Configuring SSO session timeout in WSO2 Identity Server 4.5.0

One of the key features in WSO2 Identity Server  is SAML2 based single sign on (SSO) feature. The default time period for a SSO session is 10 hours in the Identity Server versions so far and this default SSO Session Expire time value can not be changed according to the user needs. But from WSO2 IS 4.5.0 onwards the SSO session timeout can be configured at the server start time.

This configuration lies on <IS_HOME>/repository/conf/identity.xml file under the SSOService element. Add the following entry under that in order to explicitly add the SSO timeout.

<SSOService>
<SessionTimeout>120</SessionTimeout>  // Add the expecting timeout value in seconds here.
</SSOService>

Save the configuration and restart the server. Now the SSO session will be timed out as the newly configured value and a user may need to re-authenticate once he logs back after this timeout. It is not a must to have this entry in 'identity.xml' and if a timeout is not configured, the SSO session will use the '10 hours (36000s)' default time out value.

After configuring the SSO Session Expire time you can use this article in order to setup Single Sign On with WSO2 Identity Server.

Adding a new function into WSO2 MB FE using JavaToWsdl approach - My notes

In most of the WSO2 products JavaToWsdl approach is used in adding new functionality. In here we first add the necessary new methods into the relevant service class in /platform/components and then generates the service wsdl for that. After that the service wsdl is added into the corresponding wsdl file in the /platform/service-stubs this stub is used in the front end UI components, in order to call the new method.

As an example let's add a new method to obtain the currently logged in user's name from the UI components.

WSO2 Message Broker's source code is mainly written in the /platform/components/andes component. The admin functionalities are coded in 'org.wso2.carbon.andes.admin' sub component under the AndesAdminService.java class.

First add the new method into the java class.

public String getCurrentUser(){
          
        // ADD METHOD BODY HERE       
        return userName.trim();
}

Due to authentication requirements in the WSO2 MB, you need to add the following entry into the relevant 'services.xml' file in the 'Resouces' package in the component.

<operation name="getCurrentUser">
     <parameter name="AuthorizationAction" locked="true">/permission/admin/configure</parameter>
 </operation>

Now save the two files. Once we build the 'org.wso2.carbon.andes.admin' component back these changes will be available in the back end. But to use them in front end we need to edit the corresponding service wsdl file in the /platform/service-stubs.

For this goto <MB_HOME/Repository/conf/carbon.xml>  file. Find the <HideAdminServiceWSDLs> entry. This is set 'true' by default, as we don't want to expose admin service details, but now we need to see the service wsdl file to see the new functions we added there. Hence make this into 'false'.

<!-- If this parameter is set, the ?wsdl on an admin service will not give the admin service wsdl.--><HideAdminServiceWSDLs>false</HideAdminServiceWSDLs>

Build 'org.wso2.carbon.andes.admin' component using maven and replace org.wso2.carbon.andes.admin_4.1.2.jar file in the <MB_HOME/Repository/Components/Plugins> directory, with this newly built jar file found in /target folder.
(Note: Remember to rename the jar file according to notation)

Start the MB server back and goto ,
https://localhost:9443/services/AndesAdminService?wsdl

You will see the AndesAdminService wsdl file with the newly added changes. Now let's add these to the service-stub to be used in Front End.

The corresponding service-stub for 'org.wso2.carbon.andes.admin' component is, /platform/service-stubs/org.wso2.carbon.andes.stub/4.1.0

In here you will find the /resources/AndesAdminService.wsdl file. Copy the new changes from the wsdl file that is viewed in the browser, into this wsdl file. Some of the changes would be like,

<wsdl:message name="getCurrentUserRequest"><wsdl:part name="parameters" element="ns:getCurrentUser"/></wsdl:message>
<wsdl:message name="getCurrentUserResponse"><wsdl:part name="parameters" element="ns:getCurrentUserResponse"/></wsdl:message>   and more ....

After adding all the changes build the service-stub back using maven. Replace org.wso2.carbon.andes.stub_4.1.0.jar file in the <MB_HOME/Repository/Components/Plugins> directory, with this newly built jar file found in /target folder.

Now you can call this stub class from andes ui components and use the newly added 'getCurrentUser()' method as given below. The same procedure is to be followed whenever we add new functions into the code base.

AndesAdminServiceStub stub = UIUtils.getAndesAdminServiceStub(config, session, request);
String username = stub.getCurrentUser();

Providing Queue browing, message sending and purging features in WSO2 MB 2.1.0

WSO2 MB is a Message Broker which enables applications to exchange communications asynchronously or publish messages for timely access by many subscribers. For the past versions of WSO2 MB there was no support for sending sample messages from the admin console or viewing the messages in a queue. hence in WSO2 MB 2.1.0 onwards, we have added this functionality into the broker.

Therefore it is now possible to,

1.  Send sample text messages to a queue in WSO2 MB
2.  Browse the content in a queue using MB admin console
3.  Purge a queue via admin console and make it empty in WSO2 MB as of the expectation of many users.

The following are some of the snapshots from the new view of the MB admin console.  The 2.1.0 version is not yet released for public but will be releasing by end of this month.

1. New view of the 'Queue Menu'

2. New Queue Browser in WSO2 MB

3. New Message Sending UI in MB

4. New Queue purging option in MB

More details on the new features can be found in MB 2.1.0 documentation once it is released.

Deploying and Running WSO2 API Manager 1.3.1 in an Amazon EC2 instanace

This post is a quick guide on how to deploy WSO2 API Manager 1.3.1 in an AWS EC2 instance and running operations on it. You can also run API Manager behind an Elastic Load Balancer (ELB) in EC2 instance. The configuration procedure is same as described below, except the public DNS address to be used is the DNS of the ELB in that case.

Requirements: Amazon Web Services account
                        WSO2 API Manager 1.3.1


1. If you still don't have an AWS account create one as given here. In the account creation process you will need to specify a password and you will be given a Access Key ID and a Secret  Access Key which will be needed later for you to connect to your AWS EC2 instance.

2. Using your credentials log in to AWS Management Console and open Amazon EC2 console.

https://console.aws.amazon.com/ec2/

3. Create a new Linux instance by selecting "Launch Instance". Create your new instance by following the steps given in this guide.
In doing this choose ' Ubuntu Server 12.04' as the Amazon Machine Image (AMI) type and 'M1 Medium' as the instance type. Specify relevant key-pair or create a new one. If you create a new key-pair, download this into your computer and make sure you remember where it is located in your machine. (You need this later in this post!)

4. Once you finish creating an instance you can see it in the running instances list in the console. if you click on it you will see more information about the new instance.

4. Now let's connect to this instance  and deploy our Am 1.3.1 pack here. 

• Goto the location where you key-pair is located. Now we are going to connect to our Ubuntu server instance in EC2 using SSH. 


• Find the Public DNS address of your instance. In my case this is 'ec2-00-000-000-00.compute-1.amazonaws.com' (Note that i have changed the digits in my EC2 instance DNS here).


• Enter the following command in the terminal.

ssh -i ishara.pem ubuntu@ec2-00-000-000-000.compute-1.amazonaws.com


• In here  'isarap.pem' is the keypair file that was downloaded when creating the EC2 instance.
  ec2-00-000-000-000.compute-1.amazonaws.com is the public DNS address of your instance.


• Most probably there will be 'permission denied' error when you try this the first time. This is because there is more permission given for your keypair file when it is created. We need to make to more access restricted. For that use,

chmod 400 ishara.pem


• After that when you try to SSH you will be able to successfully connect to your instance in AWS EC2.You will now see the following message which means you are now connected.

Welcome to Ubuntu 12.04.1 LTS (GNU/Linux 3.2.0-36-virtual x86_64)

* Documentation: https://help.ubuntu.com/

System information as of Mon Apr 29 17:48:41 UTC 2013 
System load: 0.08                 Processes: 59 
Usage of /: 32.9% of 7.87GB Users logged in: 0 
Memory usage: 32%             IP address for eth0: 10.202.151.238 
Swap usage: 0% 

Graph this data and manage this system at https://landscape.canonical.com/ Get cloud support with Ubuntu Advantage Cloud Guest http://www.ubuntu.com/business/services/cloud 

Use Juju to deploy your cloud instances and workloads. https://juju.ubuntu.com/#cloud-precise 

Last login: Mon Apr 29 07:03:15 2013 from 203.143.18.194 
ubuntu@ip-10-202-151-238:~$
.........................................................................................................


5. As now you are logged into ubuntu instance, consider this as a normal scenario where you work on your local computer. Make a new directory in EC2 instance as apim/ and copy API Manager 1.3.1.zip pack into this EC2 instance.

ubuntu@ip-10-202-151-238:~$ pwd
/home/ubuntu

ubuntu@ip-10-202-151-238:~$  mkdir apim/


Open another terminal and enter command,
scp -i ishara.pem wso2am-1.3.1.zip ubuntu@ec2-00-000-000-00.compute-1.amazonaws.com:/home/ubuntu/apim

This will be copying Am 1.3.1 distribution files into the apim/ directory in EC2 instance. Similarly copy JDK 1.6 pack as you needs it to run the API Manager in EC2. 

6. Unzip both distributions now. If 'zip' is not installed you will first need to install it. Edit the .bashrc in /home/ubuntu directory and add the path to your JDK ad JAVA_HOME in it.

7. Unzip the API Manager 1.3.1 pack too. In order to start the API Manager server in an outside location we need to configure carbon.xml and api-manager.xml files in AM_HOME/repository/conf directory . The following guide explains how to do this in detail.

API Manager User Guide: http://dist2.wso2.org/products/api-manager/1.3.0/APIManager-GettingStarted-v1.3.0.pdf 

In addition find the following entries in api-manager.xml and specify the values given below.

<KeyValidatorClientType>WSClient</KeyValidatorClientType>
<EnableThriftServer>false</EnableThriftServer>    

..........................................................................................................
Note: You need to install 'curl' in EC2 instance to follow the steps in this guide. If there are issues occurs when trying with,

pubname=$(curl http://169.254.169.254/latest/meta­data/public­hostname 2>/dev/null);
export JAVA_OPTS=­Damazon.pub.hostname=$pubname

In that case remove the above lines from .bashrc file and manually enter the 'EC2 instance public DNS url' into the places described in the configuration. 

For example instead of adding,

<HostName>${amazon.pub.hostname}</HostName> in carbom.xml file you can enter as 
<HostName>ec2-00-000-000-00.compute-1.amazonaws.com</HostName>

...............................................................................................................................
 
8. When all these configurations are over, start API Manager from /home/ubuntu/apim/wso2am-1.3.1/bin. Point your browser to,

https://ec2-00-000-00-00.compute-1.amazonaws.com:9443/carbon/ 

9. The WSO2 Admin Console for API Manager will be started! You are running AM 1.3.1 in AWS EC2 now :)  

Error with starting OpenMRS - "Unable to get a connection to the database"

This blog post will be about a very primary error on starting and running OpenMRS medical record system, in which i did my gsoc project and where i am still contributing whenever i get a time (yes i still love openmrs!). This is more like a note to myself.

I recently started to use a new laptop, therefore i moved all my openmrs repositories, .m2 repository and .OpenMRS directories into the new machine, as my intention was saving the time that will be taken to build everything from scratch again. However when i tried to run OpenMRS in the new machine, after installing and setting up mysql server, it returned the following error.

java.lang.RuntimeException: Error occurred while trying to get the updates needed for the database.
Unable to get a connection to the database.  Please check your openmrs 
runtime properties file and make sure you have the correct 
connection.username and
connection.password set ...
.................................................................................
.................................................................................
Caused by: java.sql.SQLException: Access denied for user 'openmrs_user'@'localhost' (using password: YES)

 Although i have worked with the project over an year now, i was also first confused on why the webapp can not be started. But then i realized the fix.

This is simply because when we start the web app from a previous implementation it still uses some of the configuration from its past installation. 

If you go to "webapp" folder in the 'openmrs_home' repository, there is a file called "openmrs-runtime.properties" where there is previous configuration data (usernames, passwords etc.) still present. Now simply delete this file from /home/USER_NAME/.OpenMRS folder if it is present there. Then delete this file from the 'webapp' folder and start again using 'mvn jetty:run'. No more errors, You are good to go now  :) :)

Resolving "New XAMPP security concept" issue and opening phpMyAdmin console

Environment : Ubuntu 12.04 (Linux)

I was going to open the phpMyAdmin console after starting XAMPP server 1.8.1 where i was greeted with the following error message :D

Eventhough i was first confused, resolving this issue was not hard after having some web search. This is how to get it done.

As the error message informs first we have to find "httpd-xampp.conf" file. It is in the /opt/lampp/etc/extra directory. Open this file with root permission as we are going to edit it.

Note: /opt/lampp is the installation folder where i installed my XAMPP distribution. If you have installed it in another location go there and get into LAMPP_HOME/etc/extra directory.

Find the following section in the file.

<Directory "/opt/lampp/phpmyadmin">
  AllowOverride AuthConfig Limit
  Order allow,deny
  Allow from all
</Directory>

The error can be fixed by adding the following line in within the <Directory> tags.

Require all granted

So the edited section would look like,

<Directory "/opt/lampp/phpmyadmin">
  AllowOverride AuthConfig Limit
  Order allow,deny
  Allow from all
  Require all granted
</Directory>

Now click on phpMyAdmin link, the console will be opened now.

How to install XAMPP correctly in Linux (Ubuntu 12.04)

When you want to install Apache 2.0 server to try and test your services in the local computer, Apache XAMPP is an easy and straightforward solution which comes with combined MySQL and PHP packages.  Following is what you should do to install and run XAMPP in your computer.

1. Download latest version(or an older version if you need) of XAMPP from the 'XAMPP for Linux' page.

2. Use the following command and extract the downloaded distribution into /opt directory.

               sudo tar xvfz xampp-linux-1.8.1.tar.gz  -C /opt

You can replace xampp-linux-1.8.1.tar.gz with the version you have.

3. This will extract the content of XAMPP directory into /opt/lampp/. Now let's start the XAMPP server. Use the following command.
  
               sudo /opt/lampp/lampp start 

If all the configurations are correct XAMPP server will start now as follows.

Starting XAMPP for Linux 1.8.1...
XAMPP: Starting Apache with SSL (and PHP5)...
XAMPP: Starting MySQL...
XAMPP: Starting ProFTPD...
XAMPP for Linux started.

 4. Goto http://localhost from your browser and test whether this is correctly installed and started. You will be first directed to the language selection page and then the welcome page would be appeared as shown below.

XAMPP welcome page

 
 5. Stop the server when you are done :)

               sudo /opt/lampp/lampp stop 

 ...................................................................................................................................................

If everything goes fine as this you are good to go. However there may be times when you get error messages like this.

Starting XAMPP for Linux 1.8.1...
XAMPP: Starting Apache with SSL (and PHP5)...
XAMPP: Another MySQL daemon is already running.
XAMPP: Starting ProFTPD...
XAMPP for Linux started.

What this means is that XAMPP-MySQL is not started as you have another mysql-server instance is running in your local computer. Most probably you may have installed mysql-server-5.0 (or older version) previously into your computer. Therefore to start MySQL in XAMPP distribution we have to first stop this service. Use the following command.

            sudo service mysql stop  

The running mysql service will be stopped. Simple start the XAMPP server back and problem is fixed now :) Do the same and stop the apache2 service if you see that Apache server too hasn't started.

XAMPP: Another web server daemon is already running.
Use,     sudo service apache2 stop