Configuring Auth0 as Key Manager for WSO2 API Manager
This article will guide you to configure Auth0 as a KM in WSO2 APIM step by step. In this scenario, the when generating the access tokens those will get generated via Auth0. There are few easy steps that we need to configure the Auth0 with WSO2 API Manager to get that functionality.
Prerequisites
- Create an account in https://auth0.com/
- Download API Manager version 4.0.0 distribution from https://wso2.com/api-management/
Create an machine-to-machine application in Auth0
After successfully creating an account in Auth0 we need to create an application in Auth0 side which will then need the details of the application thats needed when configuring the external Key Manager in WSO2 API Manager.
To create a new application, Navigate to “Applications” and click on “Create Application”
Enter “API Explorer Application” as the name, select “machine to machine” and click on “create”
Select “Auth0 Management API”, give “All” permissions and click on “Authorize”
Configure Auth0 in WSO2 API Manager
Now we need to configure the Key Manager in WSO2 API Manager using the Auth0 application details
Login to WSO2 API Manager admin portal (https://localhost:9443/admin) and Add a new Key Manager.
Enter “Name”, “Display Name”.
In the Key Manager configuration, You will be asked for a text box with a “Well-known URL”. You can add this url and most of the relevant information will get auto filled. You can find this URL in the Auth0 application settings. I also have given the steps to get it below.
Note:
To get the well-known url, go to applications and select the newly created machine-to-machine application and follow the steps mentioned below.
In the selected Application, select the “settings”
Scroll down to the bottom and expand “Advance settings”
Select “endpoints” and copy the “well-known URL”
Once you have the well-known URL, comeback to Key Manager configuration section in API Manager, paste and click on “import” all the necessary fields will be autofilled.
Enter the “Introspect URL” as “none”
Add “client_credentials” and “password” for the Grant type section (client_credentials, password)
Enter “Client ID”, “Client Secret” and “Audience” in connector configurations. Please find the below note on finding the values for the required sections in the Auth0
Note:
Find the client id and client secret when you scroll up in the “settings” section in the created application in Auth0
Find Audience in the “API” section in the created application in Auth0
After you retrieve those information from Auth0 application, Please add it under the “Connector Configurations” section
As the final step of configuring the Key Manager, click on “Add”
Generate keys using the Auth0 Key Manager
Login to WSO2 API Manager developer portal (https://localhost:9443/devportal)
Add a new application.
Create production keys and sandbox keys for the application by clicking on the selected items below.
Select “Auth0” as the key manager
Scroll down and enter “Audience of the API”
Find Audience in the “API” section in the created application in Auth0 as mentioned in an above step
Click on “Generate Keys”
If the keys are generated successfully, a popup message should come as follows and generate the access token.
Since we dont have any scopes, click on “generate”
Copy the access code generate
Subscribe to an API
And try out
Copy paste the copied access token in the
Execute the tryout
When trying out, the access token that was generated using the Auth0 was used.
I hope this article made you a bit easier when configuring Auth0 as a Key Manager with WSO2 API Manager.