Configure External IdP for APIM Publisher & Devportal (WSO2 APIM 4.6.0)

If your users already exist in another Identity Provider (IdP), or you prefer not to store user credentials inside API Manager, you can integrate an external IdP with WSO2 API Manager. This guide shows how to configure an external IdP (example: Asgardeo) for the Publisher Portal and Developer Portal using WSO2 APIM 4.6.0.

Prerequisites

• WSO2 API Manager 4.6.0 downloaded with JDK 21 installed.
• External IdP application created (e.g., Asgardeo)
• Client ID and Client Secret available

Step 1 — Start API Manager

Navigate to the bin directory and start the server:

cd <APIM_HOME>\bin
./api-manager.bat

Wait until the server fully starts (Might take around 10 minutes).

Step 2 — Access the Carbon Management Portal

Open your browser and go to:

https://localhost:9443/carbon

Login using the super admin credentials (default: admin/admin unless changed).

Step 3 — Create the Identity Provider

In the Carbon portal:

1. Go to Main → Identity → Identity Providers
2. Click Add
3. Go to the Basic Information section

4. Enter a name (e.g., Asgardeo-IdP)

5. In Add the Identity Provider’s JWKS Endpoint

https://api.asgardeo.io/t/{{org_name}}/oauth2/jwks

6. Alias should be added in the field automatically, if not add it

https://localhost:9443/oauth2/token

7. Add the Identity Provider Issuer name

https://api.asgardeo.io/t/{{org_name}}/oauth2/token

8. Then go to Basic Claim Configuration section in Claim Configuration section.

9. Tick Define Custom Claim Dialect and click Add Claim Mapping. And add the roles you want.

10. And add the User ID Claim URI and Role Claim URIs.

11. Go to Role configuration and add the role mappings there.

11. Go to the OAuth/OpenID Connect Configuration sub section from the Federated Authenticators section.

12. Add the below configurations

Client ID : 
{{your_asgardeo_client_id}}

Client Secret : 
{{your_asgardeo_client_secret}}

Authorization Endpoint URL : 
https://api.asgardeo.io/t/{{org_name}}/oauth2/authorize

Token Endpoint URL :
https://api.asgardeo.io/t/{{org_name}}/oauth2/token

UserInfo Endpoint URL :
https://api.asgardeo.io/t/{{org_name}}/oauth2/userinfo

Logout Endpoint URL :
https://api.asgardeo.io/t/{{org_name}}/oidc/logout

Callback URL :
https://localhost:9443/commonauth

Scopes :
openid profile email groups

13. In the Just-In-Time provisioning

14. After that Click Register

Step 4 — Enable the IdP for APIM Portals

Next, associate the IdP with the service provider used by APIM.

For Developer Portal

1. Go to Main → Identity → Service Providers
2. Find: apim_devportal

3. If apim_devportal doesn’t exist as a service provider, click Add button in the Service Provider section.

4. Tick Manual configuration mode and add the service provider name.

5. Click Register

6. After that you can see the list of Service Providers. In that list, click the edit icon.

7. Go to the OAuth/OpenID Connect Configuration subsection from the Inbound Authentication Configuration section.

8. Click Configure.

Callback URL : 
regexp=(https://localhost:9443/devportal/services/auth/callback/login|https://localhost:9443/devportal/services/auth/callback/logout)

10. Go to the Local & Outbound Authentication Configuration section and follow the screenshot

For Publisher Portal

Do the same changes you did to devportal But for the callback URL add this. Most probably this might be already filled in.

Callback URL:
regexp=(https://localhost:9443/publisher/services/auth/callback/login|https://localhost:9443/publisher/services/auth/callback/logout)

Test the Login Flow

Now test both portals:

Developer Portal
https://localhost:9443/devportal

Publisher Portal
https://localhost:9443/publisher

You should be redirected to the external IdP login page.