2025-08-13

.gitignore

@@ -22,3 +22,5 @@ hs_err_pid*
 .DS_Store
 en/site
 
+*.iml
+

en/docs/administer/product-level-security-guidelines.md

@@ -36,6 +36,9 @@ Change the default key stores and create new keys for all the cryptographic oper
 
     For more information, see [Recommendations for using keystores](../../administer/using-asymmetric-encryption#recommendations-for-setting-up-keystores-in-wso2-products) and [Creating New Keystores](../../administer/creating-new-keystores).
 
+## Symmetric Encryption Key
+
+Generate a secure secret key by following the instructions given in [Using Symmetric Encryption](../../administer/using-symmetric-encryption/#internal-crypto-provider).
 
 ## Passwords in config files
 
@@ -251,7 +254,7 @@ Log forging can be prevented by appending a UUID to the log message.
 
 !!! info
 
-    For more information on configuring the `log4j.properties` file, see <a href="../../setup/monitoring-logs/">Monitoring Logs</a>.
+    For more information on configuring the `log4j2.properties` file, see <a href="../../setup/monitoring-logs/">Monitoring Logs</a>.
 
 
 ## JVM parameters
@@ -269,3 +272,49 @@ Log forging can be prevented by appending a UUID to the log message.
 If mutual SSL is enabled, [enable intermediate certificate validation](../../develop/authenticating-and-authorizing-rest-apis/#configure-intermediate-certificate-validation) as well to make sure that only certificates signed by the issuers mentioned in the **IntermediateCertValidation** configuration are allowed to be used during mutual SSL authentication.
 
 If mutual SSL authentication capabilities are not required, you can [disable it](../../administer/enabling-mutual-ssl/#enabling-mutual-ssl-in-the-wso2-is).
+
+## Configuring client authentication
+
+Client authentication is used to identify the application or the client that is making the request. 
+The web applications provided out-of-the-box use a set of default credentials to authenticate with WSO2 Identity Server REST APIs that are marked as **secure** under the 'ResourceAccessControl' tag of the the`<IS_HOME>/repository/conf/identity/identity.xml` file. 
+
+Follow the steps below to change the default credentials.
+
+1.  Shut the server down in case you have already started it. 
+
+2.  Add the following configuration changes to the `<IS_HOME>/repository/conf/deployment.toml` file.
+
+    -   Add the `app_password` property and enter a preferred password as the value.
+
+        ``` toml
+        [identity.auth_framework.endpoint] 
+        app_password="<value of preferred password>"
+        ```  
+
+    -   Add the `hash` property and enter the SHA-256 hash value of the `app_password` as the property value.
+
+        ``` toml
+        [account_recovery.endpoint.auth]
+        hash="<SHA-256 hash of the newly added app_password property value>"
+        ``` 
+
+    - If the `authenticationendpoint` web app is hosted externally, do the following:
+
+            a.  Open the `EndpointConfig.properties` file found in the root of the `authenticationendpoint` folder. 
+
+            b.   Change the `app.password` property value to the value added as `app_password` in the `deployment.toml` file. 
+
+            c.   Do the same changes to the `EndpointConfig.properties` file located in the `<IS_HOME>/repository/deployment/server/webapps/authenticationendpoint/WEB-INF/classes` directory.
+
+    - If the `accountrecoveryendpoint` web app is hosted externally, do the following:
+
+            a.   Open the `RecoveryEndpointConfig. properties` file found in the root of the `accountrecoveryendpoint` folder. 
+
+            b.   Change the `app.password` property value to the value added as `app_password` in the `deployment.toml` file. 
+
+            c.   Do the same changes to the `RecoveryEndpointConfig.properties` file located in the `<IS_HOME>/repository/deployment/server/webapps/accountrecoveryendpoint/WEB-INF/classes` directory.
+
+3.  Once these changes are configured, restart the server with,
+
+    - Linux/Unix : sh wso2server.sh
+    - Windows : wso2server.bat

en/docs/administer/using-tools.md

@@ -6,6 +6,5 @@ to validate the configurations and build sample response.  These tools
 in the [management console](../../setup/getting-started-with-the-management-console) are described in
 the following topics.
 
--   Using the SAML2 Toolkit
 -   Using the XACML TryIt Tool
 -   Identity Anonymization tool

en/docs/assets/attachments/learn/geo-location/linux/update-geolocation-data.sh

@@ -0,0 +1,58 @@
+echo " ======== Converting GeoLite2-City-Blocks-IPv4.csv ======="
+
+echo "Enter path to GeoLite2-City-Blocks-IPv4 directory: "
+read original_dir
+if [ -z $original_dir ]; then
+    echo "path to patched directory not provided, execution terminated!"
+    exit 0;
+elif [ ! -d "$original_dir" ]; then
+    echo "Cannot find the directory path $patch_dir, execution terminated! "
+    exit 0;
+elif [ -d "$original_dir" ];then
+    echo "Enter path to GeoLite2-City-Blocks-IPv4-converted.csv directory: "
+    read converted_dir
+    if [ -z $converted_dir ]; then
+        echo "path to patched directory not provided, execution terminated!"
+        exit 0;
+    elif [ ! -d "$converted_dir" ]; then
+        echo "Cannot find the directory path $converted_dir, execution terminated! "
+        exit 0;
+    elif [ -d "$original_dir" ];then
+
+        #Convert GeoLite2-City-Blocks-IPv4
+        echo " ** convert GeoLite2-City-Blocks-IPv4"
+        $converted_dir/geoip2-csv-converter -block-file=$original_dir/"GeoLite2-City-Blocks-IPv4.csv" -include-integer-range=true -output-file=$original_dir/"GeoLite2-City-Blocks-IPv4-converted.csv"
+
+        #Get first column form original GeoLite2-City-Blocks-IPv4
+        echo " ** get first column form original"
+        cut -d , -f 1 $original_dir/GeoLite2-City-Blocks-IPv4.csv > first.csv
+
+        #Change column name ‘network’ to ‘network_cidr’
+        echo " ** change column name to ‘network_cidr’"
+        sed -i '1s/network/network_cidr/' first.csv
+
+        #Extract first two numbers from first.csv
+        echo " ** Extract ip address data"
+        cut -d "." -f -2 first.csv > last.csv
+
+        #Change column name ‘network_cidr’ to ‘network_blocks’
+        echo " ** change column name to ‘network_blocks’"
+        sed -i '1s/network_cidr/network_blocks/' last.csv 
+
+        #Extract entries from GeoLite2-City-Blocks-IPv4-converted.csv
+        echo " ** extract entries from original"
+        cut -d , -f 1-10 $original_dir/GeoLite2-City-Blocks-IPv4-converted.csv > middle.csv
+
+        #Change column name ‘network_start_integer’ to ‘network’
+        echo " ** change column name to ‘network’"
+        sed -i '1s/network_start_integer/network/' middle.csv 
+
+        #Change column name ‘network_last_integer’ to ‘broadcast’
+        echo " ** change column name to ‘broadcast’"
+        sed -i '1s/network_last_integer/broadcast/' middle.csv 
+
+        #Merge csv files
+        echo " ** merge csv files"
+        paste -d , first.csv middle.csv last.csv > final.csv
+    fi
+fi

en/docs/assets/attachments/learn/geo-location/mac/update-geolocation-data.sh

@@ -0,0 +1,60 @@
+echo " ======== Converting GeoLite2-City-Blocks-IPv4.csv ======="
+
+echo "Enter path to GeoLite2-City-Blocks-IPv4 directory: "
+read original_dir
+if [ -z $original_dir ]; then
+    echo "path to patched directory not provided, execution terminated!"
+    exit 0;
+elif [ ! -d "$original_dir" ]; then
+    echo "Cannot find the directory path $patch_dir, execution terminated! "
+    exit 0;
+elif [ -d "$original_dir" ];then
+    echo "Enter path to geoip2-csv-converter home directory: "
+    read bin_dir
+    if [ -z $bin_dir ]; then
+        echo "path to patched directory not provided, execution terminated!"
+        exit 0;
+    elif [ ! -d "$bin_dir" ]; then
+        echo "Cannot find the directory path $bin_dir, execution terminated! "
+        exit 0;
+    elif [ -d "$bin_dir" ];then
+
+        #Convert GeoLite2-City-Blocks-IPv4
+        echo " ** convert GeoLite2-City-Blocks-IPv4"
+        $bin_dir/geoip2-csv-converter -block-file=$original_dir/"GeoLite2-City-Blocks-IPv4.csv" -include-integer-range=true -output-file=$original_dir/"GeoLite2-City-Blocks-IPv4-converted.csv"
+
+        #Get first column form original GeoLite2-City-Blocks-IPv4
+        echo " ** get first column form original"
+        cut -d , -f 1 $original_dir/GeoLite2-City-Blocks-IPv4.csv > first.csv
+
+        #Change column name ‘network’ to ‘network_cidr’
+        echo " ** change column name to ‘network_cidr’"
+        sed -i '' '1s/network/network_cidr/' first.csv
+
+        #Extract first two numbers from first.csv
+        echo " ** Extract ip address data"
+        cut -d "." -f -2 first.csv > last.csv
+
+        #Change column name ‘network_cidr’ to ‘network_blocks’
+        echo " ** change column name to ‘network_blocks’"
+        sed -i '' '1s/network_cidr/network_blocks/' last.csv 
+
+        #Extract entries from GeoLite2-City-Blocks-IPv4-converted.csv
+        echo " ** extract entries from original"
+        cut -d , -f 1-10 $original_dir/GeoLite2-City-Blocks-IPv4-converted.csv > middle.csv
+
+        #Change column name ‘network_start_integer’ to ‘network’
+        echo " ** change column name to ‘network’"
+        sed -i '' '1s/network_start_integer/network/' middle.csv 
+
+        #Change column name ‘network_last_integer’ to ‘broadcast’
+        echo " ** change column name to ‘broadcast’"
+        sed -i '' '1s/network_last_integer/broadcast/' middle.csv 
+
+        #Merge csv files
+        echo " ** merge csv files"
+        paste -d , first.csv middle.csv last.csv > final.csv
+
+    fi
+fi
+

en/docs/assets/js/theme.js

@@ -97,7 +97,7 @@ request.onload = function() {
        * Appending versions to the version selector dropdown 
        */
       if (dropdown){
-          data.list.sort().forEach(function(key, index){
+          data.list.forEach(function(key, index){
               var versionData = data.all[key];
 
               if(versionData) {