Maintaining Logins and Passwords

This section covers the following topics: 

Changing the super admin password

Follow the instructions below to change the default admin password:

1. Sign in to the APIM management console with admin/admin credentials and use the Change my password option.

2. After changing the credentials, change the same in the following files.

   • The <APIM_HOME>/repository/conf/user-mgt.xml file.

     <UserManager>
        <Realm>
           <Configuration>
               ...
               <AdminUser>
                  <UserName>admin</UserName>                  
                  <Password>admin</Password>
               </AdminUser>
           ...
        </Realm>
     </UserManager>

     Note that the password in the user-mgt.xml file is written to the primary user store when the server starts for the first time. Thereafter, the password will be validated from the primary user store and not from the user-mgt.xml file. Therefore, if you need to change the admin password stored in the user store, you cannot simply change the value in the user-mgt.xml file. To change the super admin password, you must use the Change Passwordoption from the management console.

   • The  <APIM_HOME>/repository/conf/jndi.properties file.

     connectionfactory.TopicConnectionFactory = amqp://admin:admin@clientid/carbon?brokerlist='tcp://localhost:5672'
     connectionfactory.QueueConnectionFactory = amqp://admin:admin@clientID/test?brokerlist='tcp://localhost:5672'

Recovering a password

See How can I recover the admin password used to sign in to the management console?

Login in via multiple user store attributes

See Authentication using multiple attributes in the WSO2 IS documentation.

Setting up primary and secondary logins

In a standalone deployment of the API Manager instance, users of the API Store can have a secondary login name in addition to the primary login name. This gives the user flexibility to provide either an email or a user name to sign in. You can configure the API Store to treat both login names as belonging to a single user. Users can invoke APIs with the same access token without having to create a new one for the secondary login. 

You can configure this capability using the steps below.

1. Configure user login under the <OAuth> element in the <APIM_HOME>/repository/conf/api-manager.xml file.
   
   1. Set the primary attribute of the primary login to true and the primary attribute of the secondary login to false.
   2. Primary login doesn't have a ClaimUri. Leave this field empty.
   3. Provide the  correct  ClaimUri value for the secondary login.

   An example is given below:

   <OAuth>
       ..... . ....
       <LoginConfig>
           <UserIdLogin primary="true">
                <ClaimUri></ClaimUri>
           </UserIdLogin>
           <EmailLogin primary="false">
                <ClaimUri>http://wso2.org/claims/emailaddress</ClaimUri>
           </EmailLogin>
        </LoginConfig>
   </OAuth>

2. In the API Store of a distributed setup, the serverURL element in the <APIM_HOME>/repository/conf/api-manager.xml file should point to the key manager instance's service endpoint. This allows users to connect to the key manager's user store to perform any operations related to the API Store such as login, access token generation etc. For example,

   <AuthManager>
      <!--Server URL of the Authentication service -->
      <ServerURL>https://localhost:9444/services/</ServerURL>
    
      <!-- Admin username for the Authentication manager. -->
      <Username>admin</Username>
    
      <!-- Admin password for the Authentication manager.-->
      <Password>admin</Password>
      
      <CheckPermissionsRemotely>false</CheckPermissionsRemotely>
   </AuthManager>

   If you have set the CheckPermissionRemotely parameter as true, the permissions will be checked in the remote server set in ServerURL. If the parameter is set as false the permissions will be checked by the local server

Setting up an e-mail login

See Email Authentication in the WSO2 IS documentation.

Setting up a social media login

You can auto-provision users based on a social network login by integrating the API Manager with WSO2 Identity Server.