Page Comparison

You use the Token API to generate and renew user and application access tokens programmatically. The tokens are required to invoke APIs subscribed under an application. Let's see how to generate/renew access tokens and authorize them. We support the four most common authorization grant types.

This section provides the following information:

...

Exchanging SAML2 bearer tokens with OAuth2 (SAML extension grant type)

SAML 2.0 is an XML-based protocol. It uses security tokens containing assertions to pass information about an end user between a SAML authority and a SAML consumer. A SAML authority is an identity provider (IDP) and a SAML consumer is a service provider (SP).

A lot of enterprise applications use SAML2 to engage a third-party identity provider to grant access to systems that are only authenticated against the enterprise application. These enterprise applications might need to consume OAuth-protected resources through APIs, after validating them against an OAuth2.0 authentication server. However, an enterprise application that already has a working SAML2.0 based SSO infrastructure between itself and the IDP prefers to use the existing trust relationship, even if the OAuth authorization server is entirely different from the IDP. The SAML2 Bearer Assertion Profile for OAuth2.0 helps leverage this existing trust relationship by presenting the SAML2.0 token to the authorization server and exchanging it to an OAuth2.0 access token.

WSO2 API Cloud acts as an authorization server and provides SAML2 Bearer Assertion Profile Support with the OAuth 2.0 feature. An enterprise application can exchange the SAML2.0 bearer token that it retrieves when authenticating against an IDP (e.g., WSO2 Identity Server) with an OAuth2.0 access token from an OAuth authorization server (e.g., WSO2 API Cloud). It can then use the OAuth2 token in API invocations.

The diagram below depicts this scenario:

Image Modified   
The scenarios of the above diagram are explained below:

Scenario [1]: User initiates login call to an enterprise application .

Scenario [2]:

• As the application is a SAML SP, it redirects the user to the SAML2.0 IDP to log in.
  
• The user provides credentials at the IDP and is redirected back to the SP with a SAML2.0 token signed by the IDP.
  
• The SP verifies the token and logs the user to the application.
  
• The SAML 2.0 token is stored in the user's session by the SP.  

Scenario [3]:

• The enterprise application (SP) wants to access an OAuth2 protected API resource through the API Cloud.
• The application makes a request to the API Cloud to exchange the SAML2 bearer token for an OAuth2.0 access token.
• The API Cloud validates the assertion and returns the access token.

Scenario [4]: User does API invocations through the API Cloud by setting it as an Authorization header with the returned OAuth2 access token.

Let's see how to configure the token exchange.

Prerequisites

• A signed SAML2 token (encoded assertion value), which you retrieve when authenticating against a SAML2 IDP. With the authentication request, you must pass attributes such as SAML2 issuer name, token endpoint and the restricted audience. To specify those attributes,

• 1. Log in to the management console (https://localhost:9443/carbon) using admin/admin credentials and select Add under Identity Providers menu in the Main menu.
     
     

  2. Provide the following values in the page that opens:
     
     • Under Basic Information
       
       • Identity Provider Name: Enter a unique name for IDP
       • Identity Provider Public Certificate: Upload Identity Provider public certificate
       • Alias: Give the name of the alias if the Identity Provider identifies this token endpoint by an alias

     • Under Federated Authenticators -> SAML2 Web SSO Configuration

       • Identity Provider Entity Id: The SAML2 issuer name specified when generating assertion token, which contains the unique identifier of the IDP 

       • Service Provider Entity Id: 
       • SSO URL: Enter the IDP's SAML2 Web SSO URL value
         
       
       

• A valid user account in the API Store.
  
• A valid consumer key and consumer secret. Initially, these keys must be generated through the management console by clicking the Generate link on My Subscriptions page.
  

Invoking Token API to generate tokens

Anchor
GenerateToken GenerateToken

  

...

• The Revoke API's endpoint URL is http://localhost:8280/revoke. It can take the following parameters:
  
  • The token to be revoked
  • Consumer key and consumer secret key. Must be encoded using Base64 algorithm

For example, curl -k -d "token=<ACCESS_TOKEN_TO_BE_REVOKED>" -H "Authorization: Basic Base64Encoded(Consumer key:consumer secret)" http://localhost:8280/revoke.