0

I wanted to do some POC for wso2 API manager where API Manager will expose login and registration url which will be called by UI layer but wanted to handle end user authorization and authentication in API manager layer and don't want to handle this in database how can I do this i don't to use Identity server also.

I have gone through password grant_type tutorial and we can use this but how the authorization is going to performed? Do we need to maintain user details in separate database or in identity server? if yes how this is going to happen.

I have gone through below questions but didn't get exact solution, please help me on this.

authorize user in wso2 api manager

wso2 api manager end-user

Thanks

atiwari
  • 107
  • 1
  • 8
  • It is still not clear what do you want to achieve and what are the constraints.. `don't want to handle this in database` If you want to authorize users, you need to have the user credentials somewhere. If the users are in different IdP, maybe you could use some sort of federation (OAuth or SAML), it is possible to set it up even without extra identity server. Or you want to have some sort of end-user registration? – gusto2 Nov 05 '18 at 09:59
  • @gusto2 it's kind of end user registration in which user will first register himself.user credentials will be stored in database; login , registration service along with application related services will be exposed via wso2 which will be consumed by UI layer and requirement is wso2 API manager to manage authentication and authorization. – atiwari Nov 11 '18 at 14:36

1 Answers1

0

how can I do this i don't to use Identity server also

By default you should be using the provided OAuth2 endpoints to authorize the users. However - the API Manager itselfs doesn't support self-registration and account verification.

I'd suggest to configure a WSO2 Identity Server as an APIM Key manager.

The WSO2IS has capability for self-registration and account verification.

The application or users will authenticate against the WSO2IS and the returned token will be valid for APIM (as the KeyManager shares the database with tokens).

gusto2
  • 11,210
  • 2
  • 17
  • 36
  • but by this you will be authenticating only user to user who are registering in wso2 api store not end user who are using the portal. – atiwari Nov 16 '18 at 07:59
  • @atiwari it is registering users generally (even end users). For the store all users will get a *subscriber* role automatically (it is possible to disable somewhere) – gusto2 Nov 16 '18 at 08:38
  • do we have any documents how to do this step by step. – atiwari Nov 16 '18 at 09:29