorization.
Could you shed some light on how to achieve this?
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|