WSO2 Configuration (IS Application securing APIM endpoint)

Question

We're attempting to configure a relatively complicated WSO2 setup in which Identity Server (5.7.0 with KM) authenticates through an OAuth Service Provider, uses the token to secure API Manager (2.6.0) Endpoints, which then cycles through the Enterprise Integrator (6.5.0).

I've followed the steps to configure IS as the Key Manager (https://docs.wso2.com/display/AM260/Configuring+WSO2+Identity+Server+as+a+Key+Manager). This appears to be working, as I can see users in APIM that were configured in IS.

The problem is in the application. In IS I've created an OAuth POC that federates to another authentication provider. I want APIM to understand that application, and be able to use it to subscribe to APIs through the store for users that IS has given roles to. The application doesn't appear in APIM's applications, and I can't figure out how to link the two. I'd like for APIM to understand the token, figure out that it's for the OAuth POC in IS, and then if the user has that role, let them in, else return a 401 or something equivalent. Haven't been able to find someone else with a tutorial or guidance on this setup specifically.

Is your requirement is to let users in the Authentication Provider that is communicating with IS using federation, to subscribe APIs? — Vithursa M
Yes, that is what we're going for. I wouldn't say it's a requirement, we're still evaluating the product to achieve our goal - which is mainly to just enable federated logins to our API endpoints. The whole concept of the federated entities going into the Store and making their own applications and subscribing to endpoints was a bit of a no-go, we wanted the applications pre-configured and they just authenticate against them. — Thomas

Luis Bustamante Luis Bustamante · Accepted Answer · 2019-07-24T13:03:04

Linking an Oauth2 provider from IS to an APIM application is called by WSO2 as "Out-of-Band provisioning". This guide may bring you a step further in your POC: https://docs.wso2.com/display/AM260/Provisioning+Out-of-Band+OAuth+Clients

WSO2 Configuration (IS Application securing APIM endpoint)

1 Answers