Sharing Applications

WSO2 API Manager provides the facility for users to share their applications and subscriptions with a specific logical group/groups such as an organization. As a result of application sharing, users can view and modify applications and subscriptions belonging to other users in the same group or a different group. 

WSO2 API Manager considers the organization name you enter when signing up to the API Store as the group ID. All the users specifying the same organization name belong to the same group. Therefore, such users that belong to a single group can view each others' subscriptions and applications provided that you have enabled application sharing. WSO2 API Manager also provides the flexibility to change this default authentication implementation.

Enabling application sharing

You can enable application sharing with users in a single group or between users in multiple groups by following the steps below.

1. Shutdown the server if its running.

2. Uncomment the <GroupingExtractor> element in the <API-M_HOME>/repository/conf/api-manager.xml file.

   <GroupingExtractor>org.wso2.carbon.apimgt.impl.DefaultGroupIDExtractorImpl</GroupingExtractor>

   This default extractor does not work with SAML SSO. To enable SAML SSO, you need to define the GroupingExtractor element as follows:

   <GroupingExtractor>org.wso2.carbon.apimgt.impl.SAMLGroupIDExtractorImpl</GroupingExtractor>

3. Restart the server.

Using the group sharing feature

Group IDs are extracted using a GroupingExtractor class which is an implementation of NewPostLoginExecutor interface. The default implementation is done through the  DefaultGroupIDExtractorImpl  class. The organization claim is extracted using the group ID. If a particular user is in more than one organization, provide the organizations as a string separated by commas. 

Share an application with multiple users who are in the same group or who are in multiple groups as follows: 

1. Start WSO2 API Manager, navigate to the WSO2 Store, and click Sign-up.
   

2. Sign up to the API store as two different users(e.g., usera, userb) belonging to the same organizations. Click Show Additional Details to set the organization.

   

3. Sign in as usera and add application App_A. 

4. Enter the Group ID as org1 and press enter. Click Add. App_A will be shared with all the users in org1 group.

   • You can enter one group ID or multiple group IDs based on the groups with which you wish to share the application.

   • If you have enabled group sharing, but if you have not entered a group ID in the Groups section, WSO2 API-M will automatically share the application with the users who are in the same organization that you are in, because they are considered as part of the same group.

   
   

Using application sharing

You can use application sharing as follows:

1. Sign out of the API Store. Sign in to the API Store as userb. 
2. Go to the Applications tab. You will see App_A which was added by usera.
   
   Note that the name of the application creator is appended to the application name to differentiate the applications.
3. Subscribe to the default API using App_A.
   
4. Log in to the API Store as usera. The subscriptions for App_A by userb will be displayed.
   

Extending the group ID extractor

The default implementation picks the organization claim as the group ID. The organization names are returned in a string array. To use a different claim or a different type of group ID , you should create your own group ID extractor class by extending the NewPostLoginExecutor interface and overriding the following method.

String[] getGroupingIdentifierList(String response);

When a user signs in to the store, the latter mentioned method is called and it will return all the group IDs that correspond to the user who has logged in to the store. After users sign in to the store, they will be able to see their own applications, which they created, and also the applications that are shared with the group IDs that were returned by the getGroupingIdentifierList method.

Defining a custom user claim as the group extractor claim

You can use this WUM update to configure the user claim of your choice from a configuration file rather than use the hard-coded organization claim URI. Thereby, this allows you to have the flexibility of using your own custom claim.

To define a custom user claim URI as the default group extractor claim URI, add the following configuration under the <APIStore> tag in the <APIM_HOME>/repository/conf/api-manager.xml file.

<DefaultGroupExtractorClaimUri>[custom-claim]</DefaultGroupExtractorClaimUri>

<DefaultGroupExtractorClaimUri>http://wso2.org/claims/role</DefaultGroupExtractorClaimUri>