Changes to the scope of an API endpoint are not taken into account unless restarting WSO2. Product bug? If not, any way to configure this behaviour?

user_1729795 0
Viewed 182

Starting with an API defined in WSO2 with no scopes associated to its endpoints...

enter image description here

... I get an access token and invoke them correctly.

Now I modify and publish my API, assigning a scope to one on the endpoints so that it requires the editor scope:

enter image description here

Now I invoke that editor scoped endpoint with the previous access_token and it works. This shouldn't happen since the token was given with the default scope, not the editor one.

Now I restart WSO2 and try again with the same token, getting the expected result of access denied:

(900910) - The access token does not allow you to access the requested resource</ams:description></ams:fault>%

I have needed to restart the platform so that scope changes are considered!! Is this a bug, a expected behaviour (it shouldn't...) of is there any way to force the refreshment of the endpoint requirements (appart from just publishing the changed API).?

wso2-api-manager wso2
1 Answers

If you generate a new access token after either modifying or deleting a scope of an API resource that you had previously invoked, you will not be able to access that particular resource of the API for a period of 15 minutes, which is the default Gateway cache period, because the WSO2 API Manager Gateway is designed to cache the details of the resource on its side.

Ref: https://docs.wso2.com/display/AM250/Scope+Management+with+OAuth+Scopes

This is not a practical problem in a typical production environment, as API updates in a production environment are very rare.

However, if this is really a problem for you, you can override the default scope validator[1] by extending it to not to use this cache. This is configured in identity.xml.

[1] https://github.com/wso2-extensions/identity-inbound-auth-oauth/blob/master/components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/validators/JDBCScopeValidator.java#L92

user_8055630
Related