RBAC(Role back access control) in wso2 API manager and Identity server

0
votes

I am evaluating WS02 Api manager and Identity server. My requirement is as follows: 1) We have to develop a web portal where all the APIs will be exposed in wso2 api manager in which multiple end user types will login to portal say A, B ,C, d and all needs to have different API access 2) All the backend API related to portal/application will be exposed via wso2 API manager/gateway. 3) End User Authentication , Authorization and RBAC has to be performed by WSO2 layer means admin should be authorized to see only admin related stuff normal user will have restricted access. 4) I know I can create an app in wso2 API store get the token and call all the backend apis in secured way and get access to application but how login user based authentication and authorization is going to happen.

Solution which I read from docs is. 1) I can use wso2 Identity server as key manager so that and keep user data in custom db say mssql.

https://docs.wso2.com/display/CLUSTER44x/Configuring+the+Identity+Server+5.2.0+as+a+Key+Manager+with+API+Manager+2.0.0

But not sure how how user can be restricted to use only certain contents in portal. Please help me on this.

http://movingaheadblog.blogspot.com/2014/02/securing-your-web-service-with-oauth2.html

@gusto can you help me on this. Thanks

1
wso2wso2iswso2-am

1 Answers

0
votes

You can use https://docs.wso2.com/display/AM260/Enabling+Role-Based+Access+Control+Using+XACML to use XACML based policies for access control for your applications.

When a particular API is invoked in the APIM side, APIM will ask IS to evaluate the XACML policy against parameters of the request (username, application name, API name) and return whether it is permitted or not.

You can find more information about writing XAML policy here, https://docs.wso2.com/display/IS570/Creating+a+XACML+Policy