API Manager 3.0.0 in Carbon page, if a new user and assign this roles:
For this user is possible to login in Developer page and subscriber, for ALL APIs of API products exists.
But If exist 3 users: A, B, C and 3 APIs: X, Y, Z.
The user A could subscriber for ALL APIs
The user B could subscriber only for API Y
The user C could subscriber APIs X and Y
Is possible to do the scenario with the user A,B and C and APIs X,Y and Z?
How?
Thanks
Yes, you can set API visibility using roles.
More details: https://apim.docs.wso2.com/en/3.0.0/learn/design-api/advanced-topics/control-api-visibility-and-subscription-availability-in-developer-portal/
Related
User can sign in using any of the following from the Mobile App:
a. Facebook ID
b. Google Id
c. Apple Id (for IOS)
d. Mobile No
e. Email Id
Now, if the user tries to sign in using any of the Social Media Login, the information will be checked back in the database (DynamoDB) before allowing the user further accessing the other microservices.
if the user tries to login using mobile no or email, then the information will be checked back in the database (DynamoDB), and if exists, then it is followed by a OTP for verification.
How to design a robust authentication and authorization structure which may help with the following:
a. Security (must)
b. Performance (must)
c. Token may contain necessary information like userid, name etc, if possible
d. Invalidate, if possible
Possible Tech Stack : Mobile Apps -> API Gateway -> Lambda -> DynamoDB
We want to use WSO2 as IAM framwork for our Internal and external applications.
We have below 3 main requirements.
WSO2 should be able to Authenticate user using LDAP (Active
Directory for Internal Employees ) or other data source for external
users.
We want to configure API access level in WSO2 example : ROLE based Authorization (or Policy based ) where we can configure who can access which
web API with Http verb.
We should be able dynamically add/update/delete users , update Authorization policies/ roles through WSO2 API.
Please let me know if this is out of box supported in community edition or we have to buy any licenses for the same.
Note: I have installed the server and playing around as well.
Yes these requirements are possible with WSO2 IS (Product stack)
You can easily plug an existing LDAP user store to WSO2 IS. (https://docs.wso2.com/display/IS530/Configuring+a+Read-write+LDAP+User+Store)
I am not 100% clear about what you are asking here. But if you are talking about IS APIs (Which specified in point number 3) you can do them solely with IS by little customization or else you can use WSO2 ESB with entitlement mediator to add XACML policies.
There are SOAP admin services(Non standard but able to update authorization polices etc) and REST services. (Standard SCIM 2.0 for user operations)
https://docs.wso2.com/display/IS530/Calling+Admin+Services
https://docs.wso2.com/display/IS530/SCIM+1.1+APIs
We are using WSO2 API Manager 1.10 and WSO2 Identity server 5.1.0 for managing back end REST APIs which will be consumed by Android and iOS application.For a end user(Mobile App user) to access the APIs exposed,process followed is:-
1.User registers to WSO2 IS server using WSO2 SCIM create user API.
2.User request for access token which will be used for accessing the APIs.
We are planning to add Google and facebook sign in feature in our Mobile app which will help end user avoid user creation in WSO2 IS. Does WSO2 API Manager support this sort of implementation? if so,what are the cofiguration changes we need to do to our current setup?
You can achieve this using identity federation. IS will act as key manager as well as it can federate the authentication to facebook/google.
you can find how facebook can be configured to get access token in this blog[1]. Similarly you can add google for federation[2]
[1] http://nuwanzone.blogspot.com/2015/10/getting-access-tokens-for-wso2-api.html
[2] https://docs.wso2.com/display/IS510/Configuring+Google
I have a web app where front end layer has a angular based UI.It has both public pages and other private pages which are accessible to logged in users and it depends on roles of the logged in users as well
My server based application is a java based rest service api .
How can i use wso2 for handle user authenticaiton and role based authorsation.i would like to have an additional layer of api security depending on the role of the user as well.
can someone explain the best architecture for this in wso2?
if i use wso2 api manager , how can i handle login's of the user and how to relate api access with role of the logged in user?
thanks in advance
you can use wso2 appmanager to control the access of any web apps[1]. App manager supports role based access control as well as xacml policy based access control . In order to provide api level role based security you can use scopes[2] in wso2 api manager
[1] https://docs.wso2.com/display/APPM120/Web+Application+Resource+Authorization
[2] https://docs.wso2.com/display/APPM120/Web+Application+Resource+Authorization
Let me suggest another solution. I haven't tried this with APIM. But since APIM also has Identity features installed in it, this should work.
Use OpenID Connect for login. See here for a sample. This sample is for IS, but it should work for APIM too. Only endpoint URLs are different in APIM like this.
Token: https://localhost:8243/token
Revoke: https://localhost:8243/revoke
Authorize: https://localhost:8243/authorize
There, when a user login, you get an ID_token which contains user claims. You can allow/deny page views depending on those data.
In above step, you create an SP and generate a client key-secret pair. You can set the same keys in APIM's application. Read this.
Then, as I mentioned here, you can use scopes to secure your APIs by roles.
I'm interested in using only the Publisher and the Store. We have already many API gateways in place and also a dedicated OAuth Authorization Server.
The Publisher and the Store should be used basically as an API Portal where APIs are published and potential new consumers can self-register...
I understand that all necessary information is distributed within the WSO 2 API Manager ecosystem out-of-the-box. But could this behaviour be adjusted in the following way:
When publishing an API it must be created on an external, third-party API Gateway. This gateway has it's own management API which must be triggered by the Publisher.
When a new consumer registers to an API the external, third-party OAuth authorization server must be called in order to create the necessary OAuth information there so that the new consumer is known on the Authorization Server. Again, the Authorization Server has it's own management API which must be triggered by the Store.
Is it possible to add custom fields in the Store which allows a consumer to enter additional information?
Any feedback is highly appreciated!
To answer your question on thrid party gateways, WSO2 API Manager does not support this at the moment.
But we do support incorporating a third party Key manager. You can plug a third-party OAuth provider to manage OAuth clients and access tokens. This is supported from API manager 1.9.0 onwards.
You may need to implement a key manager extention to incorporate your OAuth Authorization Server. WSO2 API manager includes a key manager extention to 'Surf OAuth Authorization Server' by default.
You can find more details on configuring a thrid party Key manager at [1] and [2]
To answer your question on adding custom fields, yes, you can include custom fields by customizing the store with a sub theme [1] [2]
[1] https://docs.wso2.com/display/AM1100/Configuring+a+Third-Party+Key+Manager
[2] https://docs.wso2.com/display/AM1100/Extending+Key+Validation
[3] https://docs.wso2.com/display/AM1100/Adding+a+new+API+Store+Theme
[4] https://docs.wso2.com/display/AM1100/Adding+a+new+API+Store+Theme#AddinganewAPIStoreTheme-Writingasubthemeofthemaintheme