WSO2 IS 使用 Access 令牌请求 XACML - 禁止错误 403

Question

Following this article, I created my request XACML and I have success. https://docs.wso2.com/display/IS560/Using+REST+APIs+via+XACML+to+Manage+Entitlement

And I saw in this last question that is possible use access token for made the request: WSO2is XACML API

My question is whether it is possible to use access token to take this request, because when I use basic authentication I'm successful in the request, but when I use access token I get 403 Forbidden.

If it is possible to use an access token to make this request, what can I do to solve the 403 problem?

Answer 1

Yes, you can use an access token to authorize the request. If you navigate to <PRODUCT_HOME>/repository/conf/identity/identity.xml file, you can find a content as follows.

<Resource context="(.*)/api/identity/entitlement/(.*)" secured="true" http-method="all">
            <Permissions>/permission/admin/manage/identity/pep</Permissions>
            <Scopes>internal_manage_pep</Scopes>
</Resource>

This config is related to how each /entitlement endpoint is secured. Find more details at https://is.docs.wso2.com/en/latest/develop/authenticating-and-authorizing-rest-apis/#secure-resources

If you use an access token it should be generated with the mentioned scopes. If the access token doesn't have the required scope you will receive 403 Forbidden. In order to make a POST request to https://localhost:9443/api/identity/entitlement/decision/pdp you should use an access token generated with internal_manage_pep scope.