如何在 wso2 apim 日志中显示调用特定 api 的用户的个人资料信息？

Question

I am trying to configure gateway access log of wso2 apim (4.0.0) so that it should contain profile info (for ex: organization, email) of the user that called certain api along with the owner of that api in a log file. I followed the answer to this similar question

The structure that I would like to have is:

username | user_organization | invoked_api_name | api_owner | api_url | request | response

Any help is welcome!

Answer 1

By using the following properties, we can extract the API Publisher , Username , and Tenant Domain from the Message Context in the custom Handler.

api.ut.apiPublisher: API Publisher
api.ut.userId: Username

Perform the following enhancements to the handleRequestOutFlow(..) method in the Custom Handler to extract the mentioned data

public boolean handleRequestOutFlow(..) {
    ...
    String username = (String) messageContext.getProperty("api.ut.userId");
    String apiCreator = (String) messageContext.getProperty("api.ut.apiPublisher");
    String apiContext = (String) messageContext.getProperty("api.ut.context");
    String tenantDomain = MultitenantUtils.getTenantDomainFromRequestURL(apiContext);
    if (tenantDomain == null) {
        tenantDomain = org.wso2.carbon.utils.multitenancy.MultitenantConstants.SUPER_TENANT_DOMAIN_NAME;
    }
    ...
}

---

Update

If you want to log the organization of a User via the custom Handler, then I can think of two options to achieve the requirement.

• Option 01: Configure OpenID Scope

  This option is applicable if you are having only a handful of applications that are needed for this function.

  Configure an additional OpenID scope mapping to the organization claim via the Carbon Management console. And make the organization claim a mandatory claim at each Service Provider to generate the JWT Access Token including the organization claim.

  When you are trying to generate the Token, you have to pass the OpenID scope that we have created for the organization , so that the Service Provider will evaluate and include the claim in the Token.

  Once the token arrives at the Gateway via the Headers, capture the token and extract the claim from it. Or else, configure the Gateway node to generate the X-JWT-Assertion token and capture that token and extract the claim.

• Option 02: Customize the Handler to retrieve claims

  We can enhance the Handler implementation to extract the Username from the JWT Access Token and then invoke a set of Key Manager endpoints with the required properties to retrieve the User claims. You can check the Key Manager connector implementation to find the relative endpoints to retrieve the User claims.

Hope this briefing helps you to choose a path. In addition, I have added few enhancements to the custom handler implementation focusing on the 2nd option.