Skip to main content

Generate Application Tokens & User Tokens from WSO2 API Manager

WSO2 API Manager provides a complete solution for publishing APIs,creating and managing a developer community and a scalable routing API trafic.If you are already familiar with this product,you are familiar with its one of basic component -'API Store'.

A deployed API Store provides a single place to all third party and internal API consumers to browse available APIs and subscribe to them as they want.If such a consumer follow the subscription process of this store-front UI,he'll notice it's a process of subscribing a selected set of APIs into a application and  giving a result with generated three keys as access token,consumer key and consumer secret adhreing to OAuth 2.0 spec.
In other words,it's the process of an Application developer [Say John a mobile app developer] select the APIs which needed to use from his application and subscribe to those APIs from his created application.As the result of this subscription process the application developer,John is getting an application access token,that can be used to invoke the subscribed APIs while developing the application and other two values called Consumer Key and Consumer Secret which are useful when the application users [third-party users who will use John's mobile application ] trying with his developed mobile app.


Now I know,you will have an important question with the above information given by me.It's that though Store-front is helpful to app developers  to find,select and subscribe to suitable and available APIs for developing applications,how the developers can handle authentication of application users to his developed app with the aid of WSO2 API Manager solution.The answer is from WSO2 API Manager we are exposing a separate endpoint,to achieve this requirement called 'Login API'. 

This has deployed as a separate pre-defined API from API Manager and from this API,it's calling an OAuth endpoint to generate access tokens.The source view of 'Login API' is as below.You can browse it from API Manager,by browsing carbon console ->Manage->Service Bus->APIs .

The developed app has to implement in a way,first the app has to store the consumer key and secret generated for the app from store front.Then once a app-user trying login to it,a request will send to above exposing login API endpoint with username/password and consumer key/secret values.Then from the login API,it'll send back a user access token ,a refresh token and an expirary time for the tokens for each success request. By using the returned user access token after a key validation,app user can use it to authenticate to functions of the app.

 Below steps will explain how to send a Curl request to above 'Login API'.App developer can implement sending this request and getting the response as a part of his app implementation.
  1. First get the relevant generated Consumer Key and Secret for the app from API Store and combine those two values as "consumerKey:consumerSecret".
  2. Then encode that combined value as base64 encoded value,For that you can use online encoder bae64encode.org .
  3. Then set that encoded value as the Authorization header for the request.The authorization header type for this request is 'Basic'.
  4. And pass username/password values as query strings.
  5. The complete sample Curl request is as below.
curl -k -d "grant_type=password&username=xxxx&password=xxxxx&scope=PRODUCTION" -H "Content-Type:application/x-www-form-urlencoded" -H "Authorization:Basic Base64EncodedValue(ConsumerKey:ConsumerSecret)" https://localhost:8243/login

 Above Curl request will return with a user access token,refresh token and an expiration time for tokens.

Comments

  1. AnonymousMarch 26, 2013 at 9:32 AM

    Hello Lalaji,

    I follow your post for my Api Manager 1.0.0 and I recibe a 403 error code "No matching resource found in the API for the given request".
    But I try the same in Api Manager 1.3.1 and worked fine.

    Any idea?

    Thanks in advance.

    ReplyDelete
  2. Lalaji SureshikaMarch 28, 2013 at 11:15 AM

    Hi Valentin,

    Did you get this 403 error,when invoking a separate API by using above generated user token or the above mentioned login API?

    ReplyDelete
  3. UnknownApril 2, 2014 at 12:17 PM

    Great post, thank you. API Key Generation & Access Control.
    Out-of-the-box API key management and provisioning for secured API Access Control with 3scale.
    http://www.3scale.net/api-key-generation-access-control-lp/

    ReplyDelete
  4. Forms-CreatorOctober 4, 2019 at 1:47 AM

    Thanks for sharing this informative blog with us

    legal document creator
    printable job application forms
    online invoice generator

    ReplyDelete

Post a Comment

Popular posts from this blog

Convert an InputStream to XML

For that we can use DocumentBuilder class in java. By using the method parse(InputStream) ; A new DOM Document object will return. InputStream input; DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); DocumentBuilder parser = factory.newDocumentBuilder(); Document dc= parser.parse(input); In the above code segment,by using the created Document object,the corresponding XML file for the inputStream can be accessed. References: http://www.w3schools.com/dom/dom_intro.asp http:// download.oracle.com/javase/1.4.2/docs/api/javax/xml/parsers/DocumentBuilder.html
2 comments
Read more

CORS support from WSO2 API Manager 2.0.0

Cross-origin resource sharing (CORS) is a mechanism that allows restricted resources  on a web page to be requested from another domain outside the domain from which the first restricted resource was served. For example, an HTML page of a web application served from http://domain-a.com makes an <img src >  request for a different domain as 'domain-b.com' to get an image via an API request.  For security reasons, browsers restrict cross-origin HTTP requests initiated from within scripts as in above example and only allows to make HTTP requests to its own domain. To avoid this limitation modern browsers have been used CORS standard to allow cross domain requests. Modern browsers use CORS in an API container - such as  XMLHttpRequest  or Fetch - to mitigate risks of cross-origin HTTP requests.Thing to  note is it's not only sufficient that the browsers handle client side of cross-origin sharing,but also the servers from which these resources getting need to handl
Post a Comment
Read more

[WSO2 AM] APIStore User Signup as an approval process

In previous versions of WSO2 APIManager before 1.6.0, it was allowed any user who's accessible the running APIStore come and register to the app.But there will be requirement like,without allowing any user to signup by him/her self alone,first get an approve by a privileged user and then allow to complete app registration.Same requirement can be apply to application creation and subscription creation as well.To fulfill that,we have introduced workflow extension support for  WSO2 APIManager  and you can find the introductory post on this feature from my previous blog post on " workflow-extentions-with-wso2-am-160 " . From this blog-post,I'll explain how to achieve simple workflow integration with default shipped resources with  WSO2 APIManager 1.6.0 and WSO2 Business Process Server 3.1.0 with targeting "user-signup" process. Steps First download the WSO2 APIManager 1.6.0[AM] binary pack from product download page . Extract it and navigate to
Post a Comment
Read more