Cross Tenant Subscription with Global Key Manager in WSO2 API Manager

Photo by Filip Szalbot on Unsplash

Global Key Manager is currently supported by API Manager v4.0.0 onwards. Hence if you are an APIM 4.x user, hope you’d find this helpful!

Please note that, upto APIM 4.2.0 this feature is available from certain update level and this is shipped inbuilt with APIM 4.3.0.

Cross Tenant Subscription

WSO2 API Manager supports cross tenant multitenancy. Which means you can have multiple organizations, as a result multiple roles and users for each organization. To enable cross tenant subscription you should add the following config to <APIM-HOME>/repository/conf/deployment.toml file.

[apim.devportal]
enable_cross_tenant_subscriptions = true

In simple terms let’s see an example of a cross tenant subscription :

Let’s assume you have 2 organizations (tenants) called ‘test.com’ and ‘hello.lk’. There’s an API called ‘Cats’ created and published by the admin of tenant ‘test.com’. To make the API visible to the users cross the organizations, he selectcts the option ‘Visible to all the tenants’ from the Subscriptions left menu for the created API and save it.

Now a privileged user of tenant ‘hello.lk’ who logs into the developer portal of the API Manager can see the ‘Cats’ API which was created by a user of ‘test.com’. Further ‘Cats’ API can be subscribed by the user of this new tenant, using a new or existing application, over a selected business plan.

Invoking cross tenant APIs

Each application has a consumer key and a consumer secret pair. When subscribing an API in a cross tenant scenario, the access token is generated using the key manager corresponding to the user of the devportal (API owner). When an API is subscribed over a selected business plan, it can be invoked providing the access token in the request header. The bottleneck here is when you need to subscribe to multiple APIs created by different tenants, different access tokens which are generated using each tenant’s key manager are required.

Image by Rusiri Illesinghe : Access token generation process for cross tenant subscription scenarios

Global Key Manager

The global key manager comes into the picture addressing the issue discussed in the above section. With this, users are entitled to subscribe cross tenant APIs using a single token generated using the Global Key Manager, without generating a token in that specific tenant’s key manager.

Image by Rusiri Illesinghe : Global Key Manager in token generation for cross tenant subscription scenarios

How to use it!

Hope you have enabled cross tenant subscription from the deployment.toml file using the config mentioned in the first section of this article. Also hope you have updated the visibility of the created APIs at API -> Subscriptions page in publisher portal, as to be suitable for cross tenant scenarios.

Now you can create a Global Key Manager, subscribe and invoke the APIs by referring to the steps in [1].

[1] https://apim.docs.wso2.com/en/4.2.0/administer/key-managers/configure-global-key-manager/

See you !