Welcome {state.username}
+ + + : + } + + ) +}; + +export default App; +``` + +If your React application is already running in the development mode, the home page will be reloaded and you will see the updated user interface. + +{: width="800" style="display: block; margin: 0;"} + +There may be instances where you’d need to retrieve user attributes outside React components. Asgardeo React SDK provides a [getBasicUserInfo](https://github.com/asgardeo/asgardeo-auth-react-sdk/blob/main/API.md#getbasicuserinfo){:target="_blank"} function, which allows you to retrieve the authenticated user’s basic information. The code example in the following section demonstrates this process and can be adapted to fit your application with any necessary customizations. + +Again, replace the code in `app.jsx` with the following. + +```javascript +import { useAuthContext } from "@asgardeo/auth-react"; +import { useEffect, useState } from "react"; +import './App.css'; + +const App = () => { + + const { state, getBasicUserInfo, signIn, signOut } = useAuthContext(); + const [userInfo, setUserInfo] = useState(undefined); + + useEffect(() => { + getBasicUserInfo().then((response) => { + setUserInfo(response) + }).catch((error) => { + console.error(error); + }); + }, [state]); + + + return ( + <> + { + state.isAuthenticated + ? <> +Welcome, {userInfo?.username}
+ + + : + } + + ) +}; + +export default App; +``` + +The above code snippet, the app utilizes the `useAuthContext` hook to access authentication state and methods such as `getBasicUserInfo`, `signIn`, and `signOut`. It also uses React's `useState` to store basic user information and `useEffect` to fetch this information whenever the authentication state changes. If the user is authenticated, the app displays a welcome message with the username and a button to log out. If the user is not authenticated, it shows a login button that triggers the sign-in process, and the errors during user info retrieval are handled by logging them to the console. + +Similarly, you can access the other user attributes, such as email, display name, allowed scopes, etc as well. The following code snippet shows you how you can access them in your app. Asgardeo React SDK is responsible for processing the ID token and decoding these attributes. + +```javascript +Your email: { userInfo?.email }
+Display name: { userInfo?.displayName }
+Allowed scopes: { userInfo?.allowedScopes }
+Tenant domain: { userInfo?.tenantDomain }
+Session state: { userInfo?.sessionState }
+``` + +## Getting additional user attributes + +Other than the above attributes decoded and available to you by default, Asgardeo React SDK provides [getDecodedIDToken](https://github.com/asgardeo/asgardeo-auth-react-sdk/blob/main/API.md#getdecodedidtoken){:target="_blank"} method to access any other user attributes that are not exposed by `getBasicUserInfo`. This method will decode the ID token in browser storage and return the output as a JSON object. + +To get additional user attributes to the ID token, the application should be configured to request the specific user attributes at the time of login. For example, if you want to retrieve a user's mobile number as an attribute, you need to configure the application to request the user’s mobile number as an attribute in the ID token. + +1. Log in to the {{product_name}} console and select the application you created. +2. Go to the **User Attributes** tab. +3. Select the **phone** scope. +4. Expand the scope, and you will see that all attributes under this scope (e.g., `mobile_number`) are selected. +5. Click Update to save the changes. + +```javascript + +const { state, signIn, signOut, getDecodedIDToken } = useAuthContext(); + + +const [mobileNumber, setMobileNumber] = useState("") + + +useEffect(() => { + if (state.isAuthenticated) { + getDecodedIDToken().then((decodedIdToken) => { + console.log(decodedIdToken); + setMobileNumber(decodedIdToken.phone_number) + }).catch((error) => { + console.log(error); + }) + } +}, [ state.isAuthenticated ]); + + +return ( + <> +Your mobile number: {mobileNumber}
+ +) + +``` + +In the above code snippet, we run the `getDecodedIDToken` method if the user is authenticated, and print the output to the browser console. The decoded ID token response will be printed to the browser console as follows. + +{: width="800" style="display: block; margin: 0;"} + +In this step, we further improved our React app to display the user attributes. As the next step, we will try to secure routes within the app. diff --git a/en/asgardeo/docs/complete-guides/react/install-asgardeo-sdk.md b/en/asgardeo/docs/complete-guides/react/install-asgardeo-sdk.md new file mode 100644 index 0000000000..abd64ac518 --- /dev/null +++ b/en/asgardeo/docs/complete-guides/react/install-asgardeo-sdk.md @@ -0,0 +1,72 @@ +--- +template: templates/complete-guide.html +heading: Install and configure Asgardeo SDK +read_time: 2 min +--- + +## Install @asgardeo/auth-react + +The Asgardeo React SDK is a production-ready SDK that simplifies integrating {{product_name}} as an Identity Provider in your React applications. It provides essential features like user authentication, retrieving user information, and an HTTP client for sending network requests with attached tokens. Additionally, it ensures best practices by being Secure by Design and Secure by Default. + +!!! Info + + Asgardeo React SDK has been developed on open standards such as OAuth2, OpenID Connect etc, therefore you can use the Asgardeo React SDK for adding authentication to your application with any other OpenID Connect identity provider such as [WSO2 Identity Server (WSO2 IS)](https://wso2.com/identity-server/){:target="_blank"} and WSO2 [Private Identity Cloud (WSO2 PIC)](https://wso2.com/private-identity-cloud/){:target="_blank"} . + +As the next step, run the following command to install the React SDK from the npm registry. + +```bash +npm install @asgardeo/auth-react + +``` + +## Add `| Field name | -Description | -||
|---|---|---|---|
| Email Address | -Provide the email address to which the invitation email should be sent. This email address will be used as the admin's username in Asgardeo. Note that a username is always unique to the organization, and you can't change it once it is created. |
+ Email Address | +The invitation will be sent to this email address. Additionally, this email address will be used as the username of this administrator. + Usernames are always unique to an organization. Once created, they cannot be modified. + |
| Role | -The Administrator role is assigned by default. For details on the available user roles and the permissions assigned to them, see [Asgardeo User Roles]({{base_path}}/references/user-management/user-roles/). |
+ Role | +Users can be assigned one or more default roles. For details on the available user roles and the permissions assigned to them, see [Asgardeo User Roles]({{base_path}}/references/user-management/user-roles/). |
| This includes administrators whose identity is managed by Asgardeo. | ||
| {org_name} organization | +{organization_name} organization | This includes administrators whose identity is managed by the {org_name} organization. |
|---|
| Attribute name | -is_migrated | -
| Attribute Display Name | -Password migration status | -
Hello {{ username }}!
+ + +``` + + diff --git a/en/asgardeo/docs/quick-starts/nextjs.md b/en/asgardeo/docs/quick-starts/nextjs.md new file mode 100644 index 0000000000..2bb2067362 --- /dev/null +++ b/en/asgardeo/docs/quick-starts/nextjs.md @@ -0,0 +1,304 @@ +--- +template: templates/quick-start.html +heading: Next.JS Quickstart +description: Welcome to the Next.js Quickstart guide! In this document, you will learn to build a Next.js app, add user login and display user profile information using Asgardeo. +what_you_will_learn: + - Create new Next.js app + - Install Asgardeo provider for Auth.js + - Add user login and logout + - Display user profile information +prerequisites: + - About 15 minutes + - Asgardeo account + - Install a JS package manager + - A favorite text editor or IDE +# source_code: Next.js App Sample +whats_next: + # - Try out {{ product_name }} complete React guide + # - Try out {{product_name}} user onboarding complete guide for React + # - Read security best practices for React app guide +--- +## Configure an Application in {{ product_name }} + +- Sign into {{ product_name }} console and navigate to **Applications > New Application.** +- Select **Traditional Web Application** and complete the wizard popup by providing a suitable name and an authorized redirect URL.(*Ensure that the protocol remains set to OpenID Connect (OIDC).)* + +*Example:* + +- *Name - asgardeo-nextjs* +- *Authorized redirect URL - http://localhost:3000/api/auth/callback/asgardeo* + + + +!!! Info + + The authorized redirect URL determines where {{product_name}} should send users after they successfully log in. Typically, this will be the web address where your app is hosted. For this guide, we'll use ` http://localhost:3000/api/auth/callback/asgardeo`, as the authorized redirect URL . + +!!! note + + Make a note of the following values from the **Protocol** and **Info** tabs of the registered application. You will need them during the **Step 4** + + - **`client-id`** from the **Protocol** tab. + - **`client-secret`** from the **Protocol** tab. + - **`issuer`** from from the **Info** tab. + +## Create a Next.js app + +Create your new Next.js app. + +=== "npm" + + ``` bash + npx create-next-app@latest --typescript asgardeo-nextjs + + cd asgardeo-nextjs + + npm install + + npm run dev + ``` + +=== "yarn" + + ``` bash + yarn create next-app --typescript asgardeo-nextjs + + cd asgardeo-nextjs + + yarn install + + yarn dev + ``` + +=== "pnpm" + + ``` bash + pnpm create next-app --typescript asgardeo-nextjs + + cd asgardeo-nextjs + + pnpm install + + pnpm run dev + ``` + +## Install Auth.js library + +Auth.js is a lightweight JavaScript library designed for simplifying authentication workflows in web application. The [Asgardeo provider for Auth.js](https://authjs.dev/reference/core/providers/asgardeo){:target="_blank"} offers all the components and hooks you need to integrate your app with {{product_name}}.To get started, simply add Auth.js library to the project. Make sure to stop the dev server started in the previous step. + +=== "npm" + + ``` bash + npm install next-auth@beta + ``` + +=== "yarn" + + ``` bash + yarn add next-auth@beta + ``` + +=== "pnpm" + + ``` bash + pnpm add next-auth@beta + ``` + +Next, generate **`AUTH_SECRET`** environment variable. + +=== "npm" + + ``` bash + npx auth secret + + ``` +=== "yarn" + + ``` bash + yarn dlx auth secret + ``` + +=== "pnpm" + + ``` bash + pnpm dlx auth secret + ``` + +Add following entries to the .env or .env.local file, and make sure to replace the placeholders in the following code with the **`client-id`**, **`client-secret`** and **`issuer`** values you copied in **Step-1** during the application registration in the {{product_name}} console. + + +```bash title=".env.local" + AUTH_ASGARDEO_ID="
+ {
+ !session ? (
+
+ ) : (
+ <>
+
+ );
+}
+```
+
+Visit your app's homepage at [http://localhost:3000](http://localhost:3000).
+
+!!! Important
+
+ You need to create a test user in {{ product_name }} by following this [guide]({{ base_path }}/guides/users/manage-users/#onboard-single-user){:target="_blank"} to tryout login and logout features.
+
+## Display logged in user details
+
+Modified the code as below to see logged in user details.
+
+```javascript title="auth.ts" hl_lines="14-29"
+
+import NextAuth from "next-auth"
+import Asgardeo from "next-auth/providers/asgardeo"
+
+declare module "next-auth" {
+ interface User {
+ username?: string;
+ }
+}
+
+export const { handlers, signIn, signOut, auth } = NextAuth({
+ providers: [Asgardeo({
+ issuer: process.env.AUTH_ASGARDEO_ISSUER
+ })],
+ callbacks: {
+ async jwt({ token, profile }) {
+ if (profile) {
+ token.username = profile.username;
+ }
+
+ return token;
+ },
+ async session({ session, token }) {
+ if (token) {
+ session.user.username = token.username as string;
+ }
+
+ return session;
+ }
+ }
+})
+
+```
+
+Then, update `page.tsx` with the following highlighted line to display the username of logged in user.
+
+```javascript title="page.tsx" hl_lines="4"
+
+...
+<>
+ You are now signed in!
+ + + + ) + } +You are now signed in!
+hello {session.user?.username}
+ + +... + +``` + diff --git a/en/asgardeo/docs/quick-starts/react.md b/en/asgardeo/docs/quick-starts/react.md index 385d7e5caf..dbb521092d 100644 --- a/en/asgardeo/docs/quick-starts/react.md +++ b/en/asgardeo/docs/quick-starts/react.md @@ -9,32 +9,32 @@ what_you_will_learn: - Display user profile information prerequisites: - About 15 minutes - - Asgardeo account + - Asgardeo account - Install a JS package manager - A favorite text editor or IDE source_code: React Vite App Sample whats_next: - - Try out Asgardeo complete React guide - - Try out Asgardeo user onboarding complete guide for React - - Read Asgardeo security best practices for React app guide + - Try out {{ product_name }} complete React guide + - Try out {{product_name}} user onboarding complete guide for React + - Read security best practices for React app guide --- -## Configure an Application in Asgardeo +## Configure an Application in {{ product_name }} -- Sign into Asgardeo console and navigate to Applications > New Application. +- Sign into {{ product_name }} console and navigate to Applications > New Application. - Select Single Page Application and complete the wizard popup by providing a suitable name and an authorized redirect URL - Name - Asgardeo-React - Authorized redirect URL - `http://localhost:5173` -!!! abstract +!!! Info The authorized redirect URL determines where Asgardeo should send users after they successfully log in. Typically, this will be the web address where your app is hosted. For this guide, we'll use`http://localhost:5173`, as the sample app will be accessible at this URL. !!! note - Note down the following values : you will need them during the**Step 4** + Note down the following values : you will need them during the **Step 4** - -`client-id` + - `client-id` - `base-url` - `redirect-url` @@ -80,19 +80,25 @@ Create (a.k.a scaffold) your new React app using Vite. ## Install @asgardeo/auth-react -Asgardeo React SDK provides all the components and hooks you need to integrate Asgardeo into your app. To get started, simply add the Asgardeo React SDK to the project. +Asgardeo React SDK provides all the components and hooks you need to integrate Asgardeo into your app. To get started, simply add the Asgardeo React SDK to the project. Make sure to stop the dev server started in the previous step. === "npm" - ``bash npm install @asgardeo/auth-react `` + ``` bash + npm install @asgardeo/auth-react + ``` === "yarn" - ``bash yarn add @asgardeo/auth-react `` + ``` bash + yarn add @asgardeo/auth-react + ``` === "pnpm" - ``bash pnpm add @asgardeo/auth-react `` + ``` bash + pnpm add @asgardeo/auth-react + ``` ## Add `Welocme {state.username}
- - - : - } + { + state.isAuthenticated ? + <> +Welcome {state.username}
+ + + : + } ) }; diff --git a/en/asgardeo/docs/references/actions/pre-issue-access-token-action/api/pre-issue-access-token-action-v1.yaml b/en/asgardeo/docs/references/actions/pre-issue-access-token-action/api/pre-issue-access-token-action-v1.yaml index e6596fb467..83146be1de 100644 --- a/en/asgardeo/docs/references/actions/pre-issue-access-token-action/api/pre-issue-access-token-action-v1.yaml +++ b/en/asgardeo/docs/references/actions/pre-issue-access-token-action/api/pre-issue-access-token-action-v1.yaml @@ -24,15 +24,26 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/SuccessResponse' - example: - - actionStatus: SUCCESS - operations: - - op: add - path: /accessToken/claims/- - value: - name: customSID - value: "12345" + oneOf: + - $ref: '#/components/schemas/SuccessResponse' + - $ref: '#/components/schemas/FailedResponse' + examples: + successExample: + summary: Success response + value: + actionStatus: SUCCESS + operations: + - op: add + path: /accessToken/claims/- + value: + name: customSID + value: "12345" + failedExample: + summary: Failed response + value: + actionStatus: FAILED + failureReason: invalid_scope + failureDescription: "The requested scope is invalid, unknown, or malformed." "400": description: Bad Request content: @@ -41,7 +52,7 @@ paths: $ref: '#/components/schemas/ErrorResponse' example: - actionStatus: ERROR - error: invalid_request + errorMessage: invalid_request errorDescription: SID claim is missing "500": description: Server Error @@ -51,7 +62,7 @@ paths: $ref: '#/components/schemas/ErrorResponse' example: - actionStatus: ERROR - error: server_error + errorMessage: server_error errorDescription: Failed to process the response components: schemas: @@ -282,6 +293,20 @@ components: items: $ref: '#/components/schemas/Operations' description: Defines the success response. + FailedResponse: + type: object + properties: + actionStatus: + type: string + enum: + - FAILED + description: Indicates the outcome of the request. For a failed operation, this should be set to FAILED. + failureReason: + type: string + description: Provides the reason for failing to issue an access token. + failureDescription: + type: string + description: Offers a detailed explanation of the failure. ErrorResponse: type: object properties: @@ -290,16 +315,15 @@ components: enum: - ERROR description: Indicates the outcome of the request. For an error operation, this should be set to ERROR. - error: + errorMessage: type: string - description: The error code, as specified in OAuth 2.0 error response definitions. + description: The cause of the error. errorDescription: type: string description: A detailed description of the error. description: | - When the external service responds with an ERROR state, it can return an HTTP status code of 400, 401, or 500, indicating that the expected validations are not met or there is an issue processing the request. - - If the defined error response is not received, or if the external service fails to respond, this is identified as an error in executing the action. In such cases, the flow will proceed as if the action was not applied, ensuring that the process continues without disruption. + When the external service responds with an ERROR state, it can return an HTTP status code of 400, 401, or 500, indicating either a validation failure or an issue processing the request. + RequestBody: type: object properties: diff --git a/en/asgardeo/docs/references/user-management/user-roles.md b/en/asgardeo/docs/references/user-management/user-roles.md index 0851c781f5..0d3339be79 100644 --- a/en/asgardeo/docs/references/user-management/user-roles.md +++ b/en/asgardeo/docs/references/user-management/user-roles.md @@ -1,108 +1,94 @@ # Asgardeo user roles -Roles consist of the permissions that are required by users to access the Asgardeo resources such as functions available on the Asgardeo Console, REST APIs, etc. +Roles determine permissions for accessing Asgardeo resources such as functionalities in the Asgardeo Console and underline REST APIs. -When you assign a role to a user, you are controlling what the user can do in Asgardeo. +The following roles, available by default, determine the options available for privileged users in the Asgardeo Console. -By default, Asgardeo has the **Administrator** user role. This role includes all administrative permissions in the organization. An organization can have many users with the administrator role. An administrator is a privileged user who has overall access to the organization. +!!! note - -The following list contains the permissions enabled for an Administrator: - -## User management -- View users -- Onboard users -- Update user profiles -- Delete users -- Terminate sessions -- View groups -- Create groups -- Update and delete groups -- View assigned users to groups -- Assign users to groups -- Assign users to groups -- View roles -- Create roles -- Update and delete roles -- Assign users to roles -- Assign groups to roles -- -## Application management -- View apps and app settings -- Register apps -- Update and delete apps -- Update Sign-in methods -- Update protocol settings - -## Connections management -- View connections and connection settings -- Create new connection -- Update and delete connections - -## Organization management -- Create new organizations -- View all the organizations created -- As the organization creator, update and delete organizations that you created -- Switch to the organizations that you created -- Share applications from the organization (root) to its organizations - -## Managing attributes and scopes -- View attributes -- Create new attributes -- Update and delete attributes -- View scopes -- Add new attributes to scopes -- Update and delete scopes +| Administrator | +This role provides all administrative permissions in the organization. An administrator is a privileged user who has overall access to the organization. | +
| Auditor | +This role provides list and view permissions to Asgardeo resources. With read-only access to all resources in the Asgardeo Console, it is ideal for troubleshooting issues and supporting other users within the organization.. | +
| Editor - Applications | +This role provides permissions for registering and managing applications, ideal for privileged users who can integrate applications with Asgardeo. | +
| Viewer - Applications | +This role provides permissions for viewing applications and their settings. It is designed for users who need read-only access to applications and their integration settings. | +
| Editor - Users | +This role provides permissions for managing users and groups within the organization. | +
| Viewer - Users | +This role provides permissions required for viewing users and groups. | +
| Editor - Connections | +This role provides permissions for managing connections, ideal for a privileged user who can manage enterprise logins, social logins and MFA options available within the organization. | +
diff --git a/en/asgardeo/features.json b/en/asgardeo/features.json new file mode 100644 index 0000000000..4d55f436af --- /dev/null +++ b/en/asgardeo/features.json @@ -0,0 +1,19 @@ +{ + "asgardeo_logs": { + "enabled": true, + "page": [ + "guides/asgardeo-logs/index.md", + "guides/asgardeo-logs/diagnostic-logs.md", + "guides/asgardeo-logs/audit-logs.md" + ] + }, + + "applications": { + "enabled": true, + "page": [ + "guides/applications/register-single-page-app.md", + "guides/applications/register-oidc-web-app.md", + "guides/applications/register-saml-web-app.md" + ] + } +} diff --git a/en/asgardeo/hooks.py b/en/asgardeo/hooks.py new file mode 100644 index 0000000000..6cc462c786 --- /dev/null +++ b/en/asgardeo/hooks.py @@ -0,0 +1,53 @@ +import os +import json +from mkdocs.structure.nav import Section, Page, Link + +def parse_json(file_path): + features_to_remove = {"feature": {}, "page": []} + with open(file_path, 'r') as json_file: + parse_data = json.load(json_file) + for feature, details in parse_data.items(): + enabled = details['enabled'] + page = details['page'] + features_to_remove['feature'][feature] = enabled + + if not enabled: + features_to_remove['page'].extend(page) + json_file.close() + return features_to_remove + +files_to_remove = parse_json(os.path.join(os.getcwd(), 'features.json')) + +def on_files(files, config): + for file in list(files): + if file.src_uri in files_to_remove['page']: + files.remove(file) + return files + +def remove_nav_item(nav_items): + filtered_items = [] + + for item in nav_items: + if isinstance(item, dict): + if any(page in item.values() for page in files_to_remove['page']): + continue + for key, value in item.items(): + if isinstance(value, list): + value = remove_nav_item(value) + item[key] = value + item = {k: v for k, v in item.items() if not (isinstance(v, list) and not v)} + if item: + filtered_items.append(item) + elif isinstance(item, list): + if item: + filtered_items.append(item) + + return filtered_items + +def on_config(config): + + for feature, enabled in files_to_remove['feature'].items(): + config[feature] = enabled + + config['nav'] = remove_nav_item(config['nav']) + return config diff --git a/en/asgardeo/mkdocs.yml b/en/asgardeo/mkdocs.yml index 3a61b4f7a0..845eda7e4a 100644 --- a/en/asgardeo/mkdocs.yml +++ b/en/asgardeo/mkdocs.yml @@ -33,6 +33,7 @@ extra: product: asgardeo product_name: *site_name nav_list: + - Home - Get Started - Guides - Tutorials @@ -93,6 +94,9 @@ watch: - ../theme/material - ../base.yml +hooks: + - hooks.py + plugins: - search - markdownextradata: {} @@ -123,6 +127,19 @@ plugins: 'references/application-logs.md' : 'guides/asgardeo-logs.md' 'apis/oauth-dcr.md' : 'apis/dynamic-client-registration-rest-api.md' '/guides/authorization/impersonation/user-impersonation/' : '/guides/authorization/user-impersonation/' + 'guides/branding/localization-in-asgardeo.md': 'guides/branding/localization.md' + +exclude_docs: | + /get-started/hello-world.md + +not_in_nav: | + /page-not-found.md + /get-started/explore-asgardeo.md + /get-started/start-integrating-apps.md + /get-started/try-samples/index.md + /get-started/try-your-own-app/index.md + /get-started/try-your-own-app/angular.md + /get-started/hello-world.md # Navigation nav: @@ -271,9 +288,9 @@ nav: - Manage roles: guides/users/manage-roles.md - Manage active sessions: guides/users/manage-sessions.md - Migrate users to Asgardeo: - - Migrate users to Asgardeo: guides/users/migrate-users-to-asgardeo/index.md - - Migrate user accounts: guides/users/migrate-users-to-asgardeo/migrate-users.md - - Migrate user passwords: guides/users/migrate-users-to-asgardeo/migrate-passwords.md + - Migrate users to Asgardeo: guides/users/migrate-users/index.md + - Migrate user accounts: guides/users/migrate-users/migrate-users.md + - Migrate user passwords: guides/users/migrate-users/migrate-passwords.md - Manage attributes and mappings: - Manage attributes and mappings: guides/users/attributes/index.md - User attributes: guides/users/attributes/manage-attributes.md @@ -333,7 +350,7 @@ nav: - Branding AI: guides/branding/ai-branding.md - Configure custom domains: guides/branding/configure-custom-domains.md - Customize email templates: guides/branding/customize-email-templates.md - - Localization in Asgardeo: guides/branding/localization-in-asgardeo.md + - Localization in Asgardeo: guides/branding/localization.md - Extend with actions: - Understanding actions: guides/customize/actions/understanding-actions.md - Setting up actions: guides/customize/actions/setting-up-actions.md @@ -409,8 +426,8 @@ nav: - Session extension API: apis/extend-sessions.md - User store management API: apis/user-store.md - Validation API: apis/validation.md - - Orgnization APIs: - - Orgnization APIs: apis/organization-apis/index.md + - Organization APIs: + - Organization APIs: apis/organization-apis/index.md - Get access for organization APIs: apis/organization-apis/authentication.md - Application management API: apis/organization-apis/org-application-management.md - Authenticators API: apis/organization-apis/org-authenticators.md @@ -474,6 +491,29 @@ nav: - Client-request: references/token-binding/client-request.md - Financial-grade API: references/financial-grade-api.md - App-native authentication: references/app-native-authentication.md + - React Guide: + - Introduction: complete-guides/react/introduction.md + - Prerequisite: complete-guides/react/prerequisite.md + - Configure an application: complete-guides/react/register-an-application.md + - Create a React app: complete-guides/react/create-a-react-app.md + - Configure Asgardeo SDK: complete-guides/react/install-asgardeo-sdk.md + - Add login and logout: complete-guides/react/add-login-and-logout.md + - Display user details: complete-guides/react/display-logged-in-user-details.md + - Securing Routes: complete-guides/react/securing-routes-within-the-app.md + - Accessing protected API : complete-guides/react/accessing-protected-api.md + - Manage tokens in React : complete-guides/react/manage-tokens-in-React-apps.md + - Next Steps: complete-guides/react/next-steps.md + - Node.js Guide: + - Introduction: complete-guides/nodejs/introduction.md + - Prerequisite: complete-guides/nodejs/prerequisite.md + - Configure an application: complete-guides/nodejs/register-an-application.md + - Create a Node.js app: complete-guides/nodejs/create-a-nodejs-app.md + - Configure Passport Asgardeo: complete-guides/nodejs/install-passport-asgardeo.md + - Add login and logout: complete-guides/nodejs/add-login-and-logout.md + - Display user details: complete-guides/nodejs/display-logged-in-user-details.md + - Securing Routes: complete-guides/nodejs/securing-routes-within-the-app.md + - Accessing protected API : complete-guides/nodejs/accessing-protected-api.md + - Next Steps: complete-guides/nodejs/next-steps.md not_in_nav: | /page-not-found.md diff --git a/en/asgardeo/requirements.txt b/en/asgardeo/requirements.txt index 287caf7b03..a3849ac591 100644 --- a/en/asgardeo/requirements.txt +++ b/en/asgardeo/requirements.txt @@ -1,4 +1,4 @@ -mkdocs==1.5.3 +mkdocs==1.6.1 Pygments==2.14.0 pymdown-extensions==10.3.1 mkdocs-minify-plugin==0.6.2 @@ -6,10 +6,12 @@ mkdocs-markdownextradata-plugin==0.2.5 mkdocs-redirects==1.2.0 pathlib==1.0.1 mkdocs-material==9.1.2 -markdown==3.2.1 +markdown==3.3.6 mkdocs-redirects==1.2.0 mkdocs-exclude==1.0.2 markdown-include==0.8.1 jinja2==3.1.2 mkdocs-glightbox==0.3.4 -mkdocs-include-markdown-plugin==6.0.0 \ No newline at end of file +mkdocs-include-markdown-plugin==6.0.0 +mkdocs-macros-plugin==1.2.0 +mkdocs-exclude==1.0.2 diff --git a/en/base.yml b/en/base.yml index 6576b8d5e4..af3eabfd89 100644 --- a/en/base.yml +++ b/en/base.yml @@ -29,6 +29,8 @@ theme: - navigation.indexes - navigation.path - navigation.top + - navigation.footer + - navigation.instant.progress - content.code.copy - content.action.edit - content.action.view @@ -104,13 +106,13 @@ extra: integrations: - name: Auth React SDK icon: assets/img/logo/react-logo.svg - description: An SDK to integrate {{ config.extra.product_name }} into React applications + description: An SDK to integrate {{ product_name }} into React applications documentation_link: get-started/try-your-own-app/react/ download_link: https://github.com/asgardeo/asgardeo-auth-react-sdk/releases/latest/download/asgardeo-react-app.zip source_link: https://github.com/asgardeo/asgardeo-auth-react-sdk - name: Auth SPA SDK icon: assets/img/logo/javascript-logo.svg - description: An SDK to integrate {{ config.extra.product_name }} into single page applications + description: An SDK to integrate {{ product_name }} into single page applications documentation_link: get-started/try-your-own-app/javascript/ download_link: https://github.com/asgardeo/asgardeo-auth-spa-sdk/releases/latest/download/asgardeo-html-js-app.zip source_link: https://github.com/asgardeo/asgardeo-auth-spa-sdk @@ -126,7 +128,7 @@ extra: - name: Auth Node SDK icon: assets/img/logo/expressjs-logo.svg dark_icon: assets/img/logo/expressjs-logo-dark.svg - description: An SDK to integrate {{ config.extra.product_name }} into JS/TS-based frameworks such as ExpressJS + description: An SDK to integrate {{ product_name }} into JS/TS-based frameworks such as ExpressJS source_link: https://github.com/asgardeo/asgardeo-auth-node-sdk - name: Tomcat OIDC Agent icon: assets/img/logo/java-logo.svg @@ -159,7 +161,7 @@ extra: source_link: https://github.com/openid/AppAuth-iOS - name: Android Mobile UI SDK icon: assets/img/logo/android-logo.svg - description: A client SDK to integrate {{ config.extra.product_name }} into Android mobile applications using "app-native authentication" + description: A client SDK to integrate {{ product_name }} into Android mobile applications using "app-native authentication" documentation_link: https://asgardeo.github.io/mobile-ui-sdks/android/introduction.html source_link: https://github.com/asgardeo/mobile-ui-sdks/tree/main/android redoc_theme: '{ diff --git a/en/identity-server/6.0.0/docs/references/about-this-release.md b/en/identity-server/6.0.0/docs/references/about-this-release.md index 622929c597..fe92ccb952 100644 --- a/en/identity-server/6.0.0/docs/references/about-this-release.md +++ b/en/identity-server/6.0.0/docs/references/about-this-release.md @@ -133,7 +133,8 @@ The following features are removed from WSO2 Identity Server 6.0.0. - H2 Console - Embedded LDAP user store - Carbon metrics -- Yahoo authenticator +- Yahoo authenticator +- Legacy OpenID authentication - reCAPTCHA v2 "I'm not a robot" Checkbox - Hazelcast DNS based pod discovery in Kubernetes membership scheme diff --git a/en/identity-server/6.1.0/docs/apis/restapis/application.yaml b/en/identity-server/6.1.0/docs/apis/restapis/application.yaml index adc620d5d6..ab0008eb7f 100644 --- a/en/identity-server/6.1.0/docs/apis/restapis/application.yaml +++ b/en/identity-server/6.1.0/docs/apis/restapis/application.yaml @@ -1,8 +1,7 @@ openapi: 3.0.0 info: description: > - This document specifies an **Application Management RESTful API** for **WSO2 - Identity Server**. + This document specifies an **Application Management RESTful API** for **WSO2 Identity Server**. version: "v1" title: WSO2 Identity Server - Application Management Rest API termsOfService: 'http://swagger.io/terms/' @@ -13,7 +12,6 @@ info: license: name: Apache 2.0 url: 'http://www.apache.org/licenses/LICENSE-2.0.html' - security: - OAuth2: [] - BasicAuth: [] @@ -24,7 +22,7 @@ paths: - Applications operationId: getAllApplications summary: | - List applications + List applications. description: | This API provides the capability to retrieve the list of applications.
Permission required:
@@ -77,15 +75,11 @@ paths: tags: - Applications summary: | - Add application + Add application. operationId: createApplication description: > - This API provides the capability to store the application information - that is provided by users.
- Permission required:
- * /permission/admin/manage/identity/applicationmgt/create
- Scope required:
- * internal_application_mgt_create + This API provides the capability to store the application information that is provided by users.
+ Scope(Permission) required: `internal_application_mgt_create` parameters: - in: query name: template @@ -142,15 +136,12 @@ paths: tags: - Applications summary: | - Create application from an exported XML file + Create application from an exported XML, YAML, or JSON file. operationId: importApplication description: > - This API provides the capability to store the application information, - provided as a file.
- Permission required:
- * /permission/admin/manage/identity/applicationmgt/create
- Scope required:
- * internal_application_mgt_create + This API provides the capability to create an application based on the + information provided in an XML, YAML, or JSON file.
+ Scope(Permission) required: `internal_application_mgt_create` requestBody: content: multipart/form-data: @@ -191,14 +182,12 @@ paths: tags: - Applications summary: | - Update application from an exported XML file + Update application from an exported XML, YAML, or JSON file. operationId: importApplicationForUpdate description: > - This API provides the capability to update an application from information that has been exported as an XML file.
- Permission required:
- * /permission/admin/manage/identity/applicationmgt/update
- Scope required:
- * internal_application_mgt_update + This API provides the capability to update an application based on the + information provided in an XML, YAML, or JSON file.
+ Scope(Permission) required: `internal_application_mgt_update` requestBody: content: multipart/form-data: @@ -241,20 +230,16 @@ paths: application/json: schema: $ref: '#/components/schemas/Error' - '/applications/{applicationId}': + /applications/{applicationId}: get: tags: - Applications summary: | - Retrieve application by ID + Retrieve application by ID. operationId: getApplication description: > - This API provides the capability to retrieve the application information - by ID.
- Permission required:
- * /permission/admin/manage/identity/applicationmgt/view
- Scope required:
- * internal_application_mgt_view + This API provides the capability to retrieve the application information by ID.
+ Scope(Permission) required: `internal_application_mgt_view` parameters: - name: applicationId in: path @@ -300,19 +285,15 @@ paths: application/xml: schema: $ref: '#/components/schemas/Error' - patch: tags: - Applications summary: | - Partially update application by ID + Partially update application by ID. operationId: patchApplication description: | - This API provides the capability to partially update an application by ID.
- Permission required:
- * /permission/admin/manage/identity/applicationmgt/update
- Scope required:
- * internal_application_mgt_update + This API provides the capability to partially update an application by ID.
+ Scope(Permission) required: `internal_application_mgt_update` parameters: - name: applicationId in: path @@ -356,14 +337,11 @@ paths: tags: - Applications summary: | - Delete application by ID + Delete application by ID. operationId: deleteApplication description: | This API provides the capability to delete an application by ID.
- Permission required:
- * /permission/admin/manage/identity/applicationmgt/delete
- Scope required:
- * internal_application_mgt_delete + Scope(Permission) required: `internal_application_mgt_delete` parameters: - name: applicationId in: path @@ -402,13 +380,10 @@ paths: - Applications operationId: exportApplication summary: | - Export application as an XML file + Export application as an XML file. description: | - This API provides the capability to retrieve the application as an XML file.
- Permission required:
- * /permission/admin/manage/identity/applicationmgt/view
- Scope required:
- * internal_application_mgt_view + This API provides the capability to retrieve the application as an XML file.
+ Scope(Permission) required: `internal_application_mgt_view` parameters: - name: applicationId in: path @@ -452,13 +427,10 @@ paths: - Applications operationId: changeApplicationOwner summary: | - Change application owner + Change application owner. description: | - This API provides the capability to change the application owner.
- Permission required:
- * /permission/admin
- Scope required:
- * SYSTEM + This API provides the capability to change the application owner.
+ Scope(Permission) required: `internal_organization_admin` parameters: - name: applicationId in: path @@ -501,14 +473,11 @@ paths: tags: - Authenticators summary: | - Get configured authenticators + Get configured authenticators. operationId: getConfiguredAuthenticators description: | - This API provides the capability to retrieve the configured authenticators. - Permission required:
- * /permission/admin/manage/identity/applicationmgt/view
- Scope required:
- * internal_application_mgt_view + This API provides the capability to retrieve the configured authenticators.
+ Scope(Permission) required: `internal_application_mgt_view` parameters: - name: applicationId in: path @@ -552,15 +521,11 @@ paths: tags: - Resident Application summary: | - Get Resident application + Get resident application. operationId: getResidentApplication description: | - This API provides the capability to retrieve the resident application information. -
- Permission required:
- * /permission/admin/manage/identity/applicationmgt/view
- Scope required:
- * internal_application_mgt_view + This API provides the capability to retrieve the resident application information.
+ Scope(Permission) required: `internal_application_mgt_view` responses: '200': description: OK @@ -594,14 +559,11 @@ paths: tags: - Resident Application summary: | - Update Resident Application + Update resident application. operationId: updateResidentApplication description: > - This API provides the capability to update the Resident Application Configuration.
- Permission required:
- * /permission/admin/manage/identity/applicationmgt/update
- Scope required:
- * internal_application_mgt_update + This API provides the capability to update the resident application configuration.
+ Scope(Permission) required: `internal_application_mgt_update` responses: '200': description: Successful @@ -651,20 +613,16 @@ paths: This represents the provisioning configuration of the resident application. required: true - '/applications/{applicationId}/inbound-protocols/': + /applications/{applicationId}/inbound-protocols/: get: tags: - Inbound Protocols summary: | - Retrieve inbound protocol configurations of the application + Retrieve inbound protocol configurations. operationId: getInboundAuthenticationConfigurations description: > - This API provides the capability to retrieve authentication protocol - configurations of an application.
- Permission required:
- * /permission/admin/manage/identity/applicationmgt/view
- Scope required:
- * internal_application_mgt_view + This API provides the capability to retrieve authentication protocol configurations of an application.
+ Scope(Permission) required: `internal_application_mgt_view` parameters: - name: applicationId in: path @@ -701,20 +659,16 @@ paths: application/json: schema: $ref: '#/components/schemas/Error' - '/applications/{applicationId}/inbound-protocols/saml': + /applications/{applicationId}/inbound-protocols/saml: get: tags: - Inbound Protocols - SAML summary: | - Retrieve SAML2 authentication protocol parameters of application + Retrieve SAML2 authentication protocol parameters. operationId: getInboundSAMLConfiguration description: > - This API provides the capability to retrieve SAML2 authentication - protocol parameters of an application.
- Permission required:
- * /permission/admin/manage/identity/applicationmgt/view
- Scope required:
- * internal_application_mgt_view + This API provides the capability to retrieve SAML2 authentication protocol parameters of an application.
+ Scope(Permission) required: `internal_application_mgt_view` parameters: - name: applicationId in: path @@ -751,20 +705,15 @@ paths: application/json: schema: $ref: '#/components/schemas/Error' - put: tags: - Inbound Protocols - SAML summary: | - Update SAML2 authentication protocol parameters of application + Update SAML2 authentication protocol parameters. operationId: updateInboundSAMLConfiguration description: > - This API provides the capability to store SAML2 authentication protocol - parameters of an application.
- Permission required:
- * /permission/admin/manage/identity/applicationmgt/update
- Scope required:
- * internal_application_mgt_update + This API provides the capability to store SAML2 authentication protocol parameters of an application.
+ Scope(Permission) required: `internal_application_mgt_update` - There are three methods to create/update SAML2 authentication protocol configuration. 1. Metadata File (by sending the Base64 encoded content of the metadata file.) @@ -826,15 +775,11 @@ paths: tags: - Inbound Protocols - SAML summary: | - Delete SAML2 authentication protocol parameters of application + Delete SAML2 authentication protocol parameters. operationId: deleteInboundSAMLConfiguration description: > - This API provides the capability to delete SAML2 authentication protocol - parameters of an application.
- Permissi on required:
- * /permission/admin/manage/identity/applicationmgt/delete
- Scope required:
- * internal_application_mgt_delete + This API provides the capability to delete SAML2 authentication protocol parameters of an application.
+ Scope(Permission) required: `internal_application_mgt_delete` parameters: - name: applicationId in: path @@ -867,21 +812,15 @@ paths: application/json: schema: $ref: '#/components/schemas/Error' - - - '/applications/{applicationId}/inbound-protocols/oidc': + /applications/{applicationId}/inbound-protocols/oidc: get: tags: - Inbound Protocols - OAuth / OIDC summary: | - Retrieve OIDC authentication protocol parameters of application + Retrieve OIDC authentication protocol parameters. description: > - This API provides the capability to retrieve OIDC authentication - protocol parameters of an application.
- Permission required:
- * /permission/admin/manage/identity/applicationmgt/view
- Scope required:
- * internal_application_mgt_view + This API provides the capability to retrieve OIDC authentication protocol parameters of an application.
+ Scope(Permission) required: `internal_application_mgt_view` operationId: getInboundOAuthConfiguration parameters: - name: applicationId @@ -923,14 +862,10 @@ paths: tags: - Inbound Protocols - OAuth / OIDC summary: | - Update OIDC authentication protocol parameters of application + Update OIDC authentication protocol parameters. description: > - This API provides the capability to store OIDC authentication protocol - parameters of an application.
- Permission required:
- * /permission/admin/manage/identity/applicationmgt/update
- Scope required:
- * internal_application_mgt_update + This API provides the capability to store OIDC authentication protocol parameters of an application.
+ Scope(Permission) required: `internal_application_mgt_update` operationId: updateInboundOAuthConfiguration parameters: - name: applicationId @@ -990,14 +925,10 @@ paths: tags: - Inbound Protocols - OAuth / OIDC summary: | - Delete OIDC authentication protocol parameters of application + Delete OIDC authentication protocol parameters. description: > - This API provides the capability to delete OIDC authentication protocol - parameters of an application.
- Permission required:
- * /permission/admin/manage/identity/applicationmgt/delete
- Scope required:
- * internal_application_mgt_delete + This API provides the capability to delete OIDC authentication protocol parameters of an application.
+ Scope(Permission) required: `internal_application_mgt_delete` operationId: deleteInboundOAuthConfiguration parameters: - name: applicationId @@ -1031,20 +962,15 @@ paths: application/json: schema: $ref: '#/components/schemas/Error' - - - '/applications/{applicationId}/inbound-protocols/oidc/regenerate-secret': + /applications/{applicationId}/inbound-protocols/oidc/regenerate-secret: post: tags: - Inbound Protocols - OAuth / OIDC summary: | - Regenerate the OAuth2/OIDC client secret of application + Regenerate the OAuth2/OIDC client secret. description: | This API regenerates the OAuth2/OIDC client secret.
- Permission required:
- * /permission/admin/manage/identity/applicationmgt/create
- Scope required:
- * internal_application_mgt_create + Scope(Permission) required: `internal_application_mgt_create` operationId: regenerateOAuthClientSecret parameters: - name: applicationId @@ -1082,19 +1008,16 @@ paths: application/json: schema: $ref: '#/components/schemas/Error' - - '/applications/{applicationId}/inbound-protocols/oidc/revoke': + /applications/{applicationId}/inbound-protocols/oidc/revoke: post: tags: - Inbound Protocols - OAuth / OIDC summary: | - Revoke the OAuth2/OIDC client of application + Revoke the OAuth2/OIDC client of application. description: | - This API revokes the OAuth2/OIDC client secret. To re-activate the client, the client secret needs to be regenerated.
- Permission required:
- * /permission/admin/manage/identity/applicationmgt/create
- Scope required:
- * internal_application_mgt_create + This API revokes the OAuth2/OIDC client secret. + To re-activate the client, the client secret needs to be regenerated.
+ Scope(Permission) required: `internal_application_mgt_create` operationId: revokeOAuthClient parameters: - name: applicationId @@ -1128,20 +1051,16 @@ paths: application/json: schema: $ref: '#/components/schemas/Error' - - '/applications/{applicationId}/inbound-protocols/passive-sts': + /applications/{applicationId}/inbound-protocols/passive-sts: get: tags: - Inbound Protocols - Passive STS summary: > - Retrieve Passive STS authentication protocol parameters of application + Retrieve Passive STS authentication protocol parameters. description: > This API provides the capability to retrieve Passive STS authentication protocol parameters of an application.
- Permission required:
- * /permission/admin/manage/identity/applicationmgt/view
- Scope required:
- * internal_application_mgt_view + Scope(Permission) required: `internal_application_mgt_view` operationId: getPassiveStsConfiguration parameters: - name: applicationId @@ -1179,19 +1098,14 @@ paths: application/json: schema: $ref: '#/components/schemas/Error' - put: tags: - Inbound Protocols - Passive STS summary: | - Update Passive STS authentication protocol parameters of application + Update Passive STS authentication protocol parameters. description: > - This API provides the capability to store passive STS authentication - protocol parameters of an application.
- Permission required:
- * /permission/admin/manage/identity/applicationmgt/update
- Scope required:
- * internal_application_mgt_update + This API provides the capability to store passive STS authentication protocol parameters of an application.
+ Scope(Permission) required: `internal_application_mgt_update` operationId: updatePassiveStsConfiguration parameters: - name: applicationId @@ -1240,7 +1154,6 @@ paths: application/json: schema: $ref: '#/components/schemas/Error' - requestBody: content: application/json: @@ -1254,14 +1167,11 @@ paths: tags: - Inbound Protocols - Passive STS summary: | - Delete Passive STS authentication protocol parameters of application + Delete Passive STS authentication protocol parameters. description: > This API provides the capability to delete Passive STS authentication protocol parameters of an application.
- Permission required:
- * /permission/admin/manage/identity/applicationmgt/delete
- Scope required:
- * internal_application_mgt_delete + Scope(Permission) required: `internal_application_mgt_delete` operationId: deletePassiveStsConfiguration parameters: - name: applicationId @@ -1295,20 +1205,16 @@ paths: application/json: schema: $ref: '#/components/schemas/Error' - - '/applications/{applicationId}/inbound-protocols/ws-trust': + /applications/{applicationId}/inbound-protocols/ws-trust: get: tags: - Inbound Protocols - WS Trust summary: | - Retrieve WS Trust authentication protocol parameters of application + Retrieve WS Trust authentication protocol parameters. description: > This API provides the capability to retrieve Passive STS authentication protocol parameters of an application.
- Permission required:
- * /permission/admin/manage/identity/applicationmgt/view
- Scope required:
- * internal_application_mgt_view + Scope(Permission) required: `internal_application_mgt_view` operationId: getWSTrustConfiguration parameters: - name: applicationId @@ -1346,19 +1252,14 @@ paths: application/json: schema: $ref: '#/components/schemas/Error' - put: tags: - Inbound Protocols - WS Trust summary: | - Update WS Trust authentication protocol parameters of application + Update WS Trust authentication protocol parameters. description: > - This API provides the capability to store WS Trust authentication - protocol parameters of an application.
- Permission required:
- * /permission/admin/manage/identity/applicationmgt/update
- Scope required:
- * internal_application_mgt_update + This API provides the capability to store WS Trust authentication protocol parameters of an application.
+ Scope(Permission) required: `internal_application_mgt_update` operationId: updateWSTrustConfiguration parameters: - name: applicationId @@ -1407,7 +1308,6 @@ paths: application/json: schema: $ref: '#/components/schemas/Error' - requestBody: content: application/json: @@ -1421,14 +1321,10 @@ paths: tags: - Inbound Protocols - WS Trust summary: | - Delete WS Trust authentication protocol parameters of application + Delete WS Trust authentication protocol parameters. description: > - This API provides the capability to delete WS Trust authentication - protocol parameters of an application.
- Permission required:
- * /permission/admin/manage/identity/applicationmgt/delete
- Scope required:
- * internal_application_mgt_delete + This API provides the capability to delete WS Trust authentication protocol parameters of an application.
+ Scope(Permission) required: `internal_application_mgt_delete` operationId: deleteWSTrustConfiguration parameters: - name: applicationId @@ -1462,20 +1358,16 @@ paths: application/json: schema: $ref: '#/components/schemas/Error' - - '/applications/{applicationId}/inbound-protocols/{inboundProtocolId}': + /applications/{applicationId}/inbound-protocols/{inboundProtocolId}: get: tags: - Inbound Protocols - Custom summary: > - Retrieve custom Inbound authentication protocol parameters of application. + Retrieve custom inbound authentication protocol parameters. description: > This API provides the capability to retrieve custom inbound authentication protocol parameters of an application.
- Permission required:
- * /permission/admin/manage/identity/applicationmgt/view
- Scope required:
- * internal_application_mgt_view + Scope(Permission) required: `internal_application_mgt_view` operationId: getCustomInboundConfiguration parameters: - name: applicationId @@ -1523,14 +1415,11 @@ paths: tags: - Inbound Protocols - Custom summary: | - Update the custom inbound authentication protocol parameters of application + Update the custom inbound authentication protocol parameters. description: > - This API provides the capability to store custom inbound authentication protocol parameters of an application. -
- Permission required:
- * /permission/admin/manage/identity/applicationmgt/update
- Scope required:
- * internal_application_mgt_update + This API provides the capability to store custom inbound authentication + protocol parameters of an application.
+ Scope(Permission) required: `internal_application_mgt_update` operationId: updateCustomInboundConfiguration parameters: - name: applicationId @@ -1598,13 +1487,10 @@ paths: tags: - Inbound Protocols - Custom summary: > - Delete custom inbound authentication protocol parameters of application + Delete custom inbound authentication protocol parameters. description: > This API provides the capability to delete custom inbound authentication protocol of an application.
- Permission required:
- * /permission/admin/manage/identity/applicationmgt/delete
- Scope required:
- * internal_application_mgt_delete + Scope(Permission) required: `internal_application_mgt_delete` operationId: deleteCustomInboundConfiguration parameters: - name: applicationId @@ -1644,21 +1530,16 @@ paths: application/json: schema: $ref: '#/components/schemas/Error' - - '/applications/meta/inbound-protocols': + /applications/meta/inbound-protocols: get: tags: - Application Metadata summary: | - Retrieve the list of inbound authentication protocols available + Retrieve the list of inbound authentication protocols available. description: > This API provides the capability to retrieve the list of inbound authentication protocols available. - If the query parameter 'customOnly' is set to true, only custom inbound protocols will be listed. -
- Permission required:
- * /permission/admin/manage/identity/applicationmgt/view
- Scope required:
- * internal_application_mgt_view + If the query parameter 'customOnly' is set to true, only custom inbound protocols will be listed.
+ Scope(Permission) required: `internal_application_mgt_view` operationId: getInboundProtocols parameters: - $ref: '#/components/parameters/inboundProtocolsCustomOnly' @@ -1690,19 +1571,15 @@ paths: application/json: schema: $ref: '#/components/schemas/Error' - - '/applications/meta/inbound-protocols/saml': + /applications/meta/inbound-protocols/saml: get: tags: - Application Metadata summary: | - Retrieve all the metadata related to the auth protocol SAML + Retrieve all the metadata related to the auth protocol SAML. description: > This API provides the capability to retrieve all the metadata related to the auth protocol SAML.
- Permission required:
- * /permission/admin/manage/identity/applicationmgt/view
- Scope required:
- * internal_application_mgt_view + Scope(Permission) required: `internal_application_mgt_view` operationId: getSAMLMetadata responses: '200': @@ -1735,19 +1612,16 @@ paths: application/json: schema: $ref: '#/components/schemas/Error' - - '/applications/meta/inbound-protocols/oidc': + /applications/meta/inbound-protocols/oidc: get: tags: - Application Metadata summary: | - Retrieve all the metadata related to the authentication protocol OAuth / OIDC + Retrieve all the metadata related to the authentication protocol OAuth / OIDC. description: > - This API provides the capability to retrieve all the metadata related to the authentication protocol OAuth / OIDC.
- Permission required:
- * /permission/admin/manage/identity/applicationmgt/view
- Scope required:
- * internal_application_mgt_view + This API provides the capability to retrieve all the metadata related + to the authentication protocol OAuth / OIDC.
+ Scope(Permission) required: `internal_application_mgt_view` operationId: getOIDCMetadata responses: '200': @@ -1772,19 +1646,15 @@ paths: application/json: schema: $ref: '#/components/schemas/Error' - - '/applications/meta/inbound-protocols/ws-trust': + /applications/meta/inbound-protocols/ws-trust: get: tags: - Application Metadata summary: | - Retrieve all the metadata related to the auth protocol WS Trust + Retrieve all the metadata related to the auth protocol WS Trust. description: > This API provides the capability to retrieve all the metadata related to the auth protocol WS_Trust.
- Permission required:
- * /permission/admin/manage/identity/applicationmgt/view
- Scope required:
- * internal_application_mgt_view + Scope(Permission) required: `internal_application_mgt_view` operationId: getWSTrustMetadata responses: '200': @@ -1809,20 +1679,16 @@ paths: application/json: schema: $ref: '#/components/schemas/Error' - - '/applications/meta/inbound-protocols/{inboundProtocolId}': + /applications/meta/inbound-protocols/{inboundProtocolId}: get: tags: - Application Metadata summary: | - Retrieve all the metadata related to the custom auth protocol identified by the inboundProtocolId + Retrieve all the metadata related to the custom auth protocol identified by the inboundProtocolId. description: > This API provides the capability to retrieve all the metadata related to the custom auth protocol - identified by the inboundProtocolId. The URL encoded inbound protocol name is used as inboundProtocolId.
- Permission required:
- * /permission/admin/manage/identity/applicationmgt/view
- Scope required:
- * internal_application_mgt_view + identified by the inboundProtocolId. The URL encoded inbound protocol name is used as inboundProtocolId.
+ Scope(Permission) required: `internal_application_mgt_view` operationId: getCustomProtocolMetadata parameters: - name: inboundProtocolId @@ -1854,19 +1720,15 @@ paths: application/json: schema: $ref: '#/components/schemas/Error' - - '/applications/meta/adaptive-auth-templates': + /applications/meta/adaptive-auth-templates: get: tags: - Application Metadata summary: | - Retrieve the sample adaptive authentication templates. + Retrieve adaptive authentication sample templates. description: > This API provides the capability to retrieve the sample adaptive authentication templates.
- Permission required:
- * /permission/admin/manage/identity/applicationmgt/view
- Scope required:
- * internal_application_mgt_view + Scope(Permission) required: `internal_application_mgt_view` operationId: getAdaptiveAuthTemplates responses: '200': @@ -1891,16 +1753,16 @@ paths: application/json: schema: $ref: '#/components/schemas/Error' - /applications/templates: get: tags: - Application Templates operationId: getAllApplicationTemplates summary: | - List Application Templates + List application templates. description: | - This API provides the capability to retrieve the list of templates available. + This API provides the capability to retrieve the list of templates available.
+ Scope(Permission) required: `internal_application_mgt_view` parameters: - $ref: '#/components/parameters/limitWithoutDefaultQueryParam' - $ref: '#/components/parameters/offsetWithoutDefaultQueryParam' @@ -1944,10 +1806,11 @@ paths: tags: - Application Templates summary: | - Add application template + Add application template. operationId: createApplicationTemplate description: > - This API provides the capability to store the application template provided by users. + This API provides the capability to store the application template provided by users.
+ Scope(Permission) required: `internal_application_mgt_create` requestBody: content: application/json: @@ -1992,16 +1855,16 @@ paths: application/json: schema: $ref: '#/components/schemas/Error' - /applications/templates/{template-id}: get: tags: - Application Templates summary: | - Retrieve application template by ID + Retrieve application template by ID. operationId: getApplicationTemplate description: > - This API provides the capability to retrieve the application template from the template id. + This API provides the capability to retrieve the application template from the template id.
+ Scope(Permission) required: `internal_application_mgt_view` parameters: - $ref: '#/components/parameters/templateIdPathParam' responses: @@ -2042,7 +1905,6 @@ paths: application/xml: schema: $ref: '#/components/schemas/Error' - put: tags: - Application Templates @@ -2050,7 +1912,8 @@ paths: Update the application template by the template ID. operationId: updateApplicationTemplate description: | - This API provides the capability to update an application template by the template ID. + This API provides the capability to update an application template by the template ID.
+ Scope(Permission) required: `internal_application_mgt_update` parameters: - $ref: '#/components/parameters/templateIdPathParam' requestBody: @@ -2098,7 +1961,8 @@ paths: Delete application template by template ID. operationId: deleteApplicationTemplate description: | - This API provides the capability to delete an application template by template ID. + This API provides the capability to delete an application template by template ID.
+ Scope(Permission) required: `internal_application_mgt_delete` parameters: - $ref: '#/components/parameters/templateIdPathParam' responses: @@ -2129,7 +1993,6 @@ paths: application/json: schema: $ref: '#/components/schemas/Error' - components: parameters: limitQueryParam: @@ -2210,9 +2073,10 @@ components: required: false description: | Specifies the required parameters in the response. - Only 'advancedConfigurations', 'templateId', 'clientId', and 'issuer' attributes are currently supported. + Only 'advancedConfigurations', 'templateId', 'clientId', 'issuer', and 'associatedRoles.allowedAudience' + attributes are currently supported. - /applications?attributes=advancedConfigurations,templateId,clientId,issuer + /applications?attributes=advancedConfigurations,templateId,clientId,issuer,associatedRoles.allowedAudience schema: type: string exportSecretsQueryParam: @@ -2251,7 +2115,7 @@ components: flows: authorizationCode: authorizationUrl: 'https://localhost:9443/oauth2/authorize' - tokenUrl: 'http://localhost:9763/oauth2/token' + tokenUrl: 'http://localhost:9443/oauth2/token' scopes: {} schemas: Link: @@ -2263,7 +2127,6 @@ components: rel: type: string example: "next" - ApplicationListResponse: type: object properties: @@ -2287,7 +2150,6 @@ components: type: array items: $ref: '#/components/schemas/Link' - ApplicationListItem: type: object properties: @@ -2326,7 +2188,6 @@ components: templateId: type: string example: "980b8tester24c64a8a09a0d80abf8c337bd2555" - ApplicationModel: type: object required: @@ -2348,6 +2209,9 @@ components: accessUrl: type: string example: 'https://example.com/login' + logoutReturnUrl: + type: string + example: 'https://example.com/app/logout' templateId: type: string example: "980b8tester24c64a8a09a0d80abf8c337bd2555" @@ -2366,7 +2230,6 @@ components: $ref: '#/components/schemas/AdvancedApplicationConfiguration' provisioningConfigurations: $ref: '#/components/schemas/ProvisioningConfiguration' - ApplicationResponseModel: type: object required: @@ -2388,6 +2251,9 @@ components: accessUrl: type: string example: 'https://example.com/login' + logoutReturnUrl: + type: string + example: 'https://example.com/app/logout' clientId: type: string example: 'SmrrDNXRYf1lMmDlnleeHTuXx_Ea' @@ -2417,7 +2283,6 @@ components: - READ - WRITE default: READ - ApplicationPatchModel: type: object properties: @@ -2433,6 +2298,9 @@ components: accessUrl: type: string example: 'https://example.com/login' + logoutReturnUrl: + type: string + example: 'https://example.com/app/logout' templateId: type: string example: "adwefi2429asdfdf94444rraf44" @@ -2444,13 +2312,11 @@ components: $ref: '#/components/schemas/AdvancedApplicationConfiguration' provisioningConfigurations: $ref: '#/components/schemas/ProvisioningConfiguration' - ResidentApplication: type: object properties: provisioningConfigurations: $ref: '#/components/schemas/ProvisioningConfiguration' - ProvisioningConfiguration: type: object properties: @@ -2472,7 +2338,6 @@ components: description: >- This property becomes only applicable if the proxy-mode config is set to false - OutboundProvisioningConfiguration: type: object properties: @@ -2505,15 +2370,15 @@ components: type: array items: $ref: '#/components/schemas/ConfiguredAuthenticator' - ConfiguredAuthenticator: - type: object - properties: - name: - type: string - example: sampleIdP - type: - type: string - example: SampleAuthenticator + ConfiguredAuthenticator: + type: object + properties: + name: + type: string + example: sampleIdP + type: + type: string + example: SampleAuthenticator AdvancedApplicationConfiguration: type: object properties: @@ -2543,6 +2408,10 @@ components: type: boolean description: Decides whether authorization policies needs to be engaged during authentication flows. example: true + fragment: + type: boolean + description: Decides whether application is a fragment application. + example: false additionalSpProperties: $ref: '#/components/schemas/AdditionalProperties' AdditionalProperties: @@ -2592,12 +2461,10 @@ components: type: array items: $ref: '#/components/schemas/CustomInboundProtocolConfiguration' - InboundProtocolsListResponse: type: array items: $ref: '#/components/schemas/InboundProtocolListItem' - InboundProtocolListItem: type: object required: @@ -2613,8 +2480,7 @@ components: example: "SAML2 Inbound" self: type: string - example: "/t/carbon.super/api/server/v1/applications/29048810-1447-4ea0-a348-30d15ab65fa3/inbound-protocols/saml" - + example: "/api/server/v1/applications/29048810-1447-4ea0-a348-30d15ab65fa3/inbound-protocols/saml" ClaimConfiguration: type: object properties: @@ -2716,7 +2582,6 @@ components: type: string example: Username readOnly: true - SAML2Configuration: type: object properties: @@ -2728,7 +2593,6 @@ components: example: 'https://example.com/samlsso/meta' manualConfiguration: $ref: '#/components/schemas/SAML2ServiceProvider' - SingleSignOnProfile: type: object properties: @@ -2740,23 +2604,18 @@ components: - HTTP_POST - HTTP_REDIRECT - ARTIFACT - enableSignatureValidationForArtifactBinding: type: boolean description: Enables Signature validation for SAML Artifact Binding. Applicable only if SAML Artifact binding is enabled through the bindings option. default: false - attributeConsumingServiceIndex: type: string readOnly: true - enableIdpInitiatedSingleSignOn: type: boolean default: false - assertion: $ref: '#/components/schemas/SAMLAssertionConfiguration' - SAMLAttributeProfile: type: object properties: @@ -2766,7 +2625,6 @@ components: alwaysIncludeAttributesInResponse: type: boolean default: false - SingleLogoutProfile: type: object properties: @@ -2787,7 +2645,6 @@ components: - FRONTCHANNEL_HTTP_POST idpInitiatedSingleLogout: $ref: '#/components/schemas/IdpInitiatedSingleLogout' - IdpInitiatedSingleLogout: type: object properties: @@ -2798,7 +2655,6 @@ components: type: array items: type: string - SAMLAssertionConfiguration: type: object properties: @@ -2806,7 +2662,6 @@ components: type: string default: 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified' example: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress' - audiences: type: array description: Additional audience values to be added to the SAML Assertions @@ -2814,7 +2669,6 @@ components: - 'https://app.example.com/saml' items: type: string - recipients: type: array description: Additional recipient values to be added to the SAML Assertions @@ -2822,14 +2676,12 @@ components: - 'https://app.example.com/saml' items: type: string - digestAlgorithm: type: string default: "http://www.w3.org/2000/09/xmldsig#sha1" example: "http://www.w3.org/2000/09/xmldsig#sha1" encryption: $ref: '#/components/schemas/AssertionEncryptionConfiguration' - AssertionEncryptionConfiguration: type: object properties: @@ -2842,7 +2694,6 @@ components: keyEncryptionAlgorithm: type: string default: "http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" - SAMLRequestValidation: type: object properties: @@ -2851,7 +2702,6 @@ components: default: true signatureValidationCertAlias: type: string - SAMLResponseSigning: type: object properties: @@ -2860,13 +2710,11 @@ components: default: true signingAlgorithm: type: string - SAML2ServiceProvider: type: object required: - issuer - assertionConsumerUrls - properties: issuer: type: string @@ -2883,26 +2731,19 @@ components: idpEntityIdAlias: type: string description: "Default value is the IdP Entity ID value specified in Resident IdP." - singleSignOnProfile: $ref: '#/components/schemas/SingleSignOnProfile' - attributeProfile: $ref: '#/components/schemas/SAMLAttributeProfile' - singleLogoutProfile: $ref: '#/components/schemas/SingleLogoutProfile' - requestValidation: $ref: '#/components/schemas/SAMLRequestValidation' - responseSigning: $ref: '#/components/schemas/SAMLResponseSigning' - enableAssertionQueryProfile: type: boolean default: false - OpenIDConnectConfiguration: type: object required: @@ -3065,6 +2906,8 @@ components: type: string replyTo: type: string + replyToLogout: + type: string WSTrustConfiguration: type: object required: @@ -3137,7 +2980,6 @@ components: type: integer default: 1 example: 1 - AuthenticationStepModel: type: object required: @@ -3165,7 +3007,6 @@ components: authenticator: type: string example: basic - AuthProtocolMetadata: type: object properties: @@ -3323,7 +3164,6 @@ components: type: array items: $ref: '#/components/schemas/ApplicationTemplatesListItem' - ApplicationTemplatesListItem: type: object properties: @@ -3362,7 +3202,6 @@ components: self: type: string example: "/t/wso2.com/api/server/v1/applications/templates/85e3f4b8-0d22-4181-b1e3-1651f71b88bd" - ApplicationTemplateModel: type: object properties: @@ -3427,7 +3266,6 @@ components: traceId: type: string example: e0fbcfeb-3617-43c4-8dd0-7b7d38e13047 - servers: - url: 'https://{serverUrl}/t/{tenantDomain}/api/server/v1' variables: diff --git a/en/identity-server/7.0.0/docs/apis/restapis/scim2-users.yaml b/en/identity-server/7.0.0/docs/apis/restapis/scim2-users.yaml index 6a23feca32..1628d9123f 100644 --- a/en/identity-server/7.0.0/docs/apis/restapis/scim2-users.yaml +++ b/en/identity-server/7.0.0/docs/apis/restapis/scim2-users.yaml @@ -681,16 +681,39 @@ components: $ref: '#/components/schemas/UserResponseObject' UserSearchRequestObject: type: object - example: + properties: schemas: - - urn:ietf:params:scim:api:messages:2.0:SearchRequest + type: object + items: + type: string + example: + - urn:ietf:params:scim:api:messages:2.0:SearchRequest attributes: - - name.familyName - - userName - filter: userName sw ki and name.familyName co err - domain: PRIMARY - startIndex: 1 - count: 10 + type: array + description: SCIM defined attributes parameter. + items: + type: string + example: + - name.familyName + - userName + filter: + type: string + description: The expression used for filtering. Supported filters are
ew, eq, co, sw, and and.
+ example: userName sw ki and name.familyName co err
+ domain:
+ type: string
+ description: The name of the user store where filtering needs to be applied.
+ example: DEFAULT
+ startIndex:
+ type: integer
+ format: int32
+ description: The 1-based index of the first query result
+ example: 1
+ count:
+ type: integer
+ format: int32
+ description: Specifies the desired maximum number of query results per page.
+ example: 10
ErrorInvalidInput:
required:
- detail
diff --git a/en/identity-server/7.0.0/docs/apis/restapis/user-store.yaml b/en/identity-server/7.0.0/docs/apis/restapis/user-store.yaml
index 7a68c6df5d..f674b3f01f 100644
--- a/en/identity-server/7.0.0/docs/apis/restapis/user-store.yaml
+++ b/en/identity-server/7.0.0/docs/apis/restapis/user-store.yaml
@@ -352,7 +352,7 @@ paths:
-d '[
{
"operation": "REPLACE",
- "path": "/properties/disabled",
+ "path": "/properties/Disabled",
"value": "true"
}
]'
@@ -880,7 +880,7 @@ components:
path:
type: string
description: A JSON-Pointer
- example: /properties/disabled
+ example: /properties/Disabled
value:
type: string
description: The value to be used within the operations
diff --git a/en/identity-server/7.0.0/docs/assets/img/concepts/asgardeo-sdk.png b/en/identity-server/7.0.0/docs/assets/img/concepts/asgardeo-sdk.png
new file mode 100644
index 0000000000..b5e8eb3116
Binary files /dev/null and b/en/identity-server/7.0.0/docs/assets/img/concepts/asgardeo-sdk.png differ
diff --git a/en/identity-server/7.0.0/docs/assets/img/concepts/asgardeo-user-stores.png b/en/identity-server/7.0.0/docs/assets/img/concepts/asgardeo-user-stores.png
new file mode 100644
index 0000000000..59dc1ef44f
Binary files /dev/null and b/en/identity-server/7.0.0/docs/assets/img/concepts/asgardeo-user-stores.png differ
diff --git a/en/identity-server/7.0.0/docs/assets/img/concepts/login-flow-ai.png b/en/identity-server/7.0.0/docs/assets/img/concepts/login-flow-ai.png
new file mode 100644
index 0000000000..bce647931e
Binary files /dev/null and b/en/identity-server/7.0.0/docs/assets/img/concepts/login-flow-ai.png differ
diff --git a/en/identity-server/7.0.0/docs/assets/img/concepts/login-flow.png b/en/identity-server/7.0.0/docs/assets/img/concepts/login-flow.png
new file mode 100644
index 0000000000..c93053ee5f
Binary files /dev/null and b/en/identity-server/7.0.0/docs/assets/img/concepts/login-flow.png differ
diff --git a/en/identity-server/7.0.0/docs/assets/img/guides/account-configurations/bot-detection.png b/en/identity-server/7.0.0/docs/assets/img/guides/account-configurations/bot-detection.png
index 995165a76f..90874d9d31 100644
Binary files a/en/identity-server/7.0.0/docs/assets/img/guides/account-configurations/bot-detection.png and b/en/identity-server/7.0.0/docs/assets/img/guides/account-configurations/bot-detection.png differ
diff --git a/en/identity-server/7.0.0/docs/assets/img/guides/account-configurations/invite-user-to-set-password.png b/en/identity-server/7.0.0/docs/assets/img/guides/account-configurations/invite-user-to-set-password.png
index b3d4d36326..50d5cc865d 100644
Binary files a/en/identity-server/7.0.0/docs/assets/img/guides/account-configurations/invite-user-to-set-password.png and b/en/identity-server/7.0.0/docs/assets/img/guides/account-configurations/invite-user-to-set-password.png differ
diff --git a/en/identity-server/7.0.0/docs/complete-guides/react/accessing-protected-api.md b/en/identity-server/7.0.0/docs/complete-guides/react/accessing-protected-api.md
new file mode 100644
index 0000000000..3b32c514da
--- /dev/null
+++ b/en/identity-server/7.0.0/docs/complete-guides/react/accessing-protected-api.md
@@ -0,0 +1,146 @@
+---
+template: templates/complete-guide.html
+heading: Accessing protected API from your React app
+read_time: 5 min
+---
+
+In this section, we will focus on how to call a secure API from your React app using the other token—the access token.
+
+For simplicity, let's assume that the APIs we’re calling are secured by the same Identity Provider (IdP) and use the same issuer— in this case, the same {{product_name}} organization. This is typical when React apps are interacting with internal APIs within the same organization.
+
+!!! tip "Tip"
+
+ If your app needs to call APIs secured by a different IdP, you’ll need to exchange your current access token for a new one issued by the IdP securing those APIs. This can be done using the OAuth2 token exchange grant type or other supported grant types. We will cover these scenarios in a separate guide.
+
+## Using SDK Built-in HTTP client
+
+You can use the `httpRequest` API provided by the Asgardeo SDK to make HTTP requests to these endpoints. This function is used to send http requests to {{product_name}} or desired backend. The developer doesn’t need to manually attach the access token since this function does it automatically.
+
+The following is a simple example of how you might use the Asgardeo SDK’s `httpRequest` to call a protected API endpoint, such as `/scim2/me` (to get the user profile details after signing in). In this case, the SCIM 2 endpoint is secured by the same {{product_name}} organization. {{product_name}} provides a SCIM 2 API for managing users within your organization. While user management with SCIM 2 is a topic for a different guide, we will use the API as part of our current guide.
+
+!!! note "Note"
+
+ The storage type must be set to `webWorker` for the token to be automatically attached. If it’s set to `sessionStorage` or `localStorage`, you may implement your own function for attaching the access token to the network request.
+
+```javascript
+
+const App = () => {
+
+
+ const { httpRequest } = useAuthContext();
+
+
+ const requestConfig = {
+ headers: {
+ "Accept": "application/json",
+ "Content-Type": "application/scim+json"
+ },
+ method: "GET",
+ url: "https://localhost:9443/scim2/me"
+ };
+
+
+ useEffect(() => {
+ // Make a GET request to a protected endpoint
+ httpRequest(requestConfig)
+ .then((response) => {
+ // Handle successful response
+ console.log('Response:', response.data);
+ })
+ .catch((error) => {
+ // Handle error
+ console.error('Error:', error);
+ });
+ }, [])
+}
+
+```
+
+Note that you don’t need to manually specify the Authorization header under headers in `requestConfig`, as `httpRequest` function intercepts the request and attaches the access token to the network request as the Authorization header.
+
+In the above example, the final request config sent by the `httpRequest` function would be as follows
+
+```javascript
+const requestConfig = {
+ headers: {
+ "Accept": "application/json",
+ "Content-Type": "application/scim+json",
+ "Authorization": "Bearer Welocme {state.username}
+ + + : + } + + ) +}; + +export default App; +``` + +If your React application is already running in the development mode, the home page will be reloaded and you will see the updated user interface. + +{: width="800" style="display: block; margin: 0;"} + +There may be instances where you’d need to retrieve user attributes outside React components. Asgardeo React SDK provides a [getBasicUserInfo](https://github.com/asgardeo/asgardeo-auth-react-sdk/blob/main/API.md#getbasicuserinfo){:target="_blank"} function, which allows you to retrieve the authenticated user’s basic information. The code example in the following section demonstrates this process and can be adapted to fit your application with any necessary customizations. + +Again, replace the code in `app.jsx` with the following. + +```javascript +import { useAuthContext } from "@asgardeo/auth-react"; +import { useEffect, useState } from "react"; +import './App.css'; + +const App = () => { + + const { state, getBasicUserInfo, signIn, signOut } = useAuthContext(); + const [userInfo, setUserInfo] = useState(undefined); + + useEffect(() => { + getBasicUserInfo().then((response) => { + setUserInfo(response) + }).catch((error) => { + console.error(error); + }); + }, [state]); + + + return ( + <> + { + state.isAuthenticated + ? <> +Welcome {userInfo?.username}
+ + + : + } + + ) +}; + +export default App; +``` + +The above code snippet, the app utilizes the `useAuthContext` hook to access authentication state and methods such as `getBasicUserInfo`, `signIn`, and `signOut`. It also uses React's `useState` to store basic user information and `useEffect` to fetch this information whenever the authentication state changes. If the user is authenticated, the app displays a welcome message with the username and a button to log out. If the user is not authenticated, it shows a login button that triggers the sign-in process, and the errors during user info retrieval are handled by logging them to the console. + +Similarly, you can access the other user attributes, such as email, display name, allowed scopes, etc as well. The following code snippet shows you how you can access them in your app. Asgardeo React SDK is responsible for processing the ID token and decoding these attributes. + +```javascript +Your email: { userInfo?.email }
+Display name: { userInfo?.displayName }
+Allowed scopes: { userInfo?.allowedScopes }
+Tenant domain: { userInfo?.tenantDomain }
+Session state: { userInfo?.sessionState }
+``` + +## Getting additional user attributes + +Other than the above attributes decoded and available to you by default, Asgardeo React SDK provides [getDecodedIDToken](https://github.com/asgardeo/asgardeo-auth-react-sdk/blob/main/API.md#getdecodedidtoken){:target="_blank"} method to access any other user attributes that are not exposed by `getBasicUserInfo`. This method will decode the ID token in browser storage and return the output as a JSON object. + +To get additional user attributes to the ID token, the application should be configured to request the specific user attributes at the time of login. For example, if you want to retrieve a user's mobile number as an attribute, you need to configure the application to request the user’s mobile number as an attribute in the ID token. + +1. Log in to the {{product_name}} console and select the application you created. +2. Go to the **User Attributes** tab. +3. Select the **phone** scope. +4. Expand the scope, and you will see that all attributes under this scope (e.g., `mobile_number`) are selected. +5. Click Update to save the changes. + +```javascript + +const { state, signIn, signOut, getDecodedIDToken } = useAuthContext(); + + +const [mobileNumber, setMobileNumber] = useState("") + + +useEffect(() => { + if (state.isAuthenticated) { + getDecodedIDToken().then((decodedIdToken) => { + console.log(decodedIdToken); + setMobileNumber(decodedIdToken.phone_number) + }).catch((error) => { + console.log(error); + }) + } +}, [ state.isAuthenticated ]); + + +return ( + <> +Your mobile number: {mobileNumber}
+ +) + +``` + +In the above code snippet, we run the `getDecodedIDToken` method if the user is authenticated, and print the output to the browser console. The decoded ID token response will be printed to the browser console as follows. + +{: width="800" style="display: block; margin: 0;"} + +In this step, we further improved our React app to display the user attributes. As the next step, we will try to secure routes within the app. diff --git a/en/identity-server/7.0.0/docs/complete-guides/react/install-asgardeo-sdk.md b/en/identity-server/7.0.0/docs/complete-guides/react/install-asgardeo-sdk.md new file mode 100644 index 0000000000..8648119c9c --- /dev/null +++ b/en/identity-server/7.0.0/docs/complete-guides/react/install-asgardeo-sdk.md @@ -0,0 +1,78 @@ +--- +template: templates/complete-guide.html +heading: Install and configure Asgardeo SDK +read_time: 5 min +--- + +## Install @asgardeo/auth-react + +The Asgardeo React SDK is a production-ready SDK that simplifies integrating {{product_name}} as an Identity Provider in your React applications. It provides essential features like user authentication, retrieving user information, and an HTTP client for sending network requests with attached tokens. Additionally, it ensures best practices by being Secure by Design and Secure by Default. + + +!!! Info + + Asgardeo-branded SDKs can be used to build apps to work with the all [WSO2 identity suite](https://wso2.com/identity-and-access-management/){:target="_blank"} of products that includes [WSO2 Identity Server (WSO2 IS)](https://wso2.com/identity-server/){:target="_blank"}, [WSO2 Private Identity Cloud (WSO2 PIC)](https://wso2.com/private-identity-cloud/){:target="_blank"} and [Asgardeo](https://wso2.com/asgardeo/){:target="_blank"}. + +!!! Info + + Asgardeo React SDK has been developed on open standards such as OAuth2, OpenID Connect etc, therefore you can use the Asgardeo React SDK for adding authentication to your application with any other OpenID Connect identity provider. + + +As the next step, run the following command to install the React SDK from the npm registry. + +```bash +npm install @asgardeo/auth-react + +``` + +## Add `Hello {{ username }}!
+ + +``` + + diff --git a/en/identity-server/7.0.0/docs/quick-starts/nextjs.md b/en/identity-server/7.0.0/docs/quick-starts/nextjs.md new file mode 100644 index 0000000000..37bf11860d --- /dev/null +++ b/en/identity-server/7.0.0/docs/quick-starts/nextjs.md @@ -0,0 +1,320 @@ +--- +template: templates/quick-start.html +heading: Next.JS Quickstart +description: Welcome to the Next.js Quickstart guide! In this document, you will learn to build a Next.js app, add user login and display user profile information using WSO2 Identity Server. +what_you_will_learn: + - Create new Next.js app + - Install Asgardeo provider for Auth.js + - Add user login and logout + - Display user profile information +prerequisites: + - About 15 minutes + - Set-up WSO2 Identity Server + - Install a JS package manager + - A favorite text editor or IDE +# source_code: Next.js App Sample +whats_next: + # - Try out {{ product_name }} complete React guide + # - Try out {{product_name}} user onboarding complete guide for React + # - Read security best practices for React app guide +--- + + +## Configure an Application in {{ product_name }} + +- Sign into {{ product_name }} console and navigate to **Applications > New Application.** +- Select **Traditional Web Application** and complete the wizard popup by providing a suitable name and an authorized redirect URL.(*Ensure that the protocol remains set to OpenID Connect (OIDC).)* + +*Example:* + +- *Name - wso2is-nextjs* +- *Authorized redirect URL - http://localhost:3000/api/auth/callback/asgardeo* + + + +!!! Info + + The authorized redirect URL determines where {{product_name}} should send users after they successfully log in. Typically, this will be the web address where your app is hosted. For this guide, we'll use ` http://localhost:3000/api/auth/callback/asgardeo`, as the authorized redirect URL . + +!!! note + + Make a note of the following values from the **Protocol** and **Info** tabs of the registered application. You will need them during the **Step 4** + + - **`client-id`** from the **Protocol** tab. + - **`client-secret`** from the **Protocol** tab. + - **`issuer`** from from the **Info** tab. + +## Create a Next.js app + +Create your new Next.js app. + +=== "npm" + + ``` bash + npx create-next-app@latest --typescript wso2is-nextjs + + cd wso2is-nextjs + + npm install + + npm run dev + ``` + +=== "yarn" + + ``` bash + yarn create next-app --typescript wso2is-nextjs + + cd wso2is-nextjs + + yarn install + + yarn dev + ``` + +=== "pnpm" + + ``` bash + pnpm create next-app --typescript wso2is-nextjs + + cd wso2is-nextjs + + pnpm install + + pnpm run dev + ``` + +## Install Auth.js library + +Auth.js is a lightweight JavaScript library designed for simplifying authentication workflows in web application. The [Asgardeo provider for Auth.js](https://authjs.dev/reference/core/providers/asgardeo){:target="_blank"} offers all the components and hooks you need to integrate your app with {{product_name}}.To get started, simply add Auth.js library to the project. Make sure to stop the dev server started in the previous step. + + +!!! Info + + Asgardeo-branded SDKs and such as Asgardeo provider for Auth.js used in this guide can be used to build apps to work with the all [WSO2 identity suite](https://wso2.com/identity-and-access-management/){:target="_blank"} of products that includes [WSO2 Identity Server (WSO2 IS)](https://wso2.com/identity-server/){:target="_blank"}, WSO2 [Private Identity Cloud (WSO2 PIC)](https://wso2.com/private-identity-cloud/){:target="_blank"} and [Asgardeo](https://wso2.com/asgardeo/){:target="_blank"}. + + +=== "npm" + + ``` bash + npm install next-auth@beta + ``` + +=== "yarn" + + ``` bash + yarn add next-auth@beta + ``` + +=== "pnpm" + + ``` bash + pnpm add next-auth@beta + ``` + +Next, generate **`AUTH_SECRET`** environment variable. + +=== "npm" + + ``` bash + npx auth secret + + ``` +=== "yarn" + + ``` bash + yarn dlx auth secret + ``` + +=== "pnpm" + + ``` bash + pnpm dlx auth secret + ``` + +Add following entries to the .env or .env.local file, and make sure to replace the placeholders in the following code with the **`client-id`**, **`client-secret`** and **`issuer`** values you copied in **Step-1** during the application registration in the {{product_name}} console. + + +```bash title=".env.local" + AUTH_ASGARDEO_ID="
+ {
+ !session ? (
+
+ ) : (
+ <>
+
+ );
+}
+```
+
+Visit your app's homepage at [http://localhost:3000](http://localhost:3000).
+
+!!! Important
+
+ You need to create a test user in {{ product_name }} by following this [guide]({{ base_path }}/guides/users/manage-users/#onboard-single-user){:target="_blank"} to tryout login and logout features.
+
+## Display logged in user details
+
+Modified the code as below to see logged in user details.
+
+```javascript title="auth.ts" hl_lines="14-29"
+
+import NextAuth from "next-auth"
+import Asgardeo from "next-auth/providers/asgardeo"
+
+declare module "next-auth" {
+ interface User {
+ username?: string;
+ }
+}
+
+export const { handlers, signIn, signOut, auth } = NextAuth({
+ providers: [Asgardeo({
+ issuer: process.env.AUTH_ASGARDEO_ISSUER
+ })],
+ callbacks: {
+ async jwt({ token, profile }) {
+ if (profile) {
+ token.username = profile.username;
+ }
+
+ return token;
+ },
+ async session({ session, token }) {
+ if (token) {
+ session.user.username = token.username as string;
+ }
+
+ return session;
+ }
+ }
+})
+
+```
+
+Then, update `page.tsx` with the following highlighted line to display the username of logged in user.
+
+```javascript title="page.tsx" hl_lines="4"
+
+...
+ <>
+ You are now signed in!
+ + + + ) + } +You are now signed in!
+hello {session.user?.username}
+ + + +... + +``` + + + + diff --git a/en/identity-server/7.0.0/docs/quick-starts/react.md b/en/identity-server/7.0.0/docs/quick-starts/react.md index 045fdf59de..0bdc5cdf45 100644 --- a/en/identity-server/7.0.0/docs/quick-starts/react.md +++ b/en/identity-server/7.0.0/docs/quick-starts/react.md @@ -9,32 +9,32 @@ what_you_will_learn: - Display user profile information prerequisites: - About 15 minutes - - Set-up WSO2 Identity Server + - Set-up WSO2 Identity Server - Install a JS package manager - A favorite text editor or IDE source_code: React Vite App Sample whats_next: - - Try out complete React guide - - Try out user onboarding complete guide for React + - Try out {{ product_name }} complete React guide + - Try out {{product_name}} user onboarding complete guide for React - Read security best practices for React app guide --- -## Configure an Application in WSO2 Identity Server +## Configure an Application in {{ product_name }} -- Sign into WSO2 Identity Server console and navigate to Applications > New Application. +- Sign into {{ product_name }} console and navigate to Applications > New Application. - Select Single Page Application and complete the wizard popup by providing a suitable name and an authorized redirect URL - Name - IS-React - Authorized redirect URL - `http://localhost:5173` -!!! abstract +!!! Info The authorized redirect URL determines where WSO2 Identity Server should send users after they successfully log in. Typically, this will be the web address where your app is hosted. For this guide, we'll use`http://localhost:5173`, as the sample app will be accessible at this URL. !!! note - Note down the following values : you will need them during the**Step 4** + Note down the following values : you will need them during the **Step 4** - -`client-id` + - `client-id` - `base-url` - `redirect-url` @@ -80,22 +80,28 @@ Create (a.k.a scaffold) your new React app using Vite. ## Install @asgardeo/auth-react -Asgardeo React SDK provides all the components and hooks you need to integrate Asgardeo into your app. To get started, simply add the Asgardeo React SDK to the project. +Asgardeo React SDK provides all the components and hooks you need to integrate Asgardeo into your app. To get started, simply add the Asgardeo React SDK to the project. Make sure to stop the dev server started in the previous step. === "npm" - ``bash npm install @asgardeo/auth-react `` + ``` bash + npm install @asgardeo/auth-react + ``` === "yarn" - ``bash yarn add @asgardeo/auth-react `` + ``` bash + yarn add @asgardeo/auth-react + ``` === "pnpm" - ``bash pnpm add @asgardeo/auth-react `` + ``` bash + pnpm add @asgardeo/auth-react + ``` -!!! note +!!! Info Asgardeo-branded SDKs can be used to build apps to work with the all WSO2 identity suite of products that includes WSO2 Identity Server (WSO2 IS), WSO2 Private Identity Cloud (WSO2 PIC), and Asgardeo. @@ -107,11 +113,11 @@ The `Welocme {state.username}
- - - : - } + { + state.isAuthenticated ? + <> +Welcome {state.username}
+ + + : + } ) }; diff --git a/en/identity-server/7.0.0/mkdocs.yml b/en/identity-server/7.0.0/mkdocs.yml index ad69e0b7a4..54606696b7 100644 --- a/en/identity-server/7.0.0/mkdocs.yml +++ b/en/identity-server/7.0.0/mkdocs.yml @@ -24,7 +24,12 @@ extra: is_version: 7.0.0 plugins: - - search + - search: + indexing: "full" + separator: "[^\\w._]+" + lang: ['en'] + prebuild_index: true + ngram_length: 3 - markdownextradata: {} - include-markdown - redirects: @@ -217,7 +222,6 @@ plugins: 'deploy/change-to-oracle-rac.md': 'deploy/configure/databases/carbon-database/change-to-oracle-rac.md' 'deploy/change-to-postgresql.md': 'deploy/configure/databases/carbon-database/change-to-postgresql.md' 'deploy/change-to-remote-h2.md': 'deploy/configure/databases/carbon-database/change-to-remote-h2.md' - 'deploy/change-datasource-bpsds.md': 'deploy/configure/databases/carbon-database/change-datasource-bpsds.md' 'deploy/change-datasource-consent-management.md': 'deploy/configure/databases/carbon-database/change-datasource-consent-management.md' 'deploy/enable-fips-for-is.md': 'deploy/security/enable-fips-for-is.md' @@ -328,6 +332,7 @@ plugins: # To address the broken links in the API Authorization guides due to the directory structure mismatch is Asgardeo and IS 'guides/api-authorization.md': 'guides/authorization/api-authorization/api-authorization.md' + 'guides/authorization/impersonation/user-impersonation.md': 'guides/authorization/user-impersonation.md' # Navigation nav: @@ -476,8 +481,7 @@ nav: - Attribute-based access control: guides/authorization/api-authorization/attribute-based-access-control.md - Fine-grained authorization: - XACML in provisioning flows: guides/authorization/fine-grained-authorization/rule-based-provisioning.md - - Impersonation: - - User Impersonation: guides/authorization/impersonation/user-impersonation.md + - User Impersonation: guides/authorization/user-impersonation.md - Branding: - Branding: guides/branding/index.md - Configure UI branding: guides/branding/configure-ui-branding.md @@ -624,7 +628,6 @@ nav: - Change to Oracle RAC: deploy/configure/databases/carbon-database/change-to-oracle-rac.md - Change to PostgreSQL: deploy/configure/databases/carbon-database/change-to-postgresql.md - Change to remote H2: deploy/configure/databases/carbon-database/change-to-remote-h2.md - - Change the Default Datasource for BPS: deploy/configure/databases/carbon-database/change-datasource-bpsds.md - Change the Default Datasource for Consent Management: deploy/configure/databases/carbon-database/change-datasource-consent-management.md - Change the Default Datasource for Session Data: deploy/configure/databases/carbon-database/change-datasource-session.md - Data Purging: deploy/configure/databases/data-purging.md @@ -668,7 +671,6 @@ nav: - Encryption: - Symmetric encryption: - Symmetric encryption: deploy/security/symmetric-encryption/index.md - - Configure symmetric key encryption: deploy/security/symmetric-encryption/use-symmetric-encryption.md - Symmetric data encryption key rotation: deploy/security/symmetric-encryption/blue-green-data-encryption-keyrotation.md - Asymmetric encryption: - Asymmetric encryption: deploy/security/asymmetric-encryption/index.md @@ -882,6 +884,18 @@ nav: - Financial-grade API: references/financial-grade-api.md - App-native authentication: references/app-native-authentication.md - OIDC session management: references/concepts/oidc-session-management.md + - React Guide: + - Introduction: complete-guides/react/introduction.md + - Prerequisite: complete-guides/react/prerequisite.md + - Configure an application: complete-guides/react/register-an-application.md + - Create a React app: complete-guides/react/create-a-react-app.md + - Configure Asgardeo SDK: complete-guides/react/install-asgardeo-sdk.md + - Add login and logout: complete-guides/react/add-login-and-logout.md + - Display user details: complete-guides/react/display-logged-in-user-details.md + - Securing Routes: complete-guides/react/securing-routes-within-the-app.md + - Accessing protected API : complete-guides/react/accessing-protected-api.md + - Manage tokens in React : complete-guides/react/manage-tokens-in-React-apps.md + - Next Steps: complete-guides/react/next-steps.md not_in_nav: | diff --git a/en/identity-server/is_common.yml b/en/identity-server/is_common.yml index e112f96108..596c44aae4 100644 --- a/en/identity-server/is_common.yml +++ b/en/identity-server/is_common.yml @@ -35,6 +35,7 @@ extra: product: is product_name: *site_name nav_list: + - Home - Get Started - Guides - Setup diff --git a/en/identity-server/next/docs/apis/restapis/actions.yaml b/en/identity-server/next/docs/apis/restapis/actions.yaml index f03b99d6fa..243a757910 100644 --- a/en/identity-server/next/docs/apis/restapis/actions.yaml +++ b/en/identity-server/next/docs/apis/restapis/actions.yaml @@ -505,127 +505,6 @@ paths: curl --location --request POST 'https://localhost:9443/api/server/v1/actions/{actionType}/{actionId}/deactivate' \ -H 'Authorization: Basic YWRtaW46YWRtaW4=' - /actions/{actionType}/{actionId}/{authType}: - put: - tags: - - Actions Endpoint - summary: Update Action Authentication - description: "This API updates authentication mechanism for the endpoint configured for the action. \n\n - Scope (Permission) required: ``internal_action_mgt_update``\n\n" - operationId: updateActionEndpointAuthentication - parameters: - - name: actionType - in: path - description: Name of the Action Type. - required: true - schema: - enum: - - preIssueAccessToken - - name: actionId - in: path - description: Unique identifier of the action. - required: true - schema: - type: string - - name: authType - in: path - description: Authentication Type of the Action Endpoint. - required: true - schema: - enum: - - none - - basic - - apiKey - - bearer - requestBody: - content: - application/json: - schema: - $ref: '#/components/schemas/AuthTypeProperties' - description: This represents the updating authentication mechanism for the endpoint configured. - required: true - responses: - '200': - description: OK - content: - application/json: - schema: - $ref: '#/components/schemas/ActionResponse' - '400': - description: Bad Request - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '401': - description: Unauthorized - '403': - description: Forbidden - '404': - description: Not Found - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '500': - description: Server Error - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - '501': - description: Not Implemented - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - x-codeSamples: - - lang: Curl(Bearer) - source: | - curl --location --request PUT 'https://localhost:9443/api/server/v1/actions/{actionType}/{actionId}/bearer' \ - -H 'Content-Type: application/json' \ - -H 'Accept: application/json' \ - -H 'Authorization: Basic YWRtaW46YWRtaW4=' \ - -d '{ - "properties": { - "accessToken": "token" - } - }' - - lang: Curl(Basic) - source: | - curl --location --request PUT 'https://localhost:9443/api/server/v1/actions/{actionType}/{actionId}/basic' \ - -H 'Content-Type: application/json' \ - -H 'Accept: application/json' \ - -H 'Authorization: Basic YWRtaW46YWRtaW4=' \ - -d '{ - "properties": { - "username": "username", - "password": "password" - } - }' - - lang: Curl(API Key) - source: | - curl --location --request PUT 'https://localhost:9443/api/server/v1/actions/{actionType}/{actionId}/apiKey' \ - -H 'Content-Type: application/json' \ - -H 'Accept: application/json' \ - -H 'Authorization: Basic YWRtaW46YWRtaW4=' \ - -d '{ - "properties": { - "header": "header", - "value": "value" - } - }' - - lang: Curl(None) - source: | - curl --location --request PUT 'https://localhost:9443/api/server/v1/actions/{actionType}/{actionId}/none' \ - -H 'Content-Type: application/json' \ - -H 'Accept: application/json' \ - -H 'Authorization: Basic YWRtaW46YWRtaW4=' \ - -d '{ - "properties": {} - }' - x-codegen-request-body-name: body - components: securitySchemes: BasicAuth: @@ -956,13 +835,6 @@ components: - $ref: '#/components/schemas/BearerAuthentication' - $ref: '#/components/schemas/NoAuthentication' - AuthTypeProperties: - oneOf: - - $ref: '#/components/schemas/Basic' - - $ref: '#/components/schemas/ApiKey' - - $ref: '#/components/schemas/Bearer' - - $ref: '#/components/schemas/None' - Error: type: object properties: diff --git a/en/identity-server/next/docs/apis/restapis/scim2-users.yaml b/en/identity-server/next/docs/apis/restapis/scim2-users.yaml index 6a23feca32..1628d9123f 100644 --- a/en/identity-server/next/docs/apis/restapis/scim2-users.yaml +++ b/en/identity-server/next/docs/apis/restapis/scim2-users.yaml @@ -681,16 +681,39 @@ components: $ref: '#/components/schemas/UserResponseObject' UserSearchRequestObject: type: object - example: + properties: schemas: - - urn:ietf:params:scim:api:messages:2.0:SearchRequest + type: object + items: + type: string + example: + - urn:ietf:params:scim:api:messages:2.0:SearchRequest attributes: - - name.familyName - - userName - filter: userName sw ki and name.familyName co err - domain: PRIMARY - startIndex: 1 - count: 10 + type: array + description: SCIM defined attributes parameter. + items: + type: string + example: + - name.familyName + - userName + filter: + type: string + description: The expression used for filtering. Supported filters areew, eq, co, sw, and and.
+ example: userName sw ki and name.familyName co err
+ domain:
+ type: string
+ description: The name of the user store where filtering needs to be applied.
+ example: DEFAULT
+ startIndex:
+ type: integer
+ format: int32
+ description: The 1-based index of the first query result
+ example: 1
+ count:
+ type: integer
+ format: int32
+ description: Specifies the desired maximum number of query results per page.
+ example: 10
ErrorInvalidInput:
required:
- detail
diff --git a/en/identity-server/next/docs/apis/restapis/user-store.yaml b/en/identity-server/next/docs/apis/restapis/user-store.yaml
index 7a68c6df5d..f674b3f01f 100644
--- a/en/identity-server/next/docs/apis/restapis/user-store.yaml
+++ b/en/identity-server/next/docs/apis/restapis/user-store.yaml
@@ -352,7 +352,7 @@ paths:
-d '[
{
"operation": "REPLACE",
- "path": "/properties/disabled",
+ "path": "/properties/Disabled",
"value": "true"
}
]'
@@ -880,7 +880,7 @@ components:
path:
type: string
description: A JSON-Pointer
- example: /properties/disabled
+ example: /properties/Disabled
value:
type: string
description: The value to be used within the operations
diff --git a/en/identity-server/next/docs/assets/img/concepts/asgardeo-sdk.png b/en/identity-server/next/docs/assets/img/concepts/asgardeo-sdk.png
new file mode 100644
index 0000000000..b5e8eb3116
Binary files /dev/null and b/en/identity-server/next/docs/assets/img/concepts/asgardeo-sdk.png differ
diff --git a/en/identity-server/next/docs/assets/img/concepts/asgardeo-user-stores.png b/en/identity-server/next/docs/assets/img/concepts/asgardeo-user-stores.png
new file mode 100644
index 0000000000..59dc1ef44f
Binary files /dev/null and b/en/identity-server/next/docs/assets/img/concepts/asgardeo-user-stores.png differ
diff --git a/en/identity-server/next/docs/assets/img/concepts/login-flow-ai.png b/en/identity-server/next/docs/assets/img/concepts/login-flow-ai.png
new file mode 100644
index 0000000000..bce647931e
Binary files /dev/null and b/en/identity-server/next/docs/assets/img/concepts/login-flow-ai.png differ
diff --git a/en/identity-server/next/docs/assets/img/concepts/login-flow.png b/en/identity-server/next/docs/assets/img/concepts/login-flow.png
new file mode 100644
index 0000000000..c93053ee5f
Binary files /dev/null and b/en/identity-server/next/docs/assets/img/concepts/login-flow.png differ
diff --git a/en/identity-server/next/docs/assets/img/guides/account-configurations/bot-detection.png b/en/identity-server/next/docs/assets/img/guides/account-configurations/bot-detection.png
index 995165a76f..90874d9d31 100644
Binary files a/en/identity-server/next/docs/assets/img/guides/account-configurations/bot-detection.png and b/en/identity-server/next/docs/assets/img/guides/account-configurations/bot-detection.png differ
diff --git a/en/identity-server/next/docs/assets/img/guides/account-configurations/invite-user-to-set-password.png b/en/identity-server/next/docs/assets/img/guides/account-configurations/invite-user-to-set-password.png
index b3d4d36326..50d5cc865d 100644
Binary files a/en/identity-server/next/docs/assets/img/guides/account-configurations/invite-user-to-set-password.png and b/en/identity-server/next/docs/assets/img/guides/account-configurations/invite-user-to-set-password.png differ
diff --git a/en/identity-server/next/docs/assets/img/guides/authorization/access-token/access-token-attributes.png b/en/identity-server/next/docs/assets/img/guides/authorization/access-token/access-token-attributes.png
new file mode 100644
index 0000000000..b5932d8df3
Binary files /dev/null and b/en/identity-server/next/docs/assets/img/guides/authorization/access-token/access-token-attributes.png differ
diff --git a/en/identity-server/next/docs/assets/img/guides/idp/x-idp/x-app-name.png b/en/identity-server/next/docs/assets/img/guides/idp/x-idp/x-app-name.png
new file mode 100644
index 0000000000..8d405387df
Binary files /dev/null and b/en/identity-server/next/docs/assets/img/guides/idp/x-idp/x-app-name.png differ
diff --git a/en/identity-server/next/docs/assets/img/guides/idp/x-idp/x-auth-config.png b/en/identity-server/next/docs/assets/img/guides/idp/x-idp/x-auth-config.png
new file mode 100644
index 0000000000..6696b3af88
Binary files /dev/null and b/en/identity-server/next/docs/assets/img/guides/idp/x-idp/x-auth-config.png differ
diff --git a/en/identity-server/next/docs/assets/img/guides/idp/x-idp/x-configure-connector.png b/en/identity-server/next/docs/assets/img/guides/idp/x-idp/x-configure-connector.png
new file mode 100644
index 0000000000..e45aa4ab12
Binary files /dev/null and b/en/identity-server/next/docs/assets/img/guides/idp/x-idp/x-configure-connector.png differ
diff --git a/en/identity-server/next/docs/assets/img/guides/idp/x-idp/x-custom-connector.png b/en/identity-server/next/docs/assets/img/guides/idp/x-idp/x-custom-connector.png
new file mode 100644
index 0000000000..9975168a6a
Binary files /dev/null and b/en/identity-server/next/docs/assets/img/guides/idp/x-idp/x-custom-connector.png differ
diff --git a/en/identity-server/next/docs/assets/img/guides/idp/x-idp/x-key-token.png b/en/identity-server/next/docs/assets/img/guides/idp/x-idp/x-key-token.png
new file mode 100644
index 0000000000..aba827b0b9
Binary files /dev/null and b/en/identity-server/next/docs/assets/img/guides/idp/x-idp/x-key-token.png differ
diff --git a/en/identity-server/next/docs/assets/img/guides/multitenancy/add-tenant.png b/en/identity-server/next/docs/assets/img/guides/multitenancy/add-tenant.png
deleted file mode 100644
index 272219191a..0000000000
Binary files a/en/identity-server/next/docs/assets/img/guides/multitenancy/add-tenant.png and /dev/null differ
diff --git a/en/identity-server/next/docs/assets/img/guides/multitenancy/create-root-organization-modal.png b/en/identity-server/next/docs/assets/img/guides/multitenancy/create-root-organization-modal.png
new file mode 100644
index 0000000000..9e8da1986f
Binary files /dev/null and b/en/identity-server/next/docs/assets/img/guides/multitenancy/create-root-organization-modal.png differ
diff --git a/en/identity-server/next/docs/assets/img/guides/multitenancy/new-root-organization.png b/en/identity-server/next/docs/assets/img/guides/multitenancy/new-root-organization.png
new file mode 100644
index 0000000000..4cd86793fd
Binary files /dev/null and b/en/identity-server/next/docs/assets/img/guides/multitenancy/new-root-organization.png differ
diff --git a/en/identity-server/next/docs/assets/img/guides/multitenancy/root-organizaiton-listing.png b/en/identity-server/next/docs/assets/img/guides/multitenancy/root-organizaiton-listing.png
new file mode 100644
index 0000000000..8441eab80b
Binary files /dev/null and b/en/identity-server/next/docs/assets/img/guides/multitenancy/root-organizaiton-listing.png differ
diff --git a/en/identity-server/next/docs/assets/img/guides/multitenancy/root-organization-advanced-search.png b/en/identity-server/next/docs/assets/img/guides/multitenancy/root-organization-advanced-search.png
new file mode 100644
index 0000000000..1938cc5975
Binary files /dev/null and b/en/identity-server/next/docs/assets/img/guides/multitenancy/root-organization-advanced-search.png differ
diff --git a/en/identity-server/next/docs/assets/img/guides/multitenancy/root-organization-basic-search.png b/en/identity-server/next/docs/assets/img/guides/multitenancy/root-organization-basic-search.png
new file mode 100644
index 0000000000..d321637647
Binary files /dev/null and b/en/identity-server/next/docs/assets/img/guides/multitenancy/root-organization-basic-search.png differ
diff --git a/en/identity-server/next/docs/assets/img/guides/multitenancy/root-organization-card-actions.png b/en/identity-server/next/docs/assets/img/guides/multitenancy/root-organization-card-actions.png
new file mode 100644
index 0000000000..02b0ac5bed
Binary files /dev/null and b/en/identity-server/next/docs/assets/img/guides/multitenancy/root-organization-card-actions.png differ
diff --git a/en/identity-server/next/docs/assets/img/guides/multitenancy/root-organization-details.png b/en/identity-server/next/docs/assets/img/guides/multitenancy/root-organization-details.png
new file mode 100644
index 0000000000..2f8c83c9ed
Binary files /dev/null and b/en/identity-server/next/docs/assets/img/guides/multitenancy/root-organization-details.png differ
diff --git a/en/identity-server/next/docs/assets/img/guides/multitenancy/root-organizations-dropdown.png b/en/identity-server/next/docs/assets/img/guides/multitenancy/root-organizations-dropdown.png
new file mode 100644
index 0000000000..b61f70318f
Binary files /dev/null and b/en/identity-server/next/docs/assets/img/guides/multitenancy/root-organizations-dropdown.png differ
diff --git a/en/identity-server/next/docs/assets/img/guides/multitenancy/view-tenants.png b/en/identity-server/next/docs/assets/img/guides/multitenancy/view-tenants.png
deleted file mode 100644
index 9f36086f00..0000000000
Binary files a/en/identity-server/next/docs/assets/img/guides/multitenancy/view-tenants.png and /dev/null differ
diff --git a/en/identity-server/next/docs/assets/img/guides/organization/attributes/edit-attribute-mappings.png b/en/identity-server/next/docs/assets/img/guides/organization/attributes/edit-attribute-mappings.png
index e8ddb8f34b..cb7c29e3b0 100644
Binary files a/en/identity-server/next/docs/assets/img/guides/organization/attributes/edit-attribute-mappings.png and b/en/identity-server/next/docs/assets/img/guides/organization/attributes/edit-attribute-mappings.png differ
diff --git a/en/identity-server/next/docs/assets/img/guides/organization/attributes/edit-attributes-additional-properties.png b/en/identity-server/next/docs/assets/img/guides/organization/attributes/edit-attributes-additional-properties.png
index 323672e8a5..c220d531d8 100644
Binary files a/en/identity-server/next/docs/assets/img/guides/organization/attributes/edit-attributes-additional-properties.png and b/en/identity-server/next/docs/assets/img/guides/organization/attributes/edit-attributes-additional-properties.png differ
diff --git a/en/identity-server/next/docs/assets/img/guides/organization/attributes/edit-attributes-general.png b/en/identity-server/next/docs/assets/img/guides/organization/attributes/edit-attributes-general.png
index 93f10dcad1..75016635ec 100644
Binary files a/en/identity-server/next/docs/assets/img/guides/organization/attributes/edit-attributes-general.png and b/en/identity-server/next/docs/assets/img/guides/organization/attributes/edit-attributes-general.png differ
diff --git a/en/identity-server/next/docs/assets/img/guides/organization/attributes/enable-for-user-store.png b/en/identity-server/next/docs/assets/img/guides/organization/attributes/enable-for-user-store.png
new file mode 100644
index 0000000000..35c36bcee9
Binary files /dev/null and b/en/identity-server/next/docs/assets/img/guides/organization/attributes/enable-for-user-store.png differ
diff --git a/en/identity-server/next/docs/assets/img/guides/organization/self-service/customer/recover-your-username.png b/en/identity-server/next/docs/assets/img/guides/organization/self-service/customer/recover-your-username.png
new file mode 100644
index 0000000000..f45a0d59d8
Binary files /dev/null and b/en/identity-server/next/docs/assets/img/guides/organization/self-service/customer/recover-your-username.png differ
diff --git a/en/identity-server/next/docs/assets/img/guides/organization/self-service/customer/username-recovery-channel-selection.png b/en/identity-server/next/docs/assets/img/guides/organization/self-service/customer/username-recovery-channel-selection.png
new file mode 100644
index 0000000000..644d0fa203
Binary files /dev/null and b/en/identity-server/next/docs/assets/img/guides/organization/self-service/customer/username-recovery-channel-selection.png differ
diff --git a/en/identity-server/next/docs/assets/img/guides/organization/self-service/customer/username-recovery-claim.png b/en/identity-server/next/docs/assets/img/guides/organization/self-service/customer/username-recovery-claim.png
new file mode 100644
index 0000000000..9db0cf4ca4
Binary files /dev/null and b/en/identity-server/next/docs/assets/img/guides/organization/self-service/customer/username-recovery-claim.png differ
diff --git a/en/identity-server/next/docs/assets/img/guides/users/migrate-users/create-a-component.png b/en/identity-server/next/docs/assets/img/guides/users/migrate-users/create-a-component.png
new file mode 100644
index 0000000000..5a214f3db4
Binary files /dev/null and b/en/identity-server/next/docs/assets/img/guides/users/migrate-users/create-a-component.png differ
diff --git a/en/identity-server/next/docs/assets/img/guides/users/migrate-users/migrate-users-visual.png b/en/identity-server/next/docs/assets/img/guides/users/migrate-users/migrate-users-visual.png
new file mode 100644
index 0000000000..4cbe1f6c77
Binary files /dev/null and b/en/identity-server/next/docs/assets/img/guides/users/migrate-users/migrate-users-visual.png differ
diff --git a/en/identity-server/next/docs/assets/img/guides/users/migrate-users/polling-make-open-endpoint.png b/en/identity-server/next/docs/assets/img/guides/users/migrate-users/polling-make-open-endpoint.png
new file mode 100644
index 0000000000..20faadfac8
Binary files /dev/null and b/en/identity-server/next/docs/assets/img/guides/users/migrate-users/polling-make-open-endpoint.png differ
diff --git a/en/identity-server/next/docs/assets/img/guides/users/migrate-users/service-details.png b/en/identity-server/next/docs/assets/img/guides/users/migrate-users/service-details.png
new file mode 100644
index 0000000000..eb4f4f881a
Binary files /dev/null and b/en/identity-server/next/docs/assets/img/guides/users/migrate-users/service-details.png differ
diff --git a/en/identity-server/next/docs/assets/img/guides/users/migrate-users/silent-user-migration.png b/en/identity-server/next/docs/assets/img/guides/users/migrate-users/silent-user-migration.png
new file mode 100644
index 0000000000..5f0c1c4b2e
Binary files /dev/null and b/en/identity-server/next/docs/assets/img/guides/users/migrate-users/silent-user-migration.png differ
diff --git a/en/identity-server/next/docs/assets/img/guides/users/migrate-users/wait-page.png b/en/identity-server/next/docs/assets/img/guides/users/migrate-users/wait-page.png
new file mode 100644
index 0000000000..d1d192c963
Binary files /dev/null and b/en/identity-server/next/docs/assets/img/guides/users/migrate-users/wait-page.png differ
diff --git a/en/identity-server/next/docs/concepts/add-login.md b/en/identity-server/next/docs/concepts/add-login.md
new file mode 100644
index 0000000000..bea0e89133
--- /dev/null
+++ b/en/identity-server/next/docs/concepts/add-login.md
@@ -0,0 +1 @@
+{% include "../../../../includes/concepts/add-login.md" %}
\ No newline at end of file
diff --git a/en/identity-server/next/docs/concepts/api-security.md b/en/identity-server/next/docs/concepts/api-security.md
new file mode 100644
index 0000000000..ed3be72922
--- /dev/null
+++ b/en/identity-server/next/docs/concepts/api-security.md
@@ -0,0 +1 @@
+{% include "../../../../includes/concepts/api-security.md" %}
\ No newline at end of file
diff --git a/en/identity-server/next/docs/concepts/basic-concepts.md b/en/identity-server/next/docs/concepts/basic-concepts.md
new file mode 100644
index 0000000000..5d7d7595d9
--- /dev/null
+++ b/en/identity-server/next/docs/concepts/basic-concepts.md
@@ -0,0 +1 @@
+{% include "../../../../includes/concepts/basic-concepts.md" %}
\ No newline at end of file
diff --git a/en/identity-server/next/docs/concepts/customer-iam.md b/en/identity-server/next/docs/concepts/customer-iam.md
new file mode 100644
index 0000000000..abec1a16fe
--- /dev/null
+++ b/en/identity-server/next/docs/concepts/customer-iam.md
@@ -0,0 +1 @@
+{% include "../../../../includes/concepts/customer-iam.md" %}
\ No newline at end of file
diff --git a/en/identity-server/next/docs/concepts/index.md b/en/identity-server/next/docs/concepts/index.md
new file mode 100644
index 0000000000..66813dff99
--- /dev/null
+++ b/en/identity-server/next/docs/concepts/index.md
@@ -0,0 +1 @@
+{% include "../../../../includes/concepts/index.md" %}
\ No newline at end of file
diff --git a/en/identity-server/next/docs/concepts/workforce-iam.md b/en/identity-server/next/docs/concepts/workforce-iam.md
new file mode 100644
index 0000000000..05a302add4
--- /dev/null
+++ b/en/identity-server/next/docs/concepts/workforce-iam.md
@@ -0,0 +1 @@
+{% include "../../../../includes/concepts/workforce-iam.md" %}
\ No newline at end of file
diff --git a/en/identity-server/next/docs/deploy/configure/databases/carbon-database/change-datasource-bpsds.md b/en/identity-server/next/docs/deploy/configure/databases/carbon-database/change-datasource-bpsds.md
deleted file mode 100644
index b4f05c586e..0000000000
--- a/en/identity-server/next/docs/deploy/configure/databases/carbon-database/change-datasource-bpsds.md
+++ /dev/null
@@ -1,114 +0,0 @@
-# Change the Default Datasource for BPS
-
-This document guides you to change the underlying databases that are
-used in business process service(BPS) components.
-
-By default WSO2 Identity Server uses the Embedded H2 database as the BPS
-datasource. However, you can change this to any database type that is
-supported by WSO2 Identity Server.
-
-Following are the sample configuration for each database type.
-
-??? example "PostgreSQL"
-
- 1. Configure the `-
-
- OpenJDK 11 -
- OpenJDK 17 -
- Oracle JDK 11 -
- Oracle JDK 17 -
- AdoptOpenJDK 11 +
- Temurin OpenJDK 11 +
- Temurin OpenJDK 17 +
- Temurin OpenJDK 21
Domain |
- The domain name (e.g., abc.com), which is used as a unique identifier for your domain. You can use it to sign in to the Management Console to be redirected to your specific tenant. The domain is also used in URLs to distinguish one tenant from another. | -||
Select Usage Plan for Tenant |
- The usage plan defines limitations (such as the number of users, bandwidth, etc.) for the tenant. | +The domain name (e.g., abc.com) is used as a unique identifier for your organization. The URL for the new root organization's Console will be `https:// |
|
First Name / Last Name |
- The name of the tenant admin. | +First Name |
+ The first name of the root organization admin. |
Admin Username |
- The sign-in username of the tenant admin. The username always ends with the domain name (e.g., admin@abc.com). | +Last Name |
+ The last name of the root organization admin. |
Admin Password |
- The password used to sign in using the admin username specified. | -||
Admin Password (Repeat) |
- Repeat the password to confirm. | +Username |
+ The username of the root organization admin that will be used for signing in. |
Email |
The email address of the admin. | ||
Password |
+ The password used when singing in with the username specified above. | +
| +Manage staff and consumers of each organization at their own organizational level, ensuring fully isolated user onboarding and management experience. Ideal for organization with business customers and partners. Organizations can be provided the flexibility to onboard their own business customers and partners forming a hierarchical business ecosystem. + +[ Diagram] + + | ++ +Manage all the staff and customers centrally at the root-organization level and assign them to sub-organizations with different roles and access based on business needs. This approach is ideal for representing entities within the same corporate group or divisions of a larger organization. Organizations can be represented hierarchically to represent complex organizational structures. + +[Diagram] + | +
| start_authentication_endpoint | +URL of the start authentication endpoint deployed in an external service | +
|---|---|
| polling_endpoint | +URL of the polling endpoint deployed in an external service | +
| authentication_status_endpoint | +URL of the authentication status endpoint deployed in an external service | +
| requestAuthConfig | +An object containing necessary authentication metadata to invoke the APIs. Refer Conditional authentication - API reference for more information. | +
Microsoft
+ {% if product_name == "WSO2 Identity Server" %}
Microsoft 365
@@ -38,7 +39,6 @@ You can register an external IdP in {{product_name}} by creating a connection. {
IWA
- {% if product_name == "WSO2 Identity Server" %}
@@ -53,10 +53,12 @@ You can register an external IdP in {{product_name}} by creating a connection. {
SAML
+ {% if product_name == "WSO2 Identity Server" %}
WS-Federation
+ {% endif %}
{% if product_name == "Asgardeo" %}
diff --git a/en/includes/guides/authentication/oidc/jarm.md b/en/includes/guides/authentication/oidc/jarm.md
index 9604cce1c2..db5c69e89a 100644
--- a/en/includes/guides/authentication/oidc/jarm.md
+++ b/en/includes/guides/authentication/oidc/jarm.md
@@ -10,10 +10,10 @@ Below is a sample authorization request sent to the authorization endpoint of th
https://api.asgardeo.io/t/SUCCESS and ERROR.
+The response can have three possible states: SUCCESS, FAILEDand ERROR.
-SUCCESS: Indicates that the request was processed successfully and includes any state changes or modifications that should be applied.
+SUCCESS: Indicates that the request was processed successfully, including any state changes or modifications that need to be applied.
-ERROR: Indicates a failure in processing, accompanied by an error message that should be communicated to the application. This error message should adhere to OAuth 2.0 error response definitions to ensure compliance. However, it is your responsibility to ensure this compliance when extending the flow.
+FAILED: Represents a selective failure within the token flow due to validation logic or business rules enforced by your external service. A 400 (Client Error) response is returned to the application, incorporating the failure message provided by your external service. It is your responsibility to supply an OAuth 2.0-compliant failure message when extending the flow.
-!!! note
- Currently, ERROR responses are not communicated back to the client, but this functionality is planned for inclusion by end October 2024.
+ERROR: Indicates a processing failure, typically caused by server-side issues. A 500 (Server Error) response is returned to the application.
#### Response for SUCCESS state:
@@ -376,9 +375,68 @@ Http Status Code: 200
!!! tip
Refer the [sample responses for successful access token updates]({{base_path}}/references/actions/pre-issue-access-token-action/sample-success-responses/) to learn how to construct success responses for different scenarios.
+#### Response for FAILED state:
+
+When the external service returns a 200 OK status code with a FAILED state, it means the service has intentionally opted to prevent access token issuance. This decision is based on specific validation logic or business rules defined by your application's requirements.
+
+The response body must be a JSON object containing the following properties:
+
+Http Status Code: 200
+
+| Property | +Description | +
|---|---|
| actionStatus | +Indicates the outcome of the request. For a failed operation, this should be set to |
+
| failureReason | +Provides the reason for failing to issue an access token. This value will be mapped to the error field in the response returned from the /oauth2/token endpoint.. |
+
| failureDescription | +Offers a detailed explanation of the failure. This value will be mapped to the error_description field in the |
+
ERROR state, it can return an HTTP status code of 400, 401, or 500, indicating that the expected validations are not met or there is an issue processing the request.
+When the external service responds with an ERROR state, it can return an HTTP status code of 400, 401, or 500, indicating either a validation failure or an issue processing the request.
Http Status Code: 400, 401 or 500
@@ -396,8 +454,8 @@ Http Status Code: 400, 401 or 500
The error code, as specified in OAuth 2.0 error response definitions..
Describes the cause of the error..
ERROR responses are not communicated back to the client, but this functionality is planned for inclusion by end October 2024.
+If the external service returns an error response (either defined or undefined) or fails to respond entirely, it will be treated as an error in executing the action. In any of these cases, the application that initiated the token request will receive a 500 Internal Server Error.
+
+Below is an example of an error response returned by the service implementing the pre issue access token action.
+
+Response from external service:
+```http
+HTTP/1.1 500
+Content-Type: application/json
+
+{
+ "actionStatus": "ERROR",
+ "errorMessage": "Server error",
+ "errorDescription": "Error while processing request."
+}
+```
+
+This will result in the following error response being sent to the application that initiated the token request.
-If the defined error response is not received, or if the external service fails to respond, this is identified as an error in executing the action. In such cases, the flow will proceed as if the action was not applied, ensuring that the process continues without disruption.
+Error response to the application:
+```http
+HTTP/1.1 500
+Content-Type: application/json
+
+{
+ "error":”server_error",
+ "error_description": "Internal Server Error."
+}
+
+```
+
+!!! note
+ Currently, the errorMessage or errorDescription from the external service’s ERROR response is not directly included in the error response sent back to the application.
diff --git a/en/includes/guides/encryption/symmetric-encryption.md b/en/includes/guides/encryption/symmetric-encryption.md
deleted file mode 100644
index 6d76a86b4d..0000000000
--- a/en/includes/guides/encryption/symmetric-encryption.md
+++ /dev/null
@@ -1,16 +0,0 @@
-# Symmetric Encryption
-
-In symmetric encryption, a single key is used for the encryption and decryption of information. In WSO2 Identity Server version 7.0.0, symmetric encryption is used by default. If required, you may switch to [asymmetric key encryption]({{base_path}}/deploy/security/asymmetric-encryption/).
-
-## Why symmetric key encryption?
-
-In all versions of WSO2 Identity Server prior to 5.11.0, asymmetric key encryption was used for signing purposes and for encrypting internal data. However, from version 7.0.0 onwards, symmetric key encryption is used as the default encryption mechanism due to the following reasons:
-
-- **Ability to easily change key stores** - In earlier versions, internal data was encrypted using asymmetric key encryption. This means that whenever the certificates expire, or when the keystore is changed, all encrypted data should be migrated. With the shift to symmetric encryption, this overhead is now removed. The secret key involved in symmetric key encryption is encrypted using asymmetric key encryption. Therefore, the secret key needs to be re-encrypted only when the keystore changes.
-
-- **Industry-wide usage** - Symmetric key encryption is used as an accepted industry-wide mechanism for encrypting internal sensitive data. This includes both on-premise and cloud platforms.
-
-- **Post-Quantum Security** - Quantum computers have the potential to break widely-used asymmetric encryption algorithms such as RSA and ECC by efficiently solving the underlying mathematical problems. Symmetric key encryption, on the other hand, is more resistant to quantum attacks.
-
-!!! info
- For more information on symmetric key encryption properties, see [Configure Symmetric Key Encryption]({{base_path}}/deploy/security/symmetric-encryption/use-symmetric-encryption).
diff --git a/en/includes/guides/fragments/manage-app/oidc-settings/access-token.md b/en/includes/guides/fragments/manage-app/oidc-settings/access-token.md
index 4604f0fcae..f67776ebae 100644
--- a/en/includes/guides/fragments/manage-app/oidc-settings/access-token.md
+++ b/en/includes/guides/fragments/manage-app/oidc-settings/access-token.md
@@ -2,7 +2,7 @@
#### Token type
{{product_name}} supports the following token types.
-- *Opaque*: Opaque tokens are plain text tokens. If a resource server wants to know information related to an opaque token, it has to call the introspection endpoint and receive information related to tokens. An example for a opaque token response is shown below.
+- **Opaque**: Opaque tokens are plain text tokens. If a resource server wants to know information related to an opaque token, it has to call the introspection endpoint and receive information related to tokens. An example for a opaque token response is shown below.
```json
{
@@ -14,7 +14,7 @@
}
```
-- *JWT token*: JWT tokens are self-contained verifiable access tokens. If a resource server wants to know the information related to that token, it can decode the token and get the required information without any additional network calls. An example for a JWT token response is shown below.
+- **JWT**: JWT tokens are self-contained verifiable access tokens. If a resource server wants to know the information related to that token, it can decode the token and get the required information without any additional network calls. An example for a JWT token response is shown below.
```json
{
@@ -27,6 +27,15 @@
```
+{% if product_name == "Asgardeo" or (product_name == "WSO2 Identity Server" and is_version != "7.0.0") %} +#### Access Token Attributes + +For **JWT** access tokens, this feature enables you to specify which user attributes are included in the access token. As a result, when a user logs in to an application, only the chosen attributes are shared, providing enhanced security and flexibility. + +{: width="600" style="display: block; margin: 0; border: 0.3px solid lightgrey;"} + +{% endif %} + #### Token binding type Token binding securely links authentication tokens to client devices to prevent unauthorized token theft and replay attacks. It is a vital mechanism, especially when dealing with unsecured networks, as it provides an additional layer of security against unauthorized access. diff --git a/en/includes/guides/fragments/migrate-users/configure-choreo-for-password-migration.md b/en/includes/guides/fragments/migrate-users/configure-choreo-for-password-migration.md new file mode 100644 index 0000000000..fa3dcf2f82 --- /dev/null +++ b/en/includes/guides/fragments/migrate-users/configure-choreo-for-password-migration.md @@ -0,0 +1,115 @@ +### Step 1: Develop the authentication service + +In this section, we will develop an authentication service that will communicate with the legacy IdP to authenticate users. + +{% if product_name == "Asgardeo" %} + +!!! note + You may find a sample Ballerina authentication service [here](https://github.com/wso2/samples-is/tree/master/user-migration-samples/asgardeo/external-authentication-service){target="_blank"}. + +{% else %} + +!!! note + You may find a sample Ballerina authentication service [here](https://github.com/wso2/samples-is/tree/master/user-migration-samples/is/external-authentication-service){target="_blank"}. + +{% endif %} + +1. Create a new Ballerina package. Learn how to do so in the [Ballerina documentation](https://ballerina.io/learn/get-started/){target="_blank"}. + +2. Write a [RESTful service](https://ballerina.io/learn/write-a-restful-api-with-ballerina/){target="_blank"} that communicates with the legacy authentication system to perform user authentication. Your service should expose the following REST API endpoints. + + !!! tip + + External authentication may require additional processing time depending on the legacy IdP and network delays. Therefore it is recommended to perform the external authentication asynchronously without holding an active connection until the external authentication completes. + + - **Start authentication endpoint** - to initiate the authentication process with the legacy system. This endpoint should accept the request, return a response with a unique random identifier (preferably a UUID) and then start the external authentication process. + + - **Authentication status endpoint** - to retrieve and return the completed authentication result. + + - **Polling endpoint** - to return the completion status of the external authentication task. This should be an open endpoint that doesn’t require any authentication. + + !!! warning "Adding logs" + + We highly recommend adding sufficient logging when developing the REST service. However, ensure no sensitive information or Personally Identifiable Information (PII) are included in the logs. + +3. Commit your changes and push the code to your remote Github repository. + +### Step 2: Create and deploy the RESTful service in Choreo + +We will now deploy the developed authentication service in [Choreo](https://wso2.com/choreo/){target="_blank"}, WSO2's integration platform. To do so, + +{% if product_name == "Asgardeo" %} + +1. Go to the [Choreo Console](https://console.choreo.dev/login){target="_blank"} and login with the SAME email address you used to create your Asgardeo organization. + + !!! note + + An organization with the same name as your Asgardeo organization will be created for you in Choreo. + +{% else %} + +1. Go to the [Choreo Console](https://console.choreo.dev/login){target="_blank"} and login to your account or create an account if you don't have one already. + +{% endif %} + +2. On the top of the Console, create a new project or select an existing one. + +3. On the left panel, select **Components** and click **Create**. + +4. On the **Select a type** tab, select **Service**. + +  + + !!! note + + Learn more about service components in the [Choreo documentation](https://wso2.com/choreo/docs/develop-components/develop-services/service-component-overview/){target="_blank"} + +5. Enter a name and description for your service. + +6. Click **Authorize with Github** and connect the relevant organization, repository and the branch for the developed authentication service in step 1. + +7. Select **Ballerina** to be the buildpack and select the Ballerina project directory from your Github repository. + +  + +8. Click **Create**. + +9. Build and deploy the service. See [Choreo documentation](https://wso2.com/choreo/docs/develop-components/develop-services/develop-a-service/#step-2-build-and-deploy){target="_blank"} for instructions. + + !!! note + + If you are using the sample authentication service, be sure to provide values for the necessary configurations before you deploy the service. + +10. As discussed earlier, the polling endpoint should be an open endpoint. Follow the steps below to configure this. + + 1. Go to **Deployment** and in the **Set up** card, click **Endpoint Configurations**. + + 2. In the window that appears, under **Permissions**, expand the polling endpoint and turn the **Security** toggle off. + +  + + 3. Click **Apply** to save the changes. + +11. On the left navigation, go to **Manage** > **Lifecycle** and click **Publish**. + +### Step 3: Create a Choreo application to consume the APIs + +After the RESTful service is deployed, follow the steps below to create an application in Choreo and subscribe it to the REST API. This application will later be used to integrate the REST APIs with the {{ product_name }} application. + +1. Sign in to the [Choreo Developer Portal](https://devportal.choreo.dev/){target="_blank"} with the same email address you used to log in to the Choreo Console in step 2. + +2. On the top navigation, go to **Applications** and click **Create Application**. + +3. Provide a name and a description for the application and click **Create**. + +4. On the left navigation, go to **Credentials** and click **Generate Credentials**. + +5. Take note of the generated consumer key and consumer secret as you will need it later. + +6. On the left navigation, go to **Subscriptions** and click **Add APIs**. + +7. Click **Add** corresponding to the API that you created in step 2. + +!!! note + + To learn more about applications in Choreo, refer to the [Choreo documentation](https://wso2.com/choreo/docs/consuming-services/manage-application/#create-an-application){target="_blank"}. diff --git a/en/includes/guides/users/attributes/manage-attributes.md b/en/includes/guides/users/attributes/manage-attributes.md index a944f0bed3..2361e685c8 100644 --- a/en/includes/guides/users/attributes/manage-attributes.md +++ b/en/includes/guides/users/attributes/manage-attributes.md @@ -1,31 +1,31 @@ # Manage attributes -An attribute is a piece of information about a particular user. It can be anything associated with the user, such as name, group, preferences, etc. +An attribute encapsulates a single, identifiable characteristic of a user. They may range from basic identifiers such as first name, last name, home address to dynamic properties like membership status. -User attributes represent information directly related to the user, such as the street address, username, email, first name, and more. +Attributes play a crucial role in managing user information within an organization and enables applications to access the required data seamlessly. Additionally, attributes are used to manage and display user information in user profiles. -You need user attributes to maintain the required user information in an organization. You can select the user information for your applications by using these attributes. Also, the user information displayed in user profiles is managed using attributes. - -See the information given below to manage attributes in your organization. +The following guides explain how you may manage attributes of an organization. ## View attributes -To view the attributes available for your organization: -1. On the {{ product_name }} Console, go to {{ attribute_path }} > **Attributes**. -2. Click **Attributes** again under the **Manage Attributes** section. +To view attributes available for your organization: + +1. On the {{ product_name }} Console, go to **User Attributes & Stores** > **Attributes**. + +2. Under **Manage Attributes**, click **Attributes**. {: width="600" style="display: block; margin: 0; border: 0.3px solid lightgrey;"} -You can now see the complete list of attributes along with **Attribute Display Name** and **Attribute** name. + This page displays all the attributes available in your organization. -{: width="600" style="display: block; margin: 0; border: 0.3px solid lightgrey;"} + {: width="600" style="display: block; margin: 0; border: 0.3px solid lightgrey;"} ## Add custom attributes -To add a custom attribute: +Apart from the default attributes, you may define your own custom attributes by following the steps below: -1. On the {{ product_name }} Console, go to {{ attribute_path }} > **Attributes**. -2. Click **Attributes** to see the list of attributes. +1. On the {{ product_name }} Console, go to **User Attributes & Stores** > **Attributes**. +2. Under **Manage Attributes**, click **Attributes** to view the list of all attributes 3. Click **New Attribute** and enter values for the following properties: {: width="600" style="display: block; margin: 0; border: 0.3px solid lightgrey;"} @@ -38,11 +38,15 @@ To add a custom attribute:
| Attribute name | +is_migrated | +
| Attribute Display Name | +Password migration status | +
+ {{ nav_item.title }}
+
+
+ {% if nav_item.children | length > 1 %}
+
+ {% endif %}
+
+ {% endif %}
+
+
+
+
+
+
+
+{% endblock %}
diff --git a/en/theme/material/templates/integrations.html b/en/theme/material/templates/integrations.html
index 6d0366c513..56060fc238 100644
--- a/en/theme/material/templates/integrations.html
+++ b/en/theme/material/templates/integrations.html
@@ -38,7 +38,7 @@
{% endif %}
+
+
+
+ {% if page.meta.heading %}
+
+
+ + {{ page.meta.heading }} + {% if page.meta.read_time %} +
+ {% endif %} + + {{ page.content }} +
+
+ + {% if "navigation.footer" in features %} + {% if page.previous_page or page.next_page %} + {% if page.meta and page.meta.hide %} + {% set hidden = "hidden" if "footer" in page.meta.hide %} + {% endif %} + + {% endif %} + {% endif %} +
+ + + {% if "navigation.footer" in features %} + {% if page.previous_page or page.next_page %} + {% if page.meta and page.meta.hide %} + {% set hidden = "hidden" if "footer" in page.meta.hide %} + {% endif %} + + {% endif %} + {% endif %} +
{{ integration.name }}
{% set description = integration.description %} - {% set description = description.replace('{{ config.extra.product_name }}', config.extra.product_name) %} + {% set description = description.replace('{{ product_name }}', config.extra.product_name).replace('{{product_name}}', config.extra.product_name) %}{{ description }}
{% if integration.documentation_link %}
diff --git a/en/theme/material/templates/no-left-sidebar.html b/en/theme/material/templates/no-left-sidebar.html
new file mode 100644
index 0000000000..3dbca4ec1e
--- /dev/null
+++ b/en/theme/material/templates/no-left-sidebar.html
@@ -0,0 +1,33 @@
+
+
+{% extends "base.html" %}
+
+{% block styles %}
+ {{ super() }}
+
+{% endblock %}
diff --git a/en/theme/material/templates/quick-start.html b/en/theme/material/templates/quick-start.html
index 4e7076cefa..124d91b449 100644
--- a/en/theme/material/templates/quick-start.html
+++ b/en/theme/material/templates/quick-start.html
@@ -24,10 +24,10 @@
{% endblock %}
{% block container %}
-
+
- {{ page.meta.headin