WSO2 API Manager with third party key manager returns a token which expires immediately

Question

I am using WSO2 APIM 2.1.0. I followed this guide, I managed to make everything work but at the last step to generate an access token in order to call my API, I'm facing an issue. I make the call to get my token :

curl -k -d "grant_type=client_credentials&scope=test" -H "Authorization: Basic <base64id+secret>, Content-Type: application/x-www-form-urlencoded" http://localhost:8080/v1/token

I actually get my token

{"scope":"test","access_token":"67d45764-a4d3-4467-a0cc-67df34e53b28","token_type":"bearer","expires_in":3600}

But then I try to use it to call my api I get the following error :

Access failure for API: /api/1, version: 1 status: (900901) - Invalid Credentials. Make sure you have given the correct access token

When I directly check the WSO2 APIM Store interface I don't see an access token. Plus if I try to generate it from the interface it works, I get an access token which doesn't work as well and if I reload my page it disappears. I'm obviously doing something wrong but I can't figure out what. Is there some configuration that's not specified in the guide mentioned above ?

I have modified the endpoint in TokenAPI.xml with http://127.0.0.1:8080/v1/token, but I don't know what the revoke endpoint is.

Answer 1

The WSO2 APIM Store is only for testing purposes. The tokens generated via the curl are totally separate from the Store interface.

In your case, please check the api scopes are set correctly. (As you genereate a token with scope 'test', the api should also have the test scope)

Answer 2

I had an Identity Server running as well and didn't think to check the configuration. I had to uncomment the APIKeyManager section of the api-manager.xml in the Identity Server. I don't understand why having only one configuration setup gives you a token but not the correct one, it should not give you a token or throw an error saying that configuration is missing in the IS or something.