In WSO2 Identity Server, when using User Information Recovery Admin Service [1], there are some flows like ‘Recover with Notification’ where we need to call a set of operations in sequence. In order to call one operation, we may need to provide captcha details for human verification. This blog post discusses how to use captcha verification when you try out the operations using Admin Services that needs captcha verification. For this demonstration, I am using WSO2 Identity Server 5.0.0 version with Service Pack 1 installed.
The captcha verification can be handled by Identity Server itself or let a 3rd party application to handle it. If you need to let Identity Server handle captcha verification, you need to set the following property in IS_HOME/repository/conf/security/identity-mgt.properties file.
Captcha.Verification.Internally.Managed=true
|
Here for demonstrating captcha verification, I am calling the getCaptcha method in UserInformationRecoveryService [1]. Following is the SOAP request I need to send.
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://services.mgt.identity.carbon.wso2.org">
<soapenv:Header/>
<soapenv:Body>
<ser:getCaptcha/>
</soapenv:Body>
</soapenv:Envelope>
|
In response I get the following SOAP message.
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Body>
<ns:getCaptchaResponse xmlns:ns="http://services.mgt.identity.carbon.wso2.org">
<ns:return xsi:type="ax2295:CaptchaInfoBean" xmlns:ax2293="http://mgt.identity.carbon.wso2.org/xsd" xmlns:ax2295="http://beans.mgt.captcha.carbon.wso2.org/xsd" xmlns:ax2297="http://beans.mgt.identity.carbon.wso2.org/xsd" xmlns:ax2298="http://dto.mgt.identity.carbon.wso2.org/xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:ax2301="http://base.identity.carbon.wso2.org/xsd">
<ax2295:imagePath>registry/resource/_system/config/repository/components/org.wso2.carbon.captcha-images/dc832c96-3ed2-45e2-adfe-fcb0ef341ce3.jpg</ax2295:imagePath>
<ax2295:secretKey>dc832c96-3ed2-45e2-adfe-fcb0ef341ce3</ax2295:secretKey>
<ax2295:userAnswer xsi:nil="true"/>
</ns:return>
</ns:getCaptchaResponse>
</soapenv:Body>
</soapenv:Envelope>
|
From the above response, we need the imagePath and the secretKey
imagePath
|
registry/resource/_system/config/repository/components/org.wso2.carbon.captcha-images/dc832c96-3ed2-45e2-adfe-fcb0ef341ce3.jpg
|
secretKey
|
dc832c96-3ed2-45e2-adfe-fcb0ef341ce3
|
When we know the imagePath, we can access the captcha image from a URL like https://<HOST_NAME>:<PORT>/<IMAGE_PATH>.
An example is below.
Then you can view the captcha image.
In User Information Recovery flows, when we need to send captcha details for verification, we need to provide the imagePath, secretKey and userAnswer. Both imagePath and secretKey were contained in the response of getCaptcha method. The userAnswer is the text or the characters displayed in the captcha image.
In this scenario, when we need to send captcha details in a SOAP request, the captcha details need to be sent as following.
<ser:captcha>
<xsd:imagePath>registry/resource/_system/config/repository/components/org.wso2.carbon.captcha-images/dc832c96-3ed2-45e2-adfe-fcb0ef341ce3.jpg</xsd:imagePath>
<xsd:secretKey>dc832c96-3ed2-45e2-adfe-fcb0ef341ce3</xsd:secretKey>
<xsd:userAnswer>8dy54</xsd:userAnswer>
</ser:captcha>
|
An example for sending captcha details is when calling the verifyConfirmationCode method in UserInformationRecoveryService.
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://services.mgt.identity.carbon.wso2.org" xmlns:xsd="http://beans.mgt.captcha.carbon.wso2.org/xsd">
<soapenv:Header/>
<soapenv:Body>
<ser:verifyConfirmationCode>
<ser:username>tharindu</ser:username>
<ser:code>00741dbc-3b03-462c-943c-902031333a3a</ser:code>
<ser:captcha> <xsd:imagePath>registry/resource/_system/config/repository/components/org.wso2.carbon.captcha-images/dc832c96-3ed2-45e2-adfe-fcb0ef341ce3.jpg</xsd:imagePath>
<xsd:secretKey>dc832c96-3ed2-45e2-adfe-fcb0ef341ce3</xsd:secretKey>
<xsd:userAnswer>8dy54</xsd:userAnswer>
</ser:captcha>
</ser:verifyConfirmationCode>
</soapenv:Body>
</soapenv:Envelope>
|
Similarly, when you try out different User Information Recovery flows, when you need to send captcha details, you can follow these steps to get to know the captcha details that should be sent for calling the operations.
References
Tharindu Edirisinghe
Identity Server Team
WSO2
No comments:
Post a Comment