I use WSO2 API Manager 2.5.0 and authorization code grant for getting access token. But now I need to authenticate my mobile client. I can't keep client secret at mobile client. And I found that authorization code grant support Proof Key for Code Exchange (PKCE) without necessity to send client secret on the second step of the flow (https://www.oauth.com/oauth2-servers/pkce/). But I not found any setting in WSO2 API Manager Store connected with PKCE.
Is authorization code grant using PKCE supported in WSO2 API Manager?
Related
I wanted to do some POC for wso2 API manager where API Manager will expose login and registration url which will be called by UI layer but wanted to handle end user authorization and authentication
in API manager layer and don't want to handle this in database how can I do this i don't to use Identity server also.
I have gone through password grant_type tutorial and we can use this but how the authorization is going to performed?
Do we need to maintain user details in separate database or in identity server? if yes how this is going to happen.
I have gone through below questions but didn't get exact solution, please help me on this.
authorize user in wso2 api manager
wso2 api manager end-user
Thanks
how can I do this i don't to use Identity server also
By default you should be using the provided OAuth2 endpoints to authorize the users. However - the API Manager itselfs doesn't support self-registration and account verification.
I'd suggest to configure a WSO2 Identity Server as an APIM Key manager.
The WSO2IS has capability for self-registration and account verification.
The application or users will authenticate against the WSO2IS and the returned token will be valid for APIM (as the KeyManager shares the database with tokens).
I have created and published API with WSO2 API Manager. API client get access through OAuth2 and client credentials grant, sending consumer key and consumer secret to request access token. But now I need to implement authorization by means of authorization code grant. I have to use client_id and client_secret of WSO2 APIM and user login form of my backend application, not WSO2 APIM user.
Can anybody tell if it is possible and how it can be implemented???
Documentation of WSO2 does not describe this flow and all examples I have found describe authorization process (OAuth2, authorization_code) only for user of WSO2 APIM.
now I need to implement authorization by means of authorization code grant.
I have to use client_id and client_secret of WSO2 APIM and user login form of my backend application, not WSO2 APIM user.
If you want to use your own (application) authentication form, the simplest option is to leverage the password grant type where your application sends the token request along application and user credentials through a backend service
Using a code grant you suppose to use an authorization endpoint https://gateway:8243/authorize with parameters described in the documentation and indeed the default login form is used when the user is not yet authenticated
(I still have an urge to downvote the question for not searching the documentation)
If you still want to use the code grant type with your own authentication form, you may either customize the default logon form of the wso2 api gateway or customize an authenticator to use form of your application (this is quite advanced topic requiring configuring your own implementation and out of scope of the question/answer)
You have 2 options here without any customizations.
1) If your backend has a userstore, it can be configured as a secondary userstore for APIM. Then you can use any user in that userstore for authentication.
See https://docs.wso2.com/display/ADMIN44x/Configuring+Secondary+User+Stores
2) If above option is not possible, and if your backend IDP supports any federation SSO protocols such as SAML2 or OIDC, you can configure federation using WSO2 IS.
See https://docs.wso2.com/display/IS550/Single+Sign-On+and+Identity+Federation
I have an API that I need to call from my react-native fetch method after v4 signing. The API uses lambda proxy as functions.
My API is set to IAM authentication.
The client side app has username/passwd, fb login and exchanges tokens with identity pool to assume a role that has permission to execute-api, etc.
However, when I test API access using POSTMAN and credentials obtained by a loggedin user with valid tokens after exchanging with the federated identity provider, the result is "the token is invalid".
Please inform what am I missing here.
PS The javascript SDK generated for the API does not work in react-native's environment and needs changes.
Thanks.
I am using WSO2 API manager 2.0.0 and WSO2 identity server 5.1.0 to manage my Toolkit REST APIs. Both the servers share an user store and have settings to maintain authentication session. SSO is not configured yet.
Reference:
https://docs.wso2.com/display/IS510/Enabling+Authentication+Session+Persistence
The first step is to authenticate into Toolkit (works) and the next step is to assign location (fails with 401 error). How to maintain a session between the 2 calls?
In WSO2 API Manager, the default authentication mechanism is OAuth2. So you need to send an OAuth2 access token with your REST API calls for authentication.
If you enabled SSO, you get an SAML assertion when you login. Then you can use that assertion to retrieve an access token using the SAML Bearer Grant Type. Documentation can be found here.
I am very new to wso2 API manager. Sometimes an application might need to call a service in another application on behalf of a user. How can we make this in wso2 API manager by configuring Signed JWT Authenticator as like Google OAuth 2.0 Authorization Server?
If user is authenticated by saml2 in the application, then application can get the oauth token using saml token and invoke the apis on behalf of user.
check following links for more detail
1.http://shafreenanfar.blogspot.in/2014/02/exchanging-sml2-token-to-oauth2-token.html
2.http://pushpalankajaya.blogspot.in/2014/01/invoking-apis-using-web-app-with-oauth2.html