1. Download WSO2 Identity Server latest version from here.
2. The default user store of WSO2 Identity Server is running on an embedded ApacheDS server. In case you need to point it to an external LDAP server you can do it through a change in the configuration. This blog post explains how to integrate Oracle Directory Server as the User Store of WSO2 Identity Server.
3. Start the WSO2 Identity Server from [IS_HOME]\bin
4. Let's now define our authorization policy in plain English.
"A given resource can be accessed only by any user having an email address from wso2 belonging to a particular role and all the requests to any other resource other than this should fail"
5. Save the following policy in to a local file and import the file to WSO2 Identity Server XACML engine. Main --> Entitlement --> Administration --> Import New Entitlement Policy --> File System and import the policy. Then from policy list view click on the Enable button against the uploaded policy to enable the policy.
6. Looking at the policy, you might have noticed that, I have used the claim http://wso2.org/claims/emailaddress. And, this should map to the attribute id, corresponding to the email, in the underlying user store. If it is LDAP then, http://wso2.org/claims/emailaddress should map to the 'mail' attribute id. This is done through the Claim Management UI,read @wso2.com$ admin http://localhost:8080/services/echo/
7. Configure --> Claim Management --> http://wso2.org/claims
8. Now you can see all the claims used under wso2.org dialect
9. Click on Edit link against any of the claims you want to update and then set the "Mapped Attribute" value to the, attribute id name from the underlying user store.
10. You can try the policy we defined, from the Entitlement TryIt tool. Main --> Entitlement --> TryIt.
