I am trying to use wso2 identification server as authorization center:
there are several system, they share same user information
I want them to utilize identification server to perform authentication and authorization
In current research, I have found the API which I can use to perform authentication, and also soap api to perform user/group/permission management soap api
But I could not find the api which I can use to perform authorization request? So far those code are written in AuthrozationMgrJDBCImpl, there is no soap API expose those API.
Is there anybody know such API?
Yes.. WSO2 Identity Server can be used as centralized authorization management. There are two approaches
Use XACML capabilities of the WSO2IS. This is the standard way. WSO2IS can act as XACML PDP. You can create policies for different appolications. PDP is exposed as web service API, Application can call this web service API to receive authorization decision based on the policies. You can see the WSDL by pointing to https://localhost:9443/services/EntitlementService?wsdl. You can find more details on XACML and WSO2IS from here.
Use "AuthorizationAdminService" services. This is a custom way that you have referred. WSO2IS stores permission data in its own database and manage it through JDBCAuthorizationManager. However it only supports for RBAC. (in XACML you can use ABAC). you can see the WSDL by pointing to https://localhost:9443/services/AuthorizationAdminService?wsdl.
Note : You can see the WSDL of this service. But it is not exposed by default. Please go through this OS question. Also "AuthorizationAdminService" service available only after WSO2IS 450 version.
Related
I have an API that is exposed through WSO2 API Manager, it is secured by OAuth2 so client must pass an apikey, token or credentials in order to get access to resources. So far so good. But now, I'd like to protect backend's endpoint as well. Backend only accepts calls from API Manager (IP security) but it is open, I mean, if someone with access to APIM's host does the call, it will accept since there is no authentication between them.
I would like to use Identity Server to protect backend but according to APIM documentation, supported endpoint security are BASIC or DIGEST.
What is the best approach to implement BASIC/Digest auth in SpringBoot backend and use WSO2 Identity Server as user registry? This way I can centralize every security details to a single solution.
Thanks in advance.
If you use basic auth or any such, your back end might have to do another API call to WSO2 to validate that token. Instead, you can pass a self contained JWT token from the API manager to the backend. So that the back end can validate that the JWT is issued by the API manager it self using using the certificate without relying on anything else.
From this way you can verify if the call was made y API Manager, additionally the end user as well from the JWT content.
Doc : https://apim.docs.wso2.com/en/latest/learn/api-gateway/passing-end-user-attributes-to-the-backend/passing-enduser-attributes-to-the-backend-using-jwt/?fbclid=IwAR1JT9DLOclmA-xw0Ev9C2Xrje5EDGrDBnmMkfDKMcbxTlCLf0swSPucMfA
Can someone please clarify when to use API Manager and when to use Identity Server. I see that API Manager comes with Key Manager. Isn't that sufficient. I am really confused. Any help would be helpful.
Many thanks....
I hope this explaination will help you out,
WSO2 Identity Server
WSO2 Identity Server is a fully fledged Identity Management Solution which supports Authentication, Authorization, Single Sign-On and Identity Federation to name a few capabilities. WSO2 Identity Server supports almost all major identity protocols such as SAML, OAuth2, OpenID Connect etc.Take a look at this page to get an idea about the capabilities of WSO2 Identity Server.
WSO2 API Manager
WSO2 API Manager, on the other hand, focuses on managing your APIs. Managing life cycle of your APIs, Authorization, Throttling, applying policies on API consumers are some of the functionalities handled by API manager. API manager has several components such as publisher, store, gateway, key manager, traffic manager that clearly separates different aspects of API Management.
So the Key manager component is responsible for managing OAuth applications, generate, validate and revoke OAuth2 Tokens. API has an inbuilt key manager component to handle these functionalities.
API Manager also offers the flexibility to use an external key manager instead of its inbuilt one should you require to do so. This external key manager needs to confirm to an interface specified by API manager. By default, API has an implementation of this interface that allows WSO2 Identity Server to used an external key manager.
So whether or not you want to use Identity Server or any other external key manager is totally dependent on your use case and the API traffic.
You can use WSO2 Identity Server for all the authentication/authorization stuff:
XACML Architecture solution.
SSO with anothers webapps or WSO2 tools.
Implement a Oauth2 autorization mechanish
Federate authentication
etc....
You can uso WSO2 API Manager for expose unsecure resultful apis or webservices as secure apis using Oauth with monitoring and billings functionallities
The key manager functionallity properly decouples the operations for creating OAuth applications and validating access tokens so that you can even plug in a third party-authorization server for key validations.
In a DEV enviroment you can work with WSO2 API Manager without the WSO2 Identity Server at all.
In a production enviroment it's recommended to use a separate WSO2 API Manager as a Key Manager or use the WSO2 Identity Server as the Key Manager
I am new in security. I have downloaded wso2 sso sample and executed it. Now I want to configure xacml into this project.
My requirement is when user logged in with sso I want to restrict them to access some particular jsp pages. Please give me some suggestion how to implement it and how I can send xacml request.
thank you
[1] is a comprehensive blog written by Asela Pathberiya on XACML and how you can leverage XACML on the wso2 identity server. Please read the blog to clarify different use cases you might have and how you can achieve them using wso2 identity server.
Basically, WSO2 uses Balana - XACML implementation on top of Sun XACML which supports XACML 3.0 specification.
You can use WSO2 Identity Server as a XACML policy decision point (PDP) quite easily. You can leverage the SOAP client or the thrift client to send XACML request to WSO2 Identity Server Entitlement Service and receive the decisions. There are samples that suit you exact use case at [2]
So basically you can do the following to achieve what you want to do,
Configure XACML policies in WSO2 Identity Service using policy editor
Call the Entitlement Service via SOAP or thrift from you app to get the entitlement decisions [3].
[1] http://xacmlinfo.org/category/xacml/
[2] https://github.com/wso2/balana/tree/master/modules/balana-samples
[3] https://github.com/wso2/carbon-identity-framework/tree/master/components/entitlement/org.wso2.carbon.identity.entitlement/src/main/java/org/wso2/carbon/identity/entitlement
Evaluating Wso2 API Manager. I have dozens of various APIs that have been developed by several groups over the past few years, all authenticate with IIS windows authentication.
How can I configure Wso2 API Manager to call a backend OData API that is expecting Windows Authentication in the request?
I don't actually need to pass-through authentication from the calling user, I'd be okay specifying a dedicated service account that API Manager always used to call the backend services.
API Manager supports NTLM authentication. You can follow the sample in APIM_HOME/samples/NTLMGrantClient. This documentation explains this. Also please follow this blog.
The Endpoint Auth Type "Windows Authentification" is not supported by API Manager. You might want to consider activating "Basic" or "Digest" authentification on your service in IIS (both of them are supported by API Manager).
see: https://docs.wso2.com/display/AM1100/Basic+Auth
In the link
http://blog.facilelogin.com/2008/10/wsas-hiddedn-services.html I saw WSo2 Soap apis , can I get it's equivalent rest apis. And an example which shows how to pass authentication details. I need this one for wso2 Identity server.
In Identity server, You can find many management web services API that can be used for authentication, authorization, user management and so on. Could you let us know the API that you are looking for.. then we can say what is exact web service that you could use. As an example for XACML based authorization, there are "EntitlementService" web service where you can find more details here. But still rest API is not available for this service.
Normally it is mentioned these web service API as admin services in WSO2 products.
Currently (With IS 450), It has a rest API for user management based on SCIM where you find them here. However, you can expose all SOAP based API as Rest API using WSO2 APIM product.