OAuthAdminService in WSO2 Identity Server 5.0

Admin Services

WSO2 Identity Server exposes SOAP base services for management purposes. Those are known as admin services. You can list down all the admin services by starting following ways.

Step 1. Start the server with -DosgiConsole .

For Linux, and Windows respectively.

> sh wso2server.sh -DosgiConsole

> wso2server.bat -DosgiConsole

Step 2. when server started,  type listAdminServices

osgi> listAdminServices

 

OAuthAdminService

There is a SOAP based admin service called "OAuthAdminService" that exposes methods to retrieve the authorized apps for given user and revoke them when user required. 

Ex use case:-

List all the oAuth applications a user has approved and revoke each of them if required for a particular user.

 

Note :-
You have to change HideAdminServiceWSDLs property in carbon.xml file before you access Admin Services in carbon products.Default value is true.

<HideAdminServiceWSDLs>false</HideAdminServiceWSDLs>

WSDL file :

https://{Hostname}:{port}/services/OAuthAdminService?wsdl

Following methods can be used 

To retrieve authorized apps ==> "getAppsAuthorizedByUser"

To revoke authorized apps ==> "revokeAuthzForAppsByResoureOwner"

When you create a project using wsdl file, you can test below APIs using soapui.

1. getAllOAuthApplicationData()

- using this API, it returned all Applications related to particular user

 

2. getAllowedGrantTypes()

 - Returned all allowed grant types for particular user 

3. getAppsAuthorizedByUser()

This API retrieve applications for particular user. user name is taken from credentials. user doesn't have any applications for admin user in following screen.

4. revokeAuthzForAppsByResoureOwner()

By using this api, user can revoke an applications by name. According to the below request, response returned false, because there is no any applications called "app1" for particular credentials.




The users provisioned in this scenario should have the login permission. Both the required service methods getAppsAuthorizedByUser() and revokeAuthzForAppsByResoureOwner() required login permission (/permission/admin/login).

You have 2 options to achieve this,

1) Assigning login permission to Internal/everyone role. (This is the simplest solution).

2) Define a special role with login permission and assign that role to the user in the provisioning time.


If you selected 2nd option, you have to add addUser() method to custom grant handler,

com.synchronoss.oauth2.token.handlers.grant.UserStoreUtils class should be updated as follows.

public static void addUser(String userName, Map<String, String> claimMap) throws IdentityOAuth2Exception {
    try {
        UserStoreManager userStoreManager = getUserStoreManager(userName);
        userStoreManager.addUser(userName, generatePassword(), null, claimMap, null);
        userStoreManager.updateRoleListOfUser(userName, null, new String[]
                {"roleNameWithLoginPermissino"}
         );
      PermissionUpdateUtil.updatePermissionTree(getTenantId(userName));
     } catch (UserStoreException e){ 
         throw new IdentityOAuth2Exception("UserStoreException while trying to check whether the user exists. ", e); 
      }
} 

You can test following APIs using soap ui

    getOAuthApplicationData()

    getOAuthApplicationDataByAppName()

    registerOAuthApplicationData()

    registerOAuthConsumer()

    removeOAuthApplicationData()

    updateConsumerApplication()

If you want to create a service provider using admin service, you have to use  IdentityApplicationManagementService. 

 

For more information :- http://soasecurity.org/2014/11/13/understanding-the-admin-services-in-carbon-products