Sharing applications and subscriptions across multiple application developers through WSO2 API Store

In previous WSO2 APIM versions before 1.9.0 version,only the application developer who logs into APIStore can view/manage his applications and subscriptions.But there was a requirement arose mainly due to following two reasons;

-- What if there’s a group of employees in an organization worked as developers for an application and how all those user group could get access to same subscription/application.

--  What if the APIStore logged in developer left the organization and organization want to manage his created subscriptions in-order to manage the developed applications under organization name and only prohibit the left developer of accessing those.

Since above two requirements are really valid in an app development organization perspective ,we have introduced the feature of sharing applications and subscriptions across user groups from APIM 1.9.0 version onwards. The API Manager provides facility to users of a specific logical group to view each other's' applications and subscriptions.  

We have written this feature with the capability to extend it depend on an organization requirement.As the attribute to define the logical user group will be vary based on organizations.For example:

1)In one organization,sharing applications and subscriptions need to be control based on user roles

2) In another scenario,an APIStore can be run as a common APIStore across multiple organizational users.And in that,user grouping has to be done based on organization attribute.

Because of above facts,the flow how the sharing apps/subscriptions flow is as below.

1. An app developer of an organization tries to login to APIStore
2. Then in the underlying APIM code,it checks,if  that APIStore server’s api-manager.xml have the config <GroupingExtractor> enabled and if a custom java class implementation defined inside it.
3. If so,that java class implementation will run and a group ID for logged in user will be set.
4. Once the app developer logged in and try to access ‘My Applications’ page and ‘My subscriptions’ page,from the underlying code,it’ll return all the database saved applications & subscriptions based on the user’s ‘Group ID’.

With above approach,the applications and subscriptions are shared based on defined ‘Group ID’ from the custom implementation defined in <GroupingExtractor> of api-manager.xml.

By default,we are shipping a sample java implementation as “org.wso2.carbon.apimgt.impl.DefaultGroupIDExtractorImpl” for this feature to consider the organization name which a signup user give at the time he sign up to the API Store as the group ID. From the custom java implementation,it extracts the claim http://wso2.org/claims/organization of the user who tries to login and uses the value specified in that claim as the group ID. This way, all users who specify the same organization name belong to the same group and therefore, can view each other's' subscriptions and applications. 

For more information on default implementation on sharing subscriptions and applications,please refer; https://docs.wso2.com/display/AM190/Sharing+Applications+and+Subscriptions

In a real organization,the requirement can be bit different.The API Manager also provides flexibility to change this default group id extracting implementation.

From this blog-post,I’ll explain how to write the group id extracting extension based on below use-case.

Requirement

An organization want to share subscriptions & applications based on user roles of the organization.They have disabled ‘signup’ option for users to access APIStore and their administrator is giving rights to users to access the APIStore. Basically the application developers of that organization can be categorized in-to two role levels.

1. Application developers with ‘manager’ role

These developers control production environment deployed mobile applications subscriptions through API Store
2. Application developers with ‘dev’ role
These developers control testing environment deployed mobile applications subscriptions through API Store 

Requirement is to share the applications and subscriptions across these two roles separately.

Solution

Above can be achieved through writing a custom Grouping Extractor class to set ‘Group ID’ based on user roles.

1. First write a java class with implementing the interface org.wso2.carbon.apimgt.api.LoginPostExecutor interface  and make it as a maven module.

2. Then implement the method  logic for ‘getGroupingIdentifiers()’ of the interface.
In this method,it has to extract two separate ‘Group ID’s for users having ‘manager’ role and users having ‘dev’ role. Below is a written sample logic for similar requirement with implementing this method.You can find the complete code from here.

   public String getGroupingIdentifiers(String loginResponse) {
        JSONObject obj;
        String username = null;
        String groupId = null;
        try {
            obj = new JSONObject(loginResponse);
            //Extract the username from login response
            username = (String) obj.get("user");
            loadConfiguration();
             /*Create client for RemoteUserStoreManagerService and perform user management operation*/
            RoleBasedGroupingExtractor extractor = new RoleBasedGroupingExtractor(true);
            //create web service client for userStoreManager
            extractor.createRemoteUserStoreManager();
            //Get the roles of the user
            String[] roles = extractor.getRolesOfUser(username);
            if (roles != null) {//If user has roles
                //Match the roles to check either he/she is from manager/dev role
                for (String role : roles) {
                    if (Constants.MANAGER_ROLE.equals(role)) {
                        //Set the group id as role name
                        groupId = Constants.MANAGER_GROUP;
                    } else if (Constants.ADMIN_ROLE.equals(role)) {
                        //Set the group id as role name
                        groupId = Constants.ADMIN_GROUP;
                    }
                }
            }

        } catch (JSONException e) {
            log.error("Exception occurred while trying to get group Identifier from login response");
        } catch (org.wso2.carbon.user.api.UserStoreException e) {
            log.error("Error while checking user existence for " + username);
        } catch (IOException e) {
            log.error("IO Exception occurred while trying to get group Identifier from login response");
        } catch (Exception e) {
            log.error("Exception occurred while trying to get group Identifier from login response");
        }
        //return the group id
        return groupId;
    }

3.  Build the java maven module and copy the jar into AM_Home/repository/components/lib folder.
4. Then open APIStore running AM server’s api-manager.xml located at {AM_Home}/repository/conf location and uncomment  <GroupingExtractor> config inside <APIStore> config and add your wrote custom java class name in it.

For eg: <GroupingExtractor>org.wso2.sample.gropuid.impl.RoleBasedGroupingExtractor</GroupingExtractor> 5. Then restart the APIM server. 6. Then try accessing API Store as different users with same ‘Group ID’ value.For example try login to API Store with a developer having ‘manager’ role and do a subscription.Then try to login as another user who also has ‘manager’ role and check his ‘My Applications’ and ‘My subscriptions’ views in API Store. The second user will able to see the first user created application and subscription in his API Store view as below.

Then try to login as an app developer with ‘dev’ role as well.He’ll not able to see the subscriptions/applications of users with ‘manager’ role.