Enable Tenant Dropdown in Single Sign On (SSO) loginpages - WSO2 Identity Server (5.1.0)

When you have multiple tenants in the same Identity Server instance, it is hard to remember which domain you should use with username, to login. When you use Single Sign On to login you will be redirected to the SSO login page. Since SP1 of WSO2 Identity Server 5.0.0 new feature was introduced to help users to select the tenant domain easily from a dropdown in the SSO login page. This feature is not default. In this post you will be able to enable this feature in IS - 5.1.0. Method is almost same in IS - 5.0.0 SP1. For demonstration we will use the IS dasboard at https://localhost:9443/dasboard. Go to this link, you will be redirected to SSO login page.

Here you can enter the username as username+@+tenantdoamin, and login.

We are going to load the tenants into a dropdown and give the ability of select the domain from the dropdown. After this you will not need to enter the tenantdomain. Just the username will be enough.

Procedure :

1. Open the file at path {IS_Product_Home}/repository/conf/identity/EndpointConfig.properties. Set tenantListEnabled=true.


2. Open the file at path {IS_Product_Home}/repository/conf/identity/application-authentication.xml.  Add following before </ApplicationAuthentication> element. 


<TenantDomainDropDownEnabled>true</TenantDomainDropDownEnabled>
   <TenantDataListenerURLs>
        <TenantDataListenerURL>/authenticationendpoint/tenantlistrefresher.do</TenantDataListenerURL>
   </TenantDataListenerURLs>



3. Open the file at path {IS_Product_Home}/repository/conf/tomcat/catalina-server.xml. Set clientAuth = "want", in the Connector for port : 9443 (what ever the port used by identity server management console)

If you are using IS 5.0.0 you will have to add following to the file at {IS_Product_Home}/repository/conf/security/authenticators.xml.

<Authenticator name="MutualSSLAuthenticator" disabled="false">

  <Priority>5</Priority>

  <Config>

      <Parameter name="UsernameHeader">UserName</Parameter>

      <Parameter name="WhiteListEnabled">false</Parameter>

      <Parameter name="WhiteList"/>

  </Config>

</Authenticator>

This should be set default in IS 5.1.0. However better to check this also. 

After setting all these start the IS server and go to the dashboard at https://localhost:9443/dasboard.

You will redirected to SSO loginpage with tenant dropdown. 

Select the tenant domain from the dropdown. Now you can login just by typing the username (don't have to append domain name) and password.