I am making a RemoteRegistry connection to a WSO2 server as user admin, but I am in need of being able to create registry resources as a different user (so the owner of the resource is not admin but another existing user). Is it possible to impersonate another user, or obtain a Registry instance for another user?
This is possible for code that runs inside the WSO2 (for example, code deployed in the built-in Tomcat instance that WSO2 itself runs on), but this particular requirement is for code that accesses the WSO2 server remotely via external APIs, rather than directly from within.
The WSO2 server in question is a WSO2 Identity Server v5.x that also includes functionality from WSO2 Governance Registry.
Related
I used wso2 identity server with multi JDBCUserStore.
Is it possible to define a user who will only be able to manage the users of a single user JDBCUserStore.
I am currently doing a PoC on WSO2 API manager (v2.6.0). I am already having a Web application (Ex: Pizza booking) and also registered customers (end users) who is using the application for pizza booking. Now I wanted to bring the backend services of the pizza booking app such as,
Choose store location,
Book pizza,
Track order, etc.
as APIs into the WSO2 API Manager. For this, I would create the required apis in API manager. Then I wanted to bring my existing web application users (end users) into the API manager and provide access to those apis.
What would be the best way to implement this?
Bring my users under WSO2 identity server and use identity server as a key manager to my API manager?
Bring my users under secondary user store/ use custom user store of API manager?
Out in that case, how would I provide access to particular API's (subscribing to API's) without logging to API manager store and subscribing manually for every user?
Also,
What is the use of creating a Service provider and creating an Oauth application under Inbound authentication?
What can I do with this application?
Is this same as the application we create before subscribing to an API in API manager store?
Can I add users to this application and grant access to them in common?
Can I subscribe to API's using this application so that all users under this application will have access to it?
You can do it either way. Using IS as Key manager (if you already using IS), or adding as a secondary user store.
So, if you are already using WSO2 Identity Server in your deployment, configuring it as key manager (by sharing user stores), will automatically enable all the users in IS (with proper permission) to access the apis.
If you do not use the IS currently, the best option is to add as a secondary user store to the existing APIM deployment.
Please find the answers to the other questions below.
What is the use of creating a Service provider and creating an Oauth application under Inbound authentication?
What can I do with this application?
Is this same as the application we create before subscribing to an API in API manager store?
Can I add users to this application and grant access to them in common?
Can I subscribe to API's using this application so that all users under this application will have access to it?
Answer
The Service Provider is created automatically when an Oauth application is created and generate keys. But, there are different aspects of these two entities.
The Service provider is generally used for generating application keys to get an access token to invoke the apis.
OAuth Application (when you create through API store) has several other uses such as subscribing to APIs, enforcing throttling policies for subscriptions etc.
In order to use the token generated by an Application, the respective API should be subscribed by the application. Otherwise, you will not be able to invoke that API although you have a valid access token.
You can subscribe to an API only from the OAuth application created through the API Store.
Your users can use the same OAuth application (which is created via Store portal and subscribed to an API) to generate an access token for them. That is by providing them with the application keys and using password grant type, they can generate token for them
Refer this documentation for more info on the token API and grant types. https://docs.wso2.com/display/AM260/Token+API
Adding to what #Menaka has explained.
Your end-users don't have to subscribe to APIs. Only the application developer has to subscribe and embed the consumer key/secret to their app. Then the application should generate tokens for the end-users using those keypair+end user credentials.
I am pretty new to the WSO2 IS and my object is to understand how ( whether its possible ) to enable simultaneous login of 2 different service provider applications.
For instance : token from one service provider is to be accessed and used to login to the other app.
Any help on this topic is appreciated.
how ( whether its possible ) to enable simultaneous login of 2 different service provider applications.
From this question, I understand that you want to try Single Sign on with Identity server. WSO2 Identity Server enables users to access multiple applications using the same set of credentials. For an example, if users log into application A, they would automatically have access to application B as well for the duration of that session without having to re-enter their credentials. WSO2IS provides the capability for SSO using different protocols such as OpenIDConnect, SAML, etc.
If this is your requirement, you can refer to this doc to know about Single sign-on. If you use OAuth apps you can get access tokens. Refer to this doc to know about SSO with OpenID Connect.
I am trying to develop a data integration service which will be used in multi-tenant mode. We are exploring different solutions available, and WSO2 is one of them. I am using WSO2 EI 6.1.1 (Carbon).
I have created two tenants from superuser's management console, and deployed the *.car file from each tenant's login.
My understanding of multi-tenancy was that single deployement is done, and multiple tenants/users of the system access the same deployed service without interferring each other or getting blocked.
But here, I have to deploy the same carbon application for each tenant (twice in my case) from management console. How is it multi-tenant then?
I think you have didn't clearly understand the what is an tenant. Consider tenant as a separate organization. For e.g if you take Alphabet, you have Google, Youtube, Maps, etc... Those are your tenants. So each tenant can have their own set of apps.
If you want all the tenant users to access a particular app I think you can mark that as a SaaS app. That way any user from any tenant can access that particular app.
Hope that gives you a clear idea.
You can refer to https://docs.wso2.com/display/AM200/Multi-tenant+Architecture for more details about tenancy concept in WSO2
We want to connect WSO2 API Manager to WSO2 Identity server for application key management, so in other words we don't want to use the embedded key management that comes with API Manager, how can we achieve that?
IS is used as Oauth provider, but if we think about key management part, we have no of operations managed by APIM, to restrict /allow token accesses..
So, if you want to use IS as keymanagement server, you need to install APIM key-management related features in IS and in the api-mgt.xml,you have to provide IS server URL/credentials under APIKeymanagment section.