Describe the issue:
As part of WSO2 identity server 6.0.0, SOAP APIs are Deprecated and Recommended to use REST-based APIs. We are using RemoteUserStoreManagerService.wsdl and UserIdentityManagementAdminService.wsdl SOAP APIs in our project, want to replace the SOAP APIs with recommended REST APIs. Can you help us to find the list of REST APIs to replace RemoteUserStoreManagerService.wsdl and UserIdentityManagementAdminService.wsdl SOAP APIs. The APIs document is not clear.
Am referring the below document from wso2
https://is.docs.wso2.com/en/latest/references/about-this-release/#removed-features
https://is.docs.wso2.com/en/latest/apis/overview/
Expected behavior:
Can you help us to find the list of REST APIs to replace RemoteUserStoreManagerService.wsdl and UserIdentityManagementAdminService.wsdl SOAP APIs.
Both RemoteUserStoreManagerService.wsdl and UserIdentityManagementAdminService.wsdl has user management operations.
So you should be able to find all REST APIs matching to your SOAP APIs under the user Management section of https://is.docs.wso2.com/en/latest/apis/overview/
RemoteUserStoreManagerService.wsdl service:
For user-related CRUD operations (creation, read, update and delete), you can use SCIM2.0 /Users API
https://is.docs.wso2.com/en/latest/apis/scim2-rest-apis/
For role-related CRUD operations, you can user SCIM 2.0 /Roles API https://is.docs.wso2.com/en/latest/apis/scim2-rest-apis/
UserIdentityManagementAdminService.wsdl service:
For user's identity claim management, you can use SCIM 2.0 /Users API. You have to change the payload with the relevant scim attributes mapped to the identity claims
For the user's challenge question answers management, this API can be used
https://is.docs.wso2.com/en/latest/apis/challenge-rest-api/
Related
As part of WSO2 identity server 6.0.0, SOAP APIs are deprecated and recommended to use REST-based APIs. We are using RemoteUserStoreManagerService.wsdl and UserIdentityManagementAdminService.wsdl SOAP APIs in our project, want to replace the SOAP APIs with recommended REST APIs. Can you help us to find the list of REST APIs to replace RemoteUserStoreManagerService.wsdl and UserIdentityManagementAdminService.wsdl SOAP APIs. The APIs document is not clear.
We are unable to find the replacement for the claim management APIs which are specific to user.The APIs which are provided for the Claim management are not user specific, we want to retrieve/create/delete the claims by passing username or userid in the request payload.
Can you please provide the details that are such APIs available for the claim management.
The REST API that you have mentioned matches the ClaimMetadataManagementService.wsdl https://is.docs.wso2.com/en/5.11.0/develop/managing-claims-with-apis/
The only available REST API to manage user claims (retrieving, updating, deleting) is SCIM 2.0 Users APIs https://is.docs.wso2.com/en/latest/apis/scim2-rest-apis/#/Users%20Endpoint/getUser
The thing you have to keep in mind is that SCIM is a protocol that is used for user management. Even though you directly used the local claim URIs in SOAP services to manage user claims, in SCIM API calls you to have to use the respective SCIM claim that is mapped to the local claim.
Check the SCIM Claim Dialects by navigating to management console -> Main -> Identity -> Claims -> List.
There you can find the SCIM claim to local claim mapping
eg:
Get Specific user's name, username claims. Required attributes should be added to attributes param based on the SCIM protocol:
GET https://localhost:9443/scim2/Users/<user-id>?attributes=username,name
Add user claims:
Refer https://is.docs.wso2.com/en/latest/apis/scim2-patch-operations/#add-user-attributes
and https://medium.com/p/1c43bb218658
Delete user claims:
Refer https://is.docs.wso2.com/en/latest/apis/scim2-patch-operations/#remove-user-attributes
and https://medium.com/p/1c43bb218658
A similar issue was raised here. Check the first answer.
The doc that you have referred is to manage the claims in general. Refer to the introduction paragraph.
The API overview page contains all the information about all the APIs you need. The following image shows the APIs needed to mange users, roles and groups (More than what you have asked in the question).
NOTE: Better not to use SCIM1.1
I have a secured API with OAuth and I have no other authorization mechanism (Basic Auth/ Digest Auth).
Based on article https://apim.docs.wso2.com/en/latest/learn/design-api/endpoints/endpoint-types/:
"You cannot call backend services secured with OAuth through APIs created in the API Publisher. At the moment, you can call only services secured with username/password (Basic Auth/ Digest Auth)."
Are there any plans to implement this feature in WSO2?
Although this feature is not available OOB, you can get this done via a mediation extension. Please check this article [1] where it explains on how to invoke a backend that is secured by OAuth2.
Currently, this feature is under development and will be adding to the product in the next release.
[1] - https://medium.com/#menakajayawardena/wso2-how-to-using-oauth2-protected-back-ends-with-api-manager-5d7e234c61c
We want to use WSO2 as IAM framwork for our Internal and external applications.
We have below 3 main requirements.
WSO2 should be able to Authenticate user using LDAP (Active
Directory for Internal Employees ) or other data source for external
users.
We want to configure API access level in WSO2 example : ROLE based Authorization (or Policy based ) where we can configure who can access which
web API with Http verb.
We should be able dynamically add/update/delete users , update Authorization policies/ roles through WSO2 API.
Please let me know if this is out of box supported in community edition or we have to buy any licenses for the same.
Note: I have installed the server and playing around as well.
Yes these requirements are possible with WSO2 IS (Product stack)
You can easily plug an existing LDAP user store to WSO2 IS. (https://docs.wso2.com/display/IS530/Configuring+a+Read-write+LDAP+User+Store)
I am not 100% clear about what you are asking here. But if you are talking about IS APIs (Which specified in point number 3) you can do them solely with IS by little customization or else you can use WSO2 ESB with entitlement mediator to add XACML policies.
There are SOAP admin services(Non standard but able to update authorization polices etc) and REST services. (Standard SCIM 2.0 for user operations)
https://docs.wso2.com/display/IS530/Calling+Admin+Services
https://docs.wso2.com/display/IS530/SCIM+1.1+APIs
I am new to this wso2 evaluating wso2,
I am using Identity Server I have web application , want to apply web SSO feature using WSo2, I had check there are soap web service present in wso2 for UserAdmin,
https://server-info:9443/services/UserAdmin.UserAdminHttpsSoap12Endpoint/ using soap client for test , for dev have to write java client for request
but did not find any web services related WEB SSO for example I require authentication web service which will accept Username/password return some token information and using that token I can store in session for single sign out
Is there any web service/ API in wso2 provide authentication? or what is best approach for implement SSO using wso2 for web applications.
Thanks
If you are looking for SSO with WSO2IS, WSO2IS supports several standard ways to achieve it. They are,
SAML2 SSO
OpenId Connect
OpenId
Passive STS (for windows based applications)
From above, most popular way is to use SAML2 SSO or Openid connect. Your web application also must support to talk with WSO2IS using above standards. Say, if you need to achieve SSO using SAML2 SSO. You application needs to send the SAML2 Request and process the SAML2 Response in standard way as mentioned in SAML2 SSO spec. You can find a sample web application that has been implemented to work with WSO2IS from here. This blog contains all configuration details that you need to do in WSO2IS side as well. You can even use the sample web application with other SAML2 IDP as sample web application is talking in standard way. Also. if you are looking for Openid connect, you can find another sample web application from here with config details. I hope this would be a good starting points for you.
WSO2 APIM by default supports OAuth2 for securing APIs. If I want to secure my APIs with other standard mechanisms such as BASIC or custom authorization mechanism(eg: based on xml body elements values of request), what is the approach I should follow?
In documentation it tells about writing a custom handler link . I guess this handler is invoked at transport level which will apply for all the API requests over that transport ??.
Does APIM supports adding other security(eg:Basic) mechanisms for each API when an API is added by publisher? and if so does that happen inside the ESB proxy service sequence or before it hits the proxy service?
The API Manager UI supports only OAuth based security, you can modify the synapse configuration of the API to support Basic auth to validate based on HTTP header. Customer authentication can be supported through handler. A reference to the handler has to be included in each API that you want to secure using the custom logic. This can be done by modifying the synapse config of the API.
You need write custom authentication handler and set as an handler configuration for that specific API