OpenAM provides a set of REST APIs to authenticate the users with username/password & validates the authenticated user’s sessions. Assume that there is an application which has been implemented to authenticate its end users by calling REST API of the OpenAM. As an example in following HTTP POST request must be sent to OpenAM for […]
Tag: WSO2APIM
WSO2 API Manager is using OAuth2 for securing the APIs which are exposed by it. Currently API Manager implementation is tightly bound with the OAuth2. However, there is some way in APIM that we can write our own authentication mechanism for APIs instead of using OAuth2. But it is normally not recommended as some other functions such […]
In this blog, we discussed, how we can use WSO2 API Manager with federated authentication for granting an access tokens. But, API manger is not shipped with all the federated authenticators (which are available in the WSO2IS) by default. Therefore you need to install these authenticators in to the API Manager. In a distributed setup, you […]
When you are using WSO2 APIM, application can subscribe for multiple APIs which are available in the API Store. End users can grant access tokens for the application. By default, these access tokens can be used to access all the APIs which are subscribed by the application. Simply, granted access token can be used to […]
WSO2 API Manager supports for both authorization code and implicit grant types. When Access tokens are granted using above grant types, end user must be authenticated to API manager (Actually Key manager) by providing their credentials. It means that end user must be in the user store that is connected to the API Manager (Key […]
According to the OpenId Connect specification, It is recommended to use authorization code and implicit grant types for OpenId Connect requests. But it is not mentioned that other grant types can not be used. Therefore you can use any other grant types for OpenId Connect authentication request. Some OAuth2 Authorization server supports for password grant […]
Identity Server supports for the OpenId connect core specification which can be found from here. If you like to try out the openid connect with Identity Server, you can find the sample from here. You can even modify the source and rebuild the web application as you like. Please note: In this blog post, sample […]
SAML2 Bearer grant type is one of the popular profile in OAuth 2.0. Once end user login in to a web application using SAML2 SSO and if web application needs to call an OAuth secured API behalf of the user, SAML2 Bearer grant type would be the ideal way to do it. With this profile, […]