User Roles in the API Manager

Roles contain permissions for users to manage the server. You can create different roles with various combinations of permissions and assign them to a user or a group of users. User roles can be reused throughout the system and prevent the overhead of granting multiple permissions to each and every user individually. Through the Management Console, you can also edit and delete an existing user role.

WSO2 API Manager allows you to log in to the Management Console as an admin user, and create custom roles with different levels of permission. These roles can then be assigned to different users according to your requirement. We identify four distinct user roles that are typically used in many organizational situations:

• Admin : Admin is the API management provider, who hosts and manages the API Gateway. S/he is responsible for creating user roles in the system, assign users to roles, managing databases, security etc. Also see the Admin Guide. The Admin role is available by default with credentials admin/admin.
• creator: A creator is typically a person in a technical role who understands the technical aspects of the API (coding, interfaces, documentation, versions, how it is exposed by API gateway) and uses the API Publisher Web application to develop and provision APIs into the API store. The creator uses the API store to consult ratings and feedback provided by API consumers. Creator can add APIs to the store but cannot manage their lifecycles (that is, make them visible to the outside world).
• publisher: A publisher is typically a person in a managerial role and overlooks a set of APIs across the enterprise or a business unit, and controls the API lifecycle and monetization aspects. The publisher also analyzes usage patterns for APIs and has access to all API statistics.
• consumer : A consumer is typically an anonymous user or an application developer who searches the API store to discover APIs and use them. He/she reads the documentation,  forums, rates/comments on APIs.

Administrators of the API Manager can use the Management Console UI to add user roles. Roles contain different levels of permissions to manage the Server. You can create different roles with various combinations of permissions. Follow the instructions below to create the creator, publisher and subscriber roles.

Creating user roles

1. Log in to the Management Console (https://localhost:9443/carbon) and select Users and Roles under the Configure menu. For instructions on accessing the Management Console, see Running the Product.
2. In the User Management  page that opens, click Roles and Add New Role link.
   

   Adding the creator role

3. Add user role as creator and click Next.  The Domain drop-down list contains all user stores configured for this product instance. By default, you only have the PRIMARY user store. To configure secondary user stores, see Configuring Secondary User Stores.
   
4. Give the following privileges to the creator role. You can select them from the list of permissions that appears.
   
   • Configure > Governance and all underlying permissions.
   • Login
   • Manage > API > Create
   • Manage > Resources > Govern and all underlying permissions
     

        
     Any user with the above permissions assigned is able to create, update and manage APIs using the  API Publisher  Web interface.

5. Click Finish once you are done adding permission. The role will be listed in the Roles window as follows:
   

   From here, you can rename, edit, delete or assign users to the role.

   Adding the publisher role

6. In the Add Role page, add user role as publisher and click Next.  The Domain drop-down list contains all user stores configured for this product instance. By default, you only have the PRIMARY user store. To configure secondary user stores, see Configuring Secondary User Stores.
   
7. Give the following privileges to the publisher role by selecting them from the list of permissions that appears.  
   
   • Login
   • Manage > API > Publish

   
     Any user with the above permissions assigned is able to manage the API's life cycle using the API Publisher Web interface.  

8. Click Finish once you are done adding permission. The role will be listed in the Roles window as follows:
   

   From here, you can rename, edit, delete or assign users to the role. 

   The default subscriber role

   When you first log in to the Management Console, you can see the subscriber role already there, defined out of the box. The reason is because API Manager assigns this default subscriber role to all users who self-register to the API Store. 

   Follow the instructions below to create a different role with the same permission levels.

9. In the Add Role window, add a suitable name for the role and click Next.   For example,
   
10. Give the following privileges to the new role.
    
    
    • Login
    • Manage > API > Subscribe

    

    Any user with the above permissions assigned is able to log in to the API Store and perform operations on the published APIs. 

11. Click Finish once you are done adding permission. The role will be listed in the Roles window.

12. Open <APIM_HOME>/repository/conf/ api-manager.xml file and edit the <SelfSignUp> element to reflect the newly added role. For example,

    <SelfSignUp>
         <Enabled>true</Enabled>
         <SubscriberRoleName>NewSubscriber</SubscriberRoleName>
         <CreateSubscriberRole>true</CreateSubscriberRole>
    </SelfSignUp>

    Editing this file ensures that all users who self-sign-up to API Store are automatically assigned the NewSubscriber role.

    Note: The <CreateSubscriberRole> parameter specifies whether the subscriber role should be created in the local user store or not. It is only used when the API subscribers are authenticated against the local user store. That means the local Carbon server is acting as the AuthManager.

    Set this parameter to false if a remote Carbon server acts as the AuthManager.