This section covers the following topics:
Changing the super admin password
Follow the instructions below to change the default admin password:
- Sign in to the APIM management console with admin/admin credentials and use the Change my password option.
After changing the credentials, change the same in the following files.
Note that the password in the
user-mgt.xmlfile is written to the primary user store when the server starts for the first time. Thereafter, the password will be validated from the primary user store and not from the
user-mgt.xmlfile. Therefore, if you need to change the admin password stored in the user store, you cannot simply change the value in the
user-mgt.xmlfile. To change the super admin password, you must use the Change Passwordoption from the management console.
Do you have any special characters in passwords?
If you specify passwords inside XML files, take care when giving special characters in the user names and passwords. According to XML specification (http://www.w3.org/TR/xml/), some special characters can disrupt the configuration. For example, the ampersand character (&) must not appear in the literal form in XML files. It can cause a Java Null Pointer exception. You must wrap it with CDATA (http://www.w3schools.com/xml/xml_cdata.asp) as shown below or remove the character:
Note the following if you have special characters in the passwords on your
- It is not possible to use the
@symbol in the username or password.
- It is also not possible to use the percentage (%) sign in the password. When building the connection URL, the URL is parsed. This parsing exception happens because the percentage (%) sign acts as the escape character in URL parsing. If using the percentage (%) sign in the connection string is required, use the respective encoding character for the percentage (%) sign in the connection string. For example, if you need to pass
adm%inas the password, then the
%symbol should be encoded with its respective URL encoding character. Therefore, you have to send it as
For a list of possible URL parsing patterns, see URL encoding reference.
- It is not possible to use the
Recovering a password
Login in via multiple user store attributes
See Authentication using multiple attributes in the WSO2 IS documentation.
- When setting up email login specify the complete username with tenant domain. If you are in super tenant mode username should be as follows. <username>@<email>@carbon.super
- When configuring <DataPublisher> section under <ThrottlingConfiguration> section in <PRODUCT_HOME>/repository/conf/api-manager.xml, specify the fully qualified username with tenant domain.
Example : <Username>firstname.lastname@example.org@carbon.super</Username>
When specifing username in JMS Connection URL, under <JMSConnectionParameters> in <PRODUCT_HOME>/repository/conf/api-manager.xml, "@" characters should be replaced by "!" character.
Example URL :
Setting up primary and secondary logins
In a standalone deployment of the API Manager instance, users of the API Store can have a secondary login name in addition to the primary login name. This gives the user flexibility to provide either an email or a user name to sign in. You can configure the API Store to treat both login names as belonging to a single user. Users can invoke APIs with the same access token without having to create a new one for the secondary login.
You can configure this capability using the steps below.
- Configure user login under the
<OAuth>element in the
- Set the
primaryattribute of the primary login to
primaryattribute of the secondary login to
- Primary login doesn't have a
ClaimUri. Leave this field empty.
- Provide the correct
ClaimUrivalue for the secondary login.
An example is given below:
- Set the
In the API Store of a distributed setup, the
serverURLelement in the
<APIM_HOME>/repository/conf/api-manager.xmlfile should point to the key manager instance's service endpoint. This allows users to connect to the key manager's user store to perform any operations related to the API Store such as login, access token generation etc. For example,
If you have set the
CheckPermissionRemotelyparameter as true, the permissions will be checked in the remote server set in
ServerURL. If the parameter is set as false the permissions will be checked by the local server
Tip: In a distributed setup, the API Store's user store needs to point to the key manager user store.
Tip: Be sure to keep the secondary login name unique to each user.
Setting up an e-mail login
See Email Authentication in the WSO2 IS documentation.
Setting up a social media login
You can auto-provision users based on a social network login by integrating the API Manager with WSO2 Identity Server.
Note that auto-provisioning users based on social network login is not supported in a multi-tenant environment.
In a multi-tenant environment, the system cannot identify the tenant domain in the login request that comes to the API Manager's Publisher/Store. Therefore, the service provider is registered as a SaaS application within the super tenant's space. Configuring user provisioning is part of creating the service provider. In order to authenticate the user through a third party identity provider such as a social network login, you must enable identity federation. As the service provider is created in the super tenant's space, the provisioned user is also created within the super tenant's space. As a result, it is not possible to provision the user in the tenant's space.
To overcome this limitation, you can write a custom authenticator to retrieve the tenant domain of the user and write a custom login page where the user can enter the tenant domain, which is added to the authenticator context. Write a custom provisioning handler to provision the user in the tenant domain that is maintained in the context.