Creating Proxy Service in WSO2 Dev Studio With UsernameToken Security? - wso2

Question

I am trying to enable UsernameToken security on a service within WSO2 Dev Studio. I can do this through the WSO2 web GUI easily. My desire to do this through the dev studio is to produce a .car file that can easily be deployed.
I see that the web gui creates a policy file and can include that in the exported .car file. The problem, I believe, is that when you use the web gui to enable usernametoken security, the second screen asks for a list of user groups to be selected. I don't see where that data ends up. It's not defined in the policy. It appears that it is stored internally by WSO2. If that is accurate, is there anyway to interact with that via the deployment of a .car file?
Ultimately, I just want to authenticate using the username and password and any user group is fine since I'm going to use an entitlement mediator after authentication to control access.
Edit: It looks like it ends up in the UM_ROLE_PERMISSION table in the WSO2CARBON database. I guess what I need is a way to put some piece of code in my .car file that will get executed upon deployment in order to write into that table. (Or a less terrible solution where I can just describe the authentication scheme in whole without having to manipulate the database.)

Answer 1

The list of user roles is stored in the user management db. By default, it will be stored in the default h2 database.
You can configure the roles allowed by setting a parameter named allowRoles in the proxy configuration. Set comma separated roles that will be authorized to access the given service.
Eg:
<parameter name="allowRoles">role1,role2</parameter>
Sample proxy config:
<?xml version="1.0" encoding="UTF-8"?>
<proxy xmlns="http://ws.apache.org/ns/synapse" name="test_ws_security" transports="http https" startOnLoad="true" trace="disable">
<target>
<inSequence>
<respond/>
</inSequence>
<outSequence/>
</target>
<parameter name="allowRoles">admin,myrole</parameter>
<policy key="conf:/custom/UsernameTokenPolicy_v1.xml"/>
<enableSec/>
</proxy>