Is Endpoint Security Authentication in WSO2 APIM Done per API or per request?
We have 3 types of endpoint security in Wso2 apim:
- Basic
- Digest
- Oauth2
I am using Oauth2. You can see UI of endpoint security configurations here:
My question is: if we have many users, how will endpoint authenticating be done? Per user? Or using cache for the API?
Solution
A cache is maintained here per API. You can check the code - https://github.com/wso2/carbon-apimgt/blob/master/components/apimgt/org.wso2.carbon.apimgt.gateway/src/main/java/org/wso2/carbon/apimgt/gateway/mediators/oauth/OAuthTokenGenerator.java#L65
- Identity Server 4 - Unable to authenticate user
- How to verify a token received from chrome.identity.getAuthToken() in the backend?
- Getting no access_token but id_token from Google OAuth2
- Need admin approval unverified needs permission to access resources in your organisation that only an admin can grant
- Getting a token from Microsoft Intra ID with PostMan using MFA
- Freshdesk OAuth SSO: Freshdesk Login Page Doesn't Ping My Auth Page?
- Azure OAuth2: can't validate access token
- Export a Google Sheet to PDF file with Python requests
- Are auth code and access token exclusive to a single resource owner?
- How to access an API with an Azure identity provider from a Python notebook?
- Unauthorized to Delete Tweet with OAuth2.0 path on free-tier developer account
- Argument of type "github" is not assignable to parameter of type 'OAuthProvider' in Appwrite
- How to authenticate resource owner with JWT token on Spring Authorization Server for requests to /oauth2/authorize?
- Headless OAuth2 Token Refresh Fails with Spring boot and MSAL4J
- Springboot Keycloak Admin add role or reset password error
- request to token url returning 400 bad request for google oauth2?
- Spring Boot Oauth Client & Authorization Server + React implementation
- Dotnet-Isolated Azure Functions - how to access HttpContext
- Enabling and Configuring Password History on Cognito
- Where to store the refresh token on the Client?
- Keycloak-Remix integration: where should I place the checks?
- Using PHPMailer when already have an access token
- Meta /media_publish return 500 unknown error
- Why is the IDP responding with Invalid Signature for a client assertion JWT
- How do you authenticate a call to a logic app (standard) via oAuth2.0?
- Securing an azure API with oauth: Able to retrieve a token but token is invalid
- Spring Security 5.2 Password Flow
- Why Doesn't my Authorization Header need "Bearer"?
- Add role based authentication using next-auth in NextJS
- No qualifying bean of type 'org.springframework.security.oauth2.client.registration.ClientRegistrationRepository' available