Thursday, November 16, 2017

Sending an Email using Gmail API - All you need in one place.


The main motivation for me to write this blog post was when I wanted to send an email using the Gmail API, I had to refer to so many places to find bits and pieces of information and connect them to finally send an email successfully. Therefore, I wrote this blog, jotting down all the steps I have followed to do the subject. Here we go.



Creating a Google API Console project and getting the Client ID and Client Secret

Before you can integrate your application with Gmail API, you need to have a Google API Console project. In the project, you create a client ID, which you need to call the sign-in API [1].


To create a Google API Console project and client ID, follow these steps:
  1. From the project drop-down, select an existing project, or create a new one by selecting Create a new project.
  2. Enable the Gmail API from the Enable APIs and services button. You will get a dashboard with web traffic and other details.
  3. In the sidebar under "APIs & Services", select Credentials, then select the OAuth consent screen tab.
  1. Choose an Email Address, specify a Product Name, and press Save.
  1. In the Credentials tab, select the Create credentials drop-down list, and choose OAuth client ID.
  2. Under Application type, select Web application.
  3. Register the origins from which your app is allowed to access the Google APIs, as follows. An origin is a unique combination of protocol, hostname, and port.
    1. In the Authorized JavaScript origins field, enter the origin for your app. You can enter multiple origins to allow for your app to run on different protocols, domains, or subdomains. You cannot use wildcards. Following are examples.
  • http://localhost:8080
  • https://myproductionurl.example.com
    1. Enter the redirect URI in the Authorized redirect URIs field. This is the path in your application that users are redirected to after they have authenticated with Google. The path will be appended with the authorization code for access. Must have a protocol. Cannot contain URL fragments or relative paths. Cannot be a public IP address.  
    2. Press the Create button.

From the resulting OAuth client dialog box, copy the Client ID and the Client Secret. These will let your app access Google APIs. Do not share these with anyone.

Obtaining the Code

Now you got the Client ID following the steps above. Next we will need to get the code by giving the following request in the browser.
  • You need to give the same redirect URI which you gave in above steps
  • The client id you received
  • The required scopes. To send an email you need to have one of the scopes specified in [2]. I have used https://www.googleapis.com/auth/gmail.send scope along with few other scopes.


https://accounts.google.com/o/oauth2/auth?redirect_uri=<REDIRECT_URI>& response_type=code& client_id=<CLIENT_ID>& scope=https://mail.google.com/+ https://www.googleapis.com/auth/gmail.compose+ https://www.googleapis.com/auth/gmail.insert+ https://www.googleapis.com/auth/gmail.labels+ https://www.googleapis.com/auth/gmail.modify+ https://www.googleapis.com/auth/gmail.readonly+ https://www.googleapis.com/auth/gmail.send& approval_prompt=force&access_type=offline

You will get a code like below. (You might need to allow the project to access information of your Google account)

https://www.google.lk/?code=4/xxxxxxxxx

Retrieving the Access Token and Refresh Token

At this point you will have the client ID, client secret and code in hand. I use Postman to send a request and retrieve the access and refresh tokens. Following screenshot is a sample.
  • You need to make sure to send the body in x-www-form-urlencoded format




POST /oauth2/v4/token HTTP/1.1
Host: www.googleapis.com
Content-Type: application/x-www-form-urlencoded
code=<your_code>&
client_id=<your_client_id>&
client_secret=<your_client_secret>&
redirect_uri=<your_redirect_uri>&
grant_type=authorization_code

After successfully sending the request, you will receive the access and refresh tokens as below.

{
   "access_token": "ya29xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
   "token_type": "Bearer",
   "expires_in": 3600,
   "refresh_token": "1/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

Refreshing the Access Token using the Refresh Token

The access token expires in 1 hour, but your refresh token is for your lifetime. You can use your refresh token to create a new access token. Following is the sample request.

POST /oauth2/v4/token HTTP/1.1
Host: www.googleapis.com
Content-Type: application/x-www-form-urlencoded

client_id=<your_client_id>&
client_secret=<your_client_secret>&
refresh_token=<refresh_token>&
grant_type=refresh_token

You will get a new access token like below.

{
   "access_token": "ya29.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
   "token_type": "Bearer",
   "expires_in": 3600
}


Sending an Email

This is the most interesting and the most awaited section of this post.  This is the sample message that we are going to send to the recipient.
From: John Doe <jdoe@machine.example>
To: Mary Smith <mary@example.net>
Subject: Saying Hello
Date: Fri, 17 Nov 2017 09:55:06

This is a message just to say hello. So, "Hello".

But, you cannot just send this message. There are few things that you must to do send the request successfully.

  1. You need to encode this entire message with base64.
  2. Then wrap the encoded message like below to create a json payload.
{
 "raw": "<base64 encoded value>"
}

  1. Pass the access token as a query parameter in the request. Here “me” is used as the user id. You can also use your email address, but it is not required.

https://www.googleapis.com/gmail/v1/users/me/messages/send?access_token=ya29.xxxx
  1. Set the body as a raw parameter
  2. Set the Content-Type as application/json
  3. Now you are good to go. (If you miss any of the above steps, you will definitely get an error :( )


 If everything goes well, you will get a successful response as below
{
   "id": "15fc8c23371f0029",
   "threadId": "15fc8c23371f0029",
   "labelIds": [
       "SENT"
   ]
}

Finally, here I received the mail..Yayyy!!! 



Hope this post helped you out in any way and hope you liked it :) 


References


Wednesday, July 6, 2016

PKCE Support for WSO2 Identity Server 5.2.0


In this post, we will look at a new feature introduced in WSO2 Identity Server (IS) 5.2.0 which is Proof Key for Code Exchange (PKCE). WSO2 implements the PKCE specification described here. It is recommended to use as OAuth 2.0 public clients utilizing the Authorization Code Grant are susceptible to the authorization code interception attack and this spec introduces a technique to mitigate against the treat through the use of PKCE.

Implementation of PKCE in WSO2 IS




A. With PKCE, the client sends two additional parameters when requesting an authorization code. It creates a "code verifier" and derives a transformed version of the code verifier named "code challenge" through a transformation method and pass the code challenge and the transformation method along with the authorization request.

Here, there are two types of transformation methods.
     i. Plain 
     If the plain transformation method is used -> code_challenge = code_verifier

     ii. S256
     If the S256 transformation method is used -> code_challenge = BASE64URL- ENCODE(SHA256(ASCII(code_verifier)))

B. IS records the code challenge and transformation method associated with the authorization request and responds to the request with the Authorization code.

C. To retrieve the Access Token, now the client sends a request with Authorization Code and Code Verifier generated at step A.

D. IS transforms the code verifier using the transformation method recorded in step B and compares the result with the code challenge saved at step B. If both are equal, the Access Token is sent to client. Otherwise access will be denied for the user.

Any attacker who intercepts the authorization code at step B is unable to retrieve the Access Token as they are not aware of the Code Verifier. 


How to use PKCE in WSO2 IS


Registering a Service Provider 


Install WSO2 IS 5.2.0 from here and register a Service Provider.

1. Log in to the Management Console. 

2. Navigate to the Main menu to access the Identity menu. Click Add under Service Providers.

3. Fill in the Service Provider Name (eg. Playground) and click on Register.

4. Under Inbound Authentication Configuration, configure the playground application as an OAuth 2.0 application with following configurations. 

  • Callback URL - http://localhost:8080/playground2/oauth2client
  • Allowed Grant Types - All grant types
  • PKCE Mandatory - Keep as default (unselected)
  • Support PKCE 'Plain' Transform Algorithm - Keep as default (selected)


After successful registration the application is given a Client Id and a Client Secret.



Retrieving the User Info using Playground Application 


1. Deploy the Playground sample app which is used as the client to demonstrate this feature. You can set up the sample app by following this guide.

2. Access the playground application
http://localhost:8080/playground2/

3. Enter the details as follows and Authorize. (Reflects Step A above)

  • Client ID and Callback URL should be the same as in the registered service provider
  • Once you select "Use PKCE", the code challenge and the code verifier will be generated according to the selected transformation method



4. Login to the Authorization Server (IS).



5. Select a user consent - Approve or Approve Always


6.  The Authorization Code is sent to the client. (Reflects Step B above)

Enter the details as follows and Get Access Token. (Reflects Step C above)
  • Client Secret and Callback URL should be the same as in the registered service provider
  • The PKCE Verifier is the same code verifier generated at step 3.


7. Since the correct PKCE Code verifier is passed, IS should successfully do the transformation, match the code challenges and send the Access Token to the client as below. (Reflects Step D above)

Enter the user info endpoint as below and get user info.



8. User information should be successfully retrieved as below.



As mentioned earlier, PKCE will come in handy to mitigate interception attacks and secure your application which uses Authorization Code grant type. With WSO2 IS implementing it, allows users to register their apps with IS and secure it more from these vulnerabilities. 

Hope this post shed some light on this new feature. Do let us know if you have any queries.


 
 
 
 
 

Monday, July 4, 2016

User Store Count with WSO2 Identity Server 5.2.0


This post is about a new feature which is to be released with WSO2 Identity Server (IS) 5.2.0. This feature introduces a new service which enables users to count users, roles, claims etc. through the Management Console (MC) and Admin services. 

Lets look at how to use this service.

1. Download the IS 5.2.0 from the WSO2 products page once it is available.
http://wso2.com/products/identity-server/

2. Enable the JDBC User store as the primary user store. Refer here to configure a JDBC User Store

3. Add the below property inside  <UserStoreManager class="org.wso2.carbon.user.core.jdbc.JDBCUserStoreManager"> config in /repository/conf/user-mgt.xml

<Property name="CountRetrieverClass">org.wso2.carbon.identity.user.store.count.jdbc.JDBCUserStoreCountRetriever</Property>

4. Change the HideAdminServiceWSDLs property in /repository/conf/carbon.xml to false to get access to the WSDL's of the admin services

<HideAdminServiceWSDLs>false</HideAdminServiceWSDLs>

5. Start the IS server


Access the User Store Count via MC


Login to the MC and navigate to Users and Roles

Under Users, you will be able to see a new table named "Count Users" where you can count the number of users in each domain, with different claims and user name patterns etc.



Similarly, under Roles you will be able to see a new table named "Count Roles" where you can count roles in different user store domains.


 

Access the User Store Count via Admin Services


Access the WSDL of UserStoreCountService service by browsing https://localhost:9443/services/UserStoreCountService?wsdl

If the WSDL is loading, access the methods of the service through SoapUI. Here, you will have access to additional methods (CountByClaimsInDomain, countClaims) than from UI (MC).




Note:
Currently, this feature supports only JDBC User Stores. But users have the capability to extend this feature by writing their own class implementing correct interfaces. Refer here for more info in extending this feature.


Hope this post helps you to use this new feature available from WSO2 IS 5.2.0. Feel free to add a comment if you have any queries :)



Thursday, April 21, 2016

Enable SSO in WSO2 Dashboard Server 2.0.0


This post will help you to enable Single Sign-On (SSO) in WSO2 Dashboard Server (DS) 2.0.0  It has the WSO2 Identity Server (IS) components embedded. Hence, you have multiple options to enable SSO in DS.

1. Use DS as the identity provider
2. Use IS as the identity provider
3. Use any other external identity provider

Follow the below steps to enable SSO.

Configuring SSO


1.  Download DS 2.0.0 from here

2. Navigate to the following path and open the designer.json file
/repository/deployment/server/jaggeryapps/portal/configs/designer.json

3. Configure the designer.json file with correct information as follows


{
  "store": {
    "type": "fs"
  },
  "authentication": {
    "activeMethod": "sso",
    "methods": {
      "sso": {
        "attributes": {
          "issuer": "portal",
          "identityProviderURL": "https://localhost:9443/samlsso",
          "responseSigningEnabled": "true",
          "acs": "https://localhost:9443/portal/acs",
          "identityAlias": "wso2carbon",
          "useTenantKey": false
        }
      },
      "basic": {
        "attributes": {}
      }
    }
  },
  "designers": [
    "Internal/everyone"
  ],
  "tenantPrefix": "/t",
  "shareStore": false,
  "theme": "basic",
  "cacheTimeoutSeconds": "5",
  "cacheSizeBytes": "1073741824",
  "defaultDashboardRedirect": false,
  "oauth": {
    "username": "admin",
    "password": "admin"
  }
}


Notes:

  • To enable SSO the "activeMethod" property should be set to "sso"
  • To disable SSO the "activeMethod" property should be set to "basic"
  • The value set to "issuer" property should be the issuer id used when registering the service provider
  • "identityProviderURL" should be the URL to your identity provider in the format https://<hostname_of_identityProvider>:<port>/samlsso
  • If you want to enable response signing set "responseSigningEnabled" parameter to true. Then, you have to keep in mind to enable the same in the Service Provider as well. (we will discuss about it later in this post)
  • The Assertion Consumer Service (ACS) URL of the service provider defines where the browser is redirected to after successful authentication. It should be in the format https://<hostname_of_DS>:<port>/portal/acs
  • useTenantKey should be set to false if you want the tenants to access the portal

4. Next, navigate to /repository/conf/security location and open the authenticators.xml file

5. Set the ServiceProviderID property to issuer id. In our case, it is portal. Without configuring this property with the correct issuer id, users won't be able to login to the portal successfully.

<!-- Authenticator Configurations for SAML2SSOAuthenticator -->
    <Authenticator name="SAML2SSOAuthenticator" disabled="true">
        <Priority>10</Priority>
        <Config>
            <Parameter name="LoginPage">/carbon/admin/login.jsp</Parameter>
            <Parameter name="ServiceProviderID">portal</Parameter>
            <Parameter name="IdentityProviderSSOServiceURL">https://localhost:9443/samlsso</Parameter>
            <Parameter name="NameIDPolicyFormat">urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</Parameter>
            <Parameter name="AssertionConsumerServiceURL">https://localhost:9443/acs</Parameter>
.......

Creating a Service Provider


Finally we have to create a Service Provider. As I mentioned earlier, you can use any identity provider to register the portal application. The first two methods (using DS or IS) go hand in hand. I will use the DS as the identity provider in this post. But, you can create a service provider with the same steps using IS as well. Only thing you have to be cautious is to use the correct identityProviderURL when configuring the designer.json file in step 3.

So, let's create the Service Provider.

1. Navigate to the management console using the below link.
https://localhost:9443/carbon/

2. Go to Identity tab -> Service Providers and click on Add

3. Enter a service provider name (Eg: Portal) and click on Register

4. Enable the SAAS Application property

5. Go to Inbound Authentication Configuration tab -> SAML2 Web SSO Configuration and click on Configure

6. Fill the form with correct details and click on Register and Update to create the service provider. Make sure to use the same details you used to configure designer.json file in Step 3.



All done. Let's try to login to the portal and verify SSO is working fine. Go to https://localhost:9443/portal/.
You will be directed to the identity server's login page to login to portal as expected. Once you login with valid credentials, you will be directed to the portal.



Note: If you use IS as the Identity Provider, share the user and registry databases between IS and DS so that users will be shared across the two applications.

Hope you got it done without any issue. Please put a comment if you have any queries :)


Saturday, February 27, 2016

Clustering WSO2 Dashboard Server 2.0.0


In this post I will explain how to set up a WSO2 Dashboard Server 2.0.0 (referred as DS hereafter) cluster in a distributed manner with two DS instances fronted with a Nginx Plus Load Balancer. The following diagram depicts the overall distribution of the cluster components.



Both DS instances of the cluster will act as manager nodes and the load balancer will distribute the load between these two nodes in a round robin fashion. Following are the pre-requisites to start off with this tutorial and the versions I used for this setup.
  • Nginx Plus installed (1.7.11.- nginx-plus-r6-p1)
  • Oracle setup (Oracle 12c)
  • SVN server to use as the deployment synchronizer (v1.8)
  • Dashboard Server 2.0.0 downloaded in both nodes.

Configuring the Load Balancer


I assume you have installed Nginx Plus by now. Follow the below steps to configure Nginx

1. Navigate to the following location
   /etc/nginx/conf.d

2. Create a file named ds.conf (you can also use the default.conf file which is available there by default)

3. Add the following content and save the file
     
upstream httpdsportal {
       server 192.168.48.76:9763;
       server 192.168.48.77:9763;
}

upstream httpsdsportal {
       server 192.168.48.76:9443;
       server 192.168.48.77:9443;

           sticky learn create=$upstream_cookie_jsessionid
           lookup=$cookie_jsessionid
           zone=client_sessions_ds:1m;
}

server {
       listen 80;
       server_name ds.wso2.com;
       location / {
              proxy_set_header X-Forwarded-Host $host;
              proxy_set_header X-Forwarded-Server $host;
              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
              proxy_set_header Host $http_host;
              proxy_read_timeout 5m;
              proxy_send_timeout 5m;
              proxy_pass http://httpdsportal/;
              proxy_redirect http://httpdsportal/ http://ds.wso2.com/;

              proxy_http_version 1.1;
              proxy_set_header Upgrade $http_upgrade;
              proxy_set_header Connection "upgrade";
       }
}

server {
       listen 443;
       server_name ds.wso2.com;
       ssl on;
       ssl_certificate /etc/nginx/ssl/ds/ds.crt;
       ssl_certificate_key /etc/nginx/ssl/ds/ds.key;
       location / {
              proxy_set_header X-Forwarded-Host $host;
              proxy_set_header X-Forwarded-Server $host;
              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
              proxy_set_header Host $http_host;
              proxy_read_timeout 5m;
              proxy_send_timeout 5m;
              proxy_pass https://httpsdsportal/;
              proxy_redirect https://httpsdsportal/ https://ds.wso2.com/;
}

4. I have created a ssl certificate (ds.crt) and a key (ds.key) and pointed to the location as you can see in the configuration above. Follow the steps in the link below to create the SSL certificate.
https://docs.wso2.com/display/CLUSTER44x/Configuring+NGINX

5. Finally restart the Nginx server.
sudo service nginx restart

If you have done the configurations correctly, the server will restart successfully.

Configuring the DS instances


First of all copy the cert file you created above (ds.crt) from nginx to following path in both DS instances.
DS_HOME/repository/resources/security

Then you need to import the certificate to the keystore.

keytool -import -alias <alias> -file ds.crt -keystore client-truststore.jks -storepass wso2carbon

Now, you are done importing your trusted certificate to the client trust store where all WSO2 products refer for trusted certificates. Follow the below steps to configure other files within the DS product.

axis2.xml configurations

Open DS_HOME/repository/conf/axis2/axis2.xml file and follow the steps below.

1. Enable clustering.
<clustering class="org.wso2.carbon.core.clustering.hazelcast.HazelcastClusteringAgent"
               enable="true">

2. Set the membership scheme to wka to enable the well-known address registration method

<parameter name="membershipScheme">wka</parameter>

3. Specify the name of the cluster this node will join

<parameter name="domain">wso2.ds.domain</parameter>

4. Specify the hosts / IP addresses

Node 1:
<parameter name="localMemberHost">192.168.48.76</parameter>

Node 2:
<parameter name="localMemberHost">192.168.48.77</parameter>

5. Specify the port used to communicate cluster messages

Node 1:
<parameter name="localMemberPort">4100</parameter>

Node 2:
<parameter name="localMemberPort">4200</parameter>

6. Specify the well known members

Node 1:
<members>
           <member>
               <hostName>192.168.48.77</hostName>
               <port>4200</port>
           </member>
</members>

Node 2:
<members>
           <member>
               <hostName>192.168.48.76</hostName>
               <port>4100</port>
           </member>
</members>

carbon.xml Configurations

Open DS_HOME/repository/conf/carbon.xml file and follow the steps below.

1. Configure the HostName and MgtHostName

<HostName>ds.wso2.com</HostName>
<MgtHostName>ds.wso2.com</MgtHostName>

2. Enable SVN-based deployment synchronization in both nodes. (Both nodes have read/write permission)

<DeploymentSynchronizer>
       <Enabled>true</Enabled>
       <AutoCommit>true</AutoCommit>
       <AutoCheckout>true</AutoCheckout>
       <RepositoryType>svn</RepositoryType>
       <SvnUrl>URL</SvnUrl>
       <SvnUser>username</SvnUser>
       <SvnPassword>password</SvnPassword>
       <SvnUrlAppendTenantId>true</SvnUrlAppendTenantId>
</DeploymentSynchronizer>

3. Download http://product-dist.wso2.com/tools/svnkit-all-1.8.7.wso2v1.jar and install it by copying it into the<DS_HOME>/repository/components/dropins folder.

4. Download http://maven.wso2.org/nexus/content/groups/wso2-public/com/trilead/trilead-ssh2/1.0.0-build215/trilead-ssh2-1.0.0-build215.jar and copy it to the <DS_HOME>/repository/components/lib folder.


catalina-server.xml Configurations

Open DS_HOME/repository/conf/tomcat/catalina-server.xml file and follow the steps below.

1. Configure the proxy ports

<Connector protocol="org.apache.coyote.http11.Http11NioProtocol"
   port="9763"
   proxyPort="80"
   ...
   />

<Connector protocol="org.apache.coyote.http11.Http11NioProtocol"
   port="9443"
   proxyPort="443"
   ...
   />


Configuring the Databases and Registry Mounting 


Create two databases (this tutorial uses Oracle 12c) to store Registry and User information. Then, point the servers to the newly created databases as follows.

master-datasources.xml Configurations

Open DS_HOME/repository/conf/datasources/master-datasources.xml file and follow the steps below.

1. Add the data sources for Registry and User databases  

<datasource> <name>WSO2_DS_USER_DB</name> <jndiConfig> <name>jdbc/DS_USER_DB</name> </jndiConfig> <definition type="RDBMS"> <configuration> <driverClassName>oracle.jdbc.driver.OracleDriver</driverClassName> <url>url</url> <maxActive>100</maxActive> <maxWait>60000</maxWait> <minIdle>5</minIdle> <testOnBorrow>true</testOnBorrow> <validationQuery>SELECT 1 FROM DUAL</validationQuery> <validationInterval>30000</validationInterval> <username>username</username> <password>password</password> <defaultAutoCommit>false</defaultAutoCommit> </configuration> </definition> </datasource>
<datasource> <name>WSO2_DS_REGISTRY_DB</name> <jndiConfig> <name>jdbc/DS_REGISTRY_DB</name> </jndiConfig> <definition type="RDBMS"> <configuration> <driverClassName>oracle.jdbc.driver.OracleDriver</driverClassName> <url>url</url> <maxActive>100</maxActive> <maxWait>60000</maxWait> <minIdle>5</minIdle> <testOnBorrow>true</testOnBorrow> <validationQuery>SELECT 1 FROM DUAL</validationQuery> <validationInterval>30000</validationInterval> <username>username</username> <password>password</password> <defaultAutoCommit>false</defaultAutoCommit> </configuration> </definition> </datasource>

2. Copy the ojdbc7.jar driver for the oracle 12c database to <DS_HOME>/repository/components/lib directory.

registry.xml Configurations

Open DS_HOME/repository/conf/registry.xml file and follow the steps below.

1. Add/Update the following configurations

<dbConfig name="sharedregistry">
       <dataSource>jdbc/DS_REGISTRY_DB</dataSource>
</dbConfig>

<remoteInstance url="https://localhost:9443/registry">
       <id>instanceid</id>
       <dbConfig>sharedregistry</dbConfig>
       <readOnly>false</readOnly>
       <enableCache>true</enableCache>
       <registryRoot>/</registryRoot>
       <cacheId>unique cache id</cacheId>
 </remoteInstance>

 <mount path="/_system/config" overwrite="true">
       <instanceId>instanceid</instanceId>
       <targetPath>/_system/config</targetPath>
 </mount>

 <mount path="/_system/governance" overwrite="true">
       <instanceId>instanceid</instanceId>
       <targetPath>/_system/governance</targetPath>
 </mount>


user-mgt.xml Configurations

Open DS_HOME/repository/conf/user-mgt.xml file and follow the steps below.

1. Point the user store to the newly created database.

       <Configuration>
               <AddAdmin>true</AddAdmin>
               <AdminRole>admin</AdminRole>
               <AdminUser>
                    <UserName>admin</UserName>
                    <Password>admin</Password>
               </AdminUser>
           <EveryOneRoleName>everyone</EveryOneRoleName> <!-- By default users in this role sees the registry root -->
           <Property name="isCascadeDeleteEnabled">true</Property>
           <Property name="dataSource">jdbc/DS_USER_DB</Property>
       </Configuration>

designer.json configuration

Open DS_HOME/repository/deployment/server/jaggeryapps/portal/configs/designer.json file.

1. Configure the hostname of the cluster, https/https protocol and the port (optional in our setup)

 "host": {
   "hostname": "ds.wso2.com",
   "port": "443",
   "protocol": "https"
 }

Without this configuration the gadgets added to the dashboard will not render in the dashboard. Also, you can access the dashboard using the IP address instead of the host name without any issue with this configuration.

hosts configuration

Open /etc/hosts file and do the following.

1. Map the host name of the cluster to the IP address of the Nginx load balancer as follows. 
192.168.48.75  ds.wso2.com

This should be done in all the following nodes.
  • Nginx plus node
  • Both DS nodes
  • Any server that is browsing the DS portal or management console

Starting the server


Now you have successfully configured all the configurations in order to start the DS servers.
sh wso2server.sh -Dsetup

2. To start the pack normally.
sh wso2server.sh  or  sh wso2server.sh start


Once started you can access the portal and the management console of DS as follows
  • https://ds.wso2.com/portal
  • https://ds.wso2.com/carbon
That's it. Now you can create dashboards with lots of new features using the WSO2 Dashboard Server. Please drop a comment if you have any queries :)