WSO2 API Manager - Authenticate user from API client

2
votes

I'm developing a set of microservices exposed as REST through WSO2 API manager.

Now, I'd like to call these services in Angular front end. What is the best way to handle user authentication and authorization?

I found it can be done through OAuth2 Password Grant as described here?

When user logs in, user credentials will be sent to specific WSO2 APIM endpoint (/token), it validates, generates the token and this token will be sent in header for subsequent calls.

Is this the best approach to this case?

Thanks in advance,

1
oauth-2.0wso2wso2-amwso2is

1 Answers

2
votes

As mentioned in your question, https://apim.docs.wso2.com/en/next/learn/api-security/oauth2/grant-types/password-grant/ This method will only work when you have the resource owner's username and password.

Take an example, suppose you have published the APIs and created a user (resource owner) in the WSO2 store. this user is subscribed to the API using the application. the application will have a client id and secret, which will be used to generate the OAuth2.0 token. this token will be used to invoke the APIs.

Now in your angular project, one way is to hardcode the base64(clientid:clientsecret) and call the token API to generate the OAuth2.0 bearer token. use the generated token to call the APIs onboarded on WSO2. To protect your APIs from the attack, use rate limiting based on IP

Now take another situation, if you want the user to authenticate first, then generate the JWT token for that user using the password grant type (using actual user's username and password), and using that JWT generate the OAuth2.0 Bearer token which will be used to call the APIs.

Steps to be performed for the second situation:

  1. during registration (from Angular), internally onboard the user in the WSO2 Identity Server. (There is a WSO2 API for the same)
  2. After registration, generate the JWT token from the identity server by authenticating username and password. (Again for this, WSO2 API is there)
  3. now using this JWT token, Generate the OAuth2.0 token from WSO2 APIM
  4. use this token to call the APIs

The second approach is the ideal approach for user to service authentication and authorization using WSO2 as the gateway while the first approach mainly focuses on service to service authentication and authorization

Hope this answers your question

Reference Link: https://medium.com/wso2-learning/how-to-protect-your-apis-with-self-contained-access-token-jwt-using-wso2-api-manager-and-wso2-75673d8a4686