Publish assets using the API-Postman-WSO2 Enterprise Store

At the moment there are two ways to publish an asset to the ES back-office.

1. Using the UI

Eg: - Browse https://localhost:9443/publisher/asset/ebook
You can find the following UI and add the new asset(ebook in this case)

2. Using the API

This is the subject that I'm going to talk in this post. I'm going to use Postman- REST client for google chrome and CURL to execute this API invocation.

First lets try out with Postman,

Prerequisite :
a) google chrome browser
b) Postman chrome-extension

Steps

i) Browse https://localhost:9443/publisher/ and login in to the back-office.
ii) Browse chrome://apps/ and launch Postman REST client.
iii) Refer following screen-shot and create the POST form-data accordingly.

Note
URL :  https://localhost:9443/publisher/api/asset/ebook
Type : POST

iv) Now you can invoke the API :)

You will receive the following output if it works right..

Lets browse the newly added ebook asset.

I will come up with a separate post on the topic POST multipart/form-data using CURL soon. So you can invoke the same above asset add API using CURL.

Fronting WSO2 Management Console UI with Nginx

I'm going to set up WSO2 API Manager & WSO2 BAM in Linux environment for this exercise.

Since I'm going to run both products within a single machine need following configuration change,

1. Update port offset configuration as follows within <BAM_HOME>/repository/conf/carbon.xml.

<Offset>1</Offset>

 For API Manager I'm going to use the default configurations.

2. Update /etc/hosts with following and update IP address according to your environment.

10.100.0.128 am.wso2.org
10.100.0.128 bam.wso2.org

 3. Use following configuration within Nginx and update  proxy_pass according to your environment.

server {
    listen 443;
    server_name am.wso2.org;
    ssl on;
        ssl_certificate /etc/nginx/ssl/server.crt;
        ssl_certificate_key /etc/nginx/ssl/server.key;

    location /carbon {
            index index.html;
            proxy_set_header X-Forwarded-Host $host;
            proxy_set_header X-Forwarded-Server $host;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_pass https://10.100.0.128:9443;
        }
    location /t {
            index index.html;
            proxy_set_header X-Forwarded-Host $host;
            proxy_set_header X-Forwarded-Server $host;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_pass https://10.100.0.128:9443;
        }
 }

server {
    listen 443;
    server_name bam.wso2.org;
    ssl on;
        ssl_certificate /etc/nginx/ssl/server.crt;
        ssl_certificate_key /etc/nginx/ssl/server.key;

    location /carbon {
            index index.html;
            proxy_set_header X-Forwarded-Host $host;
            proxy_set_header X-Forwarded-Server $host;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_pass https://10.100.0.128:9444;
        }
    location /t {
            index index.html;
            proxy_set_header X-Forwarded-Host $host;
            proxy_set_header X-Forwarded-Server $host;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_pass https://10.100.0.128:9444;
        }
 }

So in this configuration I'm having two server directives, one for API Manager and one for BAM.

Read this post if you need help on creating SSL certificates.

I'm done with the configuration now, lets browse our management console now.

If you type https://am.wso2.org/carbon you will get the API Manager Admin Console UI.

 
After logging using defualt username:admin ,password:admin you may create a new tenant using Home > Configure > Multitenancy > Add New Tenant.

Now try to log-in to that tenant. You will get the following,

Ok, Let's try the BAM admin console now. Browse https://bam.wso2.org/carbon ,

Log-in, create a tenant and try to login using those tenant credentials.

Hope this will help to configure any WSO2 Product with Nginx !!

[UES-357] Using IP address or domain name to access UES gadgets

You may get the following error and your gadgets won't work as expected if you try to use an IP address/domain name instead of the default URL with https.

Eg :-

Default :
https://localhost:9443/portal/gadgets/intro-gadget-2/intro-gadget-2.xml

Updated :
https://10.100.0.128:9443/portal/gadgets/intro-gadget-2/intro-gadget-2.xml
or
https://ues.udara.me/portal/gadgets/intro-gadget-2/intro-gadget-2.xml

Detailed error: 500 javax.net.ssl.SSLException: hostname in certificate didn't match: <10.100.1.128> != <localhost> shindig.js:9

By default all WSO2 products shipped with a self signed certificate for the domain localhost, to overcome this issue you have to create and add a certificate for your IP/Domain name.
 1. Lets assume you need to add a self signed certificate for your IP address(10.100.0.128), run following command and provide information when required, here I'm using wso2carbon as my keystore password so I don't have to do any configuration changes.

keytool -genkey -alias ues -keyalg RSA -keystore  ues.jks -keysize 2048

Note :- I have created ues.jks within /home/udara/key/ directory and you have to provide your IP or domain name as your first and last name (CN).

udara@thinkPad:~/key$ keytool -genkey -alias ues -keyalg RSA -keystore  ues.jks -keysize 2048
Enter keystore password: wso2carbon
Re-enter new password: wso2carbon
What is your first and last name?
  [Unknown]:  10.100.0.128
What is the name of your organizational unit?
  [Unknown]: 
What is the name of your organization?
  [Unknown]:  WSO2
What is the name of your City or Locality?
  [Unknown]:  Mountain View
What is the name of your State or Province?
  [Unknown]:  CA
What is the two-letter country code for this unit?
  [Unknown]:  US
Is CN=10.100.0.128, OU=Unknown, O=WSO2, L=Mountain View, ST=CA, C=US correct?
  [no]:  yes

Enter key password for <wso2carbon>
    (RETURN if same as keystore password):  wso2carbon
Re-enter new password: wso2carbon

2.Take a back-up of the current <UES_HOME>/repository/resources/security/ directory.

3.Run following command within <UES_HOME>/repository/resources/security/ directory to import your certificate into wso2carbon.jks.

Since I have created my ues.jks inside /home/udara/key/ directory in step-1,

udara@thinkPad:/wso2/support/workspace/wso2ues-1.0.0/repository/resources/security$ keytool -importkeystore -srckeystore /home/udara/key/ues.jks -destkeystore wso2carbon.jks -srcstoretype jks -deststoretype jks -srcstorepass wso2carbon -deststorepass wso2carbon
Entry for alias ues successfully imported.
Import command completed:  1 entries successfully imported, 0 entries failed or cancelled

4. Since we can't have two different private keys, lets delete the previous one.

udara@thinkPad:/wso2/support/workspace/wso2ues-1.0.0/repository/resources/security$ keytool -delete -alias wso2carbon -keystore wso2carbon.jks -storepass wso2carbon

5.  Lets export our public key from wso2carbon.jks and import it in to the client-truststore.jks.

I) Export public key from wso2carbon.jks as test.cer.

udara@thinkPad:/wso2/support/workspace/wso2ues-1.0.0/repository/resources/security$ keytool -export -keystore ues.jks -alias ues -file test.cer
Enter keystore password: 
Certificate stored in file <test.cer>

II) Import public certificate test.cer into client-truststore.jks.

udara@thinkPad:/wso2/support/workspace/wso2ues-1.0.0/repository/resources/security$ keytool -import -alias ues -file test.cer -keystore client-truststore.jks
Enter keystore password: 
Owner: CN=10.100.0.128, OU=Unknown, O=WSO2, L=Mountain View, ST=CA, C=US
Issuer: CN=10.100.0.128, OU=Unknown, O=WSO2, L=Mountain View, ST=CA, C=US
Serial number: 4a460fad
Valid from: Tue Apr 08 11:49:26 IST 2014 until: Mon Jul 07 11:49:26 IST 2014
Certificate fingerprints:
     MD5:  54:CD:B8:CD:7D:3D:B5:29:2B:A4:45:61:18:C9:5A:59
     SHA1: 53:03:B5:6D:32:D2:07:33:0D:49:7A:37:32:C7:13:DA:4E:29:60:28
     SHA256: C5:23:6D:09:F3:97:45:3A:F8:19:A1:F9:14:18:DE:BC:F3:C7:C9:C1:FF:0E:D9:E6:94:EF:DA:A3:6D:79:36:B9
     Signature algorithm name: SHA256withRSA
     Version: 3

Extensions:

#1: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 92 70 EA 1B 80 6B F8 07   84 0A D9 B0 FE 52 A3 41  .p...k.......R.A
0010: C0 DA B0 17                                        ....
]
]

Trust this certificate? [no]:  yes
Certificate was added to keystore

6. Since we have updated the key store alias from wso2carbon to ues, we have to modify this in few configs to make SSO works.

Update <UES_HOME>repository/conf/carbon.xml,

<KeyStore>
            <!-- Keystore file location-->
            <Location>${carbon.home}/repository/resources/security/wso2carbon.jks</Location>
            <!-- Keystore type (JKS/PKCS12 etc.)-->
            <Type>JKS</Type>
            <!-- Keystore password-->
            <Password>wso2carbon</Password>
            <!-- Private Key alias-->
            <KeyAlias>ues</KeyAlias>
            <!-- Private Key password-->
            <KeyPassword>wso2carbon</KeyPassword>
 </KeyStore>

If we take portal jaggery app(<UES_HOME>/repository/deployment/server/jaggeryapps/portal),

Update ssoConfiguration section in portal.json as follows,

    "ssoConfiguration" : {
        "enabled" : true,
        "issuer" : "portal",
        "identityProviderURL" : "%https.host%/sso/samlsso.jag",
        "keyStorePassword" : "wso2carbon",
        "identityAlias" : "ues",
        "responseSigningEnabled" : "true",
        "keyStoreName" : "/repository/resources/security/wso2carbon.jks",
        "storeAcs" : "%https.host%/store/sso.jag",
        "portalAcs" : "%https.host%/portal/sso.jag",
        "appAcsHost" : "%https.host%"
    }

You have to made the above update in all other jaggery apps within the  <UES_HOME>/repository/deployment/server/jaggeryapps/ directory.

Update ssoConfiguration section in portal/dashboard-template/files/login.jag.hbs, but in the lastest UES distribution you have to make this change within portal/dashboard-template/files/config.json.hbs.

        ssoConfiguration = {
            "enabled": true,
            "issuer": "{{appName}}",
            "identityProviderURL": config.ssoConfiguration.identityProviderURL,
            "keyStorePassword": "wso2carbon",
            "identityAlias": "ues",
            "responseSigningEnabled": "true",
            "keyStoreName": "/repository/resources/security/wso2carbon.jks"
        }

7. Restart WSO2 UES server.

If you browse Home>Configure>Key Stores>View Key Store, you can see the certificate of the private key section as follows.

By providing your IP address or domain name as the first and last name in step 1, you can overcome this host-name mismatch issue while loading UES gadgets.

You can refer this article[1] which explains how to create and add CA signed certificate to any Carbon product.

[1] . http://wso2.com/library/knowledge-base/2011/08/adding-ca-certificate-authority-signed-certificate-wso2-products/

Dashboard - Gadget communication using pub/sub within WSO2 UES

What is pub/sub?

This is a messaging pattern where message senders named publishers and consumers named subscribers. In this architecture publishers are not directly sending messages to consumers but sending to a channel where interesting parties(subscribers) subscribe to this channel and consume messages.

In this blog-post, portal or my dashboard acts as the publisher where user triggers any event to publish and simple gadget acts as the subscriber.

My requirement is to have something similar to the following, When user triggers "Publish a random number" button, dashboard should publish a random number to a predefined channel.Subscriber gadget subscribes to this channel and print the published random number.

How can we create this type of a dashboard?

Refer WSO2-UES documentation on how to create a gadget and how to add gadgets to dashboards.

Note :- 
If you browse <UES_HOME>/repository/deployment/server/jaggeryapps/portal/dashboard-template/files/ directory this is where we store template files for your dashboards. You may update index.jag.hbs file according to your preference, but keep in mind hereafter every time you create a dashboard, these changes will reflect on the dashboard.

Since our requirement is to have this template for all my dashboards, lets update the index.jag.hbs file.

You can find the full updated source gist here[1].
Note I have added the following HTML snippet to get the user input and display the published value.

<input type="button" value="Publish a random number" onclick="publish()"/>
<div id="output"> </div>

Also I have introduced following script, in order to publish a random number to the defined channel.

<script>
function publish() {
               var message = Math.random();
               UESContainer.inlineClient.publish('my-channel', message);
               document.getElementById("output").innerHTML = "Number that is published to the channel : " + message;
        }
</script>

Lets move to the gadget, you may find the source for this sample subscriber gadget here[2] and refer "Subscriber Gadget" section from this blog post[3] if you need to build the subscriber gadget from the scratch.

Interested about inter-gadget communication within WSO2-UES? you may refer the same blog post[3] done by tanya.

[1]. https://gist.github.com/udarakr/d9ebe3c32b64ec4e1ba0
[2]. https://svn.wso2.org/repos/wso2/people/tanya/pub-sub/subscriber/
[3] http://tanyamadurapperuma.blogspot.com/2013/12/inter-gadget-communication-with-wso2-ues.html

Simple web-app with SSO capability which showcase CarbonContext usage

I'm going to use WSO2 Application Server 5.2.1[1] and WSO2 Identity Server 4.5.0[2] to deploy simple web-app with SSO capability to showcase CarbonContext[3] usage.

Without writing this webapp from the scratch I will use/modify the SSOAgentSample which can find here[4].

First let's checkout the source from this location[4] and modify it for our purpose.

a) Open travelocity.properties which can find under SSOAgentSample/src/main/resources/ directory,

vi src/main/resources/travelocity.properties

b) Update following properties, update the port from 8080 to 9764 and comment out AttributeConsumingServiceIndex property.

#The URL of the SAML 2.0 Assertion Consumer
SAML.ConsumerUrl=http://localhost:9764/travelocity.com/samlsso-home.jsp

#Identifier given for the Service Provider for SAML 2.0 attributes
#exchange
#SAML.AttributeConsumingServiceIndex=1701087467

 c) Run following command within SSOAgentSample directory to build the webapp.

mvn clean install

 We are done with the sample webapp for now, but I will update this to showcase CarbonContext usage and provide source in github.

d) Start WSO2 Identity Server, run following within Identity Server home.

sh bin/wso2server.sh

e) Lets register a new service provider in IS, browse Home> Manage> SAML SSO
and press  Register New Service Provider link.Provide following details and press Register.

Issuer : travelocity.com
Assertion Consumer URL:http://localhost:9764/travelocity.com/samlsso-home.jsp

Select other stuff according to your requirements, I'm going to select
Enable Response Signing, Enable Assertion Signing, Enable Single Logout and Enable Attribute Profile. 

Since I'm going to display roles, email address and given name of the logged in user within webapp I will select and add following three claims.

http://wso2.org/claims/role
http://wso2.org/claims/emailaddress
http://wso2.org/claims/givenname

f) Lets upload our webapp to AS and start using a port offset. Copy travelocity.com.war from SSOAgentSample/target to <AS_HOME>/repository/deployment/server/webapps/ directory.

In my local setup,

cp target/travelocity.com.war /home/udara/wso2/workspace/wso2as-5.2.1/repository/deployment/server/webapps

Since I'm starting Application Server in the same local machine which Identity Server instance resides, In-order to avoid port conflicts lets update port-offset within <AS_HOME>repository/conf/carbon.xml.

 <Offset>1</Offset>

g) Start WSO2 Application Server, run following within Application Server home.

sh bin/wso2server.sh

h) Browse http://localhost:9764/travelocity.com/ and select login with SAML from Identity Server and it will automatically redirects to the Identity Server login page.

 



Provide your username/password and Identity Server will automatically redirects you back to the http://localhost:9764/travelocity.com/samlsso-home.jsp with claims that we select in step e.

CarbonContext[3] usage

Lets update our webapp to list down all users within same tenant.

Add following import statements to the src/main/webapp/samlsso-home.jsp file along with current import statements.

<%@page import="org.wso2.carbon.context.CarbonContext" %>
<%@page import="org.wso2.carbon.user.api.UserRealm" %>
Add following highlighted snippet to obtain the reference to the user-realm from the CarbonContext and print user list.

        </table>
        <a href="index.jsp">Go to Login page</a>
        <hr/>
        <!--Start of The user list-->
        <p><b>The user list</b></p>
            <%
                CarbonContext context = CarbonContext.getCurrentContext();
                UserRealm realm = context.getUserRealm();
                String[] names = realm.getUserStoreManager().listUsers("*", 100);
                    for (String name : names) {
                       %><%=name%><br/><%
                    }
            %>
            <!--End of The user list-->
        <form action="logout">
        <input type="submit" value="Logout">

i) Build(Step c) and re-deploy your webapp.
j) Browse http://localhost:9764/travelocity.com/samlsso-home.jsp and you will get,

I have created a repo to provide the updated source, you can find related repo here[5].


[1]. http://wso2.com/products/application-server/
[2]. http://wso2.com/products/identity-server/
[3]. http://docs.wso2.org/display/Carbon420/CarbonContext+API
[4]. https://svn.wso2.org/repos/wso2/carbon/platform/branches/turing/products/is/4.5.0/modules/samples/sso/SSOAgentSample/
[5]. https://github.com/udarakr/SSOAgentSample-1.0

Creating RabbitMQ Proxy Service in WSO2 ESB with different exchange types

You can follow documentation for RabbitMQ AMQP Transport here[1] if you wish to use exchange type as direct.According to the following implementation

if you don't specify the exchange type it will set to direct by default.

String exchangerType = properties.get(RabbitMQConstants.EXCHANGE_TYPE);
if (exchangerType != null) {
     String durable = properties.get(RabbitMQConstants.EXCHANGE_DURABLE);
         if (durable != null) {
              channel.exchangeDeclare(exchangeName, exchangerType, Boolean.parseBoolean(durable));
         } else {
              channel.exchangeDeclare(exchangeName, exchangerType, true);
         }
 } else {
      channel.exchangeDeclare(exchangeName, "direct", true);
 }

So how to use other exchange types such as topic, headers, x-consistent-hash etc...

Simple solution is to introduce the property "rabbitmq.exchange.type" to your proxy end-point URI.

Default sample proxy,

<proxy xmlns="http://ws.apache.org/ns/synapse" name="AMQPProxy" transports="rabbitmq" statistics="disable" trace="disable" startOnLoad="true">

   <target>

      <inSequence>

         <log level="full"/>

         <property name="OUT_ONLY" value="true"/>

         <property name="FORCE_SC_ACCEPTED" value="true" scope="axis2"/>

      </inSequence>

      <endpoint>

         <address

         uri="rabbitmq:/AMQPProxy?rabbitmq.server.host.name=localhost&rabbitmq.server.port=5672&rabbitmq.server.user.name=guest&rabbitmq.server.password=guest&rabbitmq.queue.name=queue2&rabbitmq.exchange.name=exchange2"/>

      </endpoint>

   </target>

   <parameter name="rabbitmq.queue.name">queue1</parameter>

   <parameter name="rabbitmq.exchange.name">exchange1</parameter>

   <parameter name="rabbitmq.connection.factory">AMQPConnectionFactory</parameter>

   <description></description>

</proxy>

Following is my updated end-point, which is going to use x-consistent-hash as the exchange type.

<endpoint>

         <address

         uri="rabbitmq:/AMQPProxy?rabbitmq.server.host.name=localhost&rabbitmq.server.port=5672&rabbitmq.server.user.name=guest&rabbitmq.server.password=guest&rabbitmq.queue.name=queue2&rabbitmq.exchange.type=x-consistent-hash&rabbitmq.exchange.name=exchange2"/>

      </endpoint>

[1]. http://docs.wso2.org/display/ESB460/RabbitMQ+AMQP+Transport

RabbitMQ Management and Configuration

While creating a RabbitMQ proxy service with WSO2 ESB, I googled a bit about management aspects of RabbitMQ and complied this post as a future reference.

I took the easiest way to install RabbitMQ by using a .deb downloaded from here[1]. Found that there are two main configuration files in RabbitMQ, rabbitmq-env.conf is to set up environment related details and rabbitmq.config to configure RabbitMQ core application, Erlang services and RabbitMQ plug-ins.But the most important fact to keep in mind is that these configuration files are not created by default.

For my purpose of moving from default port 5672 to 8080, I have created /etc/rabbitmq/rabbitmq.config file with the following content.

[ {rabbit, [{tcp_listeners, [8080]}]} ].

Then start/restart RabbitMQ server with the following command.

sudo service rabbitmq-server start

Since I haven't change any environment specific configurations yet, I can use the default RabbitMQ startup log to monitor startup process with following command.

tail -f /var/log/rabbitmq/startup_log

For easy management and configuration RabbitMQ do have a nice web UI. But you have to activate rabbitmq_management plugin in-order-to access it.

rabbitmq-plugins enable rabbitmq_management

Then,browse http://localhost:15672/#/ or if you have already changed the port same as me http://localhost:18080/#/.

For more information you can find out official documentation here[2].
 
[1]. http://www.rabbitmq.com/releases/rabbitmq-server/v3.0.2/
[2]. https://www.rabbitmq.com/