I am using a custom datastore with the WSO2 Identity Server to authenticate users stored in an RDBMS. The userstore is on readOnly mode.
How the users are added/deleted from the RDBMS is unknown to the identity server.
This is the use case:
An external application should allow users to login using credentials stored in the RDBMS and retrieve a token that can be used to communicate with the resource provider. The application will use authorization_code grant for this.
After a successful authorization the client will receive a JWT token which will be used when trying to contact the resource provider.
The resource provider uses the introspection endpoint of the identity server to confirm that the token is valid before procceeding with the request.
This flow is working as expected. A user can login and access the resources as expected.
However two issues arise.
Can I somehow retrieve the applications that a user has authorized from the Identity server? I am aware of the dashboard but I want to move that functionality in another app.
If a user is deleted from the RDBMS any active OAuth tokens issued for him are not revoked from the identity server and the user can still access the resource. I do not want to force the resource owner to check if the user is still valid.
From my understanding those actions should be supported from the Identity server with no additional products. Admin services are enabled on the Identity Server but I can't locate the wsdl & endpoint to do that.
I am using WSO2 IS 5.8
-DosgiConsole
and when the server is started, hit the enter/return key several times to get the OSGI shell in the console. In the OSGI shell, type: osgi> listAdminServices. Then a list of all available admin services will be listed. To see the service contract of an admin service, select the admin service's URL and then paste it in your browser with ?wsdl at the end. – manuka_m Dec 3 at 6:00