使用WSO2 ESB将OAuth安全的REST服务公开为不安全

Question

I have an OAuth secured REST service "Oservice". The client (who wants to access OService) is not able to request a token at the service's token generator. I would like the WSO2 ESB to handle this for the client:

1) The ESB should have an API, which receives the request from the client, adds the name + password and sends this request to the token generator.

2) The ESB should receive the token and add the token to the message from the client and forwards it to the Oservice.

3) The Oservice receives message from ESB, validates the token and replies with correct content to ESB and ESB will forward the reply to the client.

I was trying to find out whether OAuth mediator does this, but wasn't successful, since documentation is rather short for the OAuth mediator. Does anyone have an idea how to deal with this scenario?

Thanks a lot!

EDIT:

The goal is to use the ESB to expose a secured service as not secured to clients. I hope this clarifies a bit.

Answer 1

OAuth mediator can only be used to validate the OAuth access token which comes with the request. In your use case the back-end REST service is secured with OAuth and the request which comes via the ESB should have the access token. In this case OAuth mediator is of no use since token validation happens at the backend, not at ESB. This article explains how OAuth works. In step 2 and 3 you will anyway need human intervention to authenticate the resource owner which is not designed to be done programmatically. So your complete requirement does not seem to be valid because the final resource is accessed by the application, not the resource owner.

However I think some part of your requirement can be fulfilled. Say you have two REST APIs API1 and API2 in ESB.

1. Client sends a request to API1 just to trigger the API.
2. API1 sends a request to IDP with Client ID, scope of authorization and callback URL which is URL of API2.
3. IDP will redirect the client to the authentication page where he will authenticate himself. At this point clients HTTP request is fulfilled.
4. IDP will send the Authorization code to API2.
5. API2 will use the Authorization code and client secrete to get the Access token from IDP.
6. Once the Access token is received, API2 can access your Oservice and get the response/resource.
7. API2 will have to store the response somewhere like a file.
8. The client can make another request to say API3 to retrieve it.

Hope this helps

Answer 2

In your case you may use OAuth2 resource owner credentials grant type which is used when there is a high trust with the application using the resource owner credentials.

1. Now you may expose the IDP OAuthService (which is a SOAP service) as REST say API1 at ESB.
2. IDP OAuth service takes input as client id,client secret, resource owner username, resource owner password and grant type (=password) and returns access token with validity period.
3. Now you may call API1 to get the access token and then use that token while calling other OAuth protected APIs.

Hope it helps.