WSO2 API Manager 1.10.0 - API Lifecycle management based on user roles

WSO2 API manager user tasks can be categorized under three main  user roles. They are creator, publisher and subscriber. See Adding User Roles section in the product document for more information. Users with the creator and publisher roles can log in to the API manager publisher application and work on the API creation and management. 

Users with publisher permissions can change the lifecycle states of an api. He can deprecate the api, or block the api or even retire the api. From API Manager 1.10 onward, user can limit this capability and assign their own roles for this lifecycle state management. This way if someone does not want a user with only publisher permission to block an api, he can do it with API Manager 1.10.0 easily using the Custom Lifecycle Inclusion feature.

Scenario

The owner of the api does not want to give every one the permission to put his API in to Blocked state. He wants to assign it to a separate group. 

Steps:

1. Create a new role. 

See Adding User Roles. Here I create a new role "blockrole" for this scenario. You can assign any permission for this. I'll keep that empty since the grouping is done based on the role name.

2. Modify the existing lifecycle.  

For that Log in to API manager management console (https://localhost:9443/carbon) and navigate to 

Home

> Extensions

> Configure

> Lifecycles section and edit 'APILifeCycle' resource. See Extending the API Life Cycle

Update the 'Published' state with the following

      <state id="Published">

              <datamodel>

                  <data name="transitionExecution">

                      <execution forEvent="Block"

                                       class="org.wso2.carbon.apimgt.impl.executors.APIExecutor">

                      </execution>

                      <execution forEvent="Deprecate"

                                       class="org.wso2.carbon.apimgt.impl.executors.APIExecutor">

                      </execution>

                      <execution forEvent="Demote to Created"

                                       class="org.wso2.carbon.apimgt.impl.executors.APIExecutor">

                      </execution>

                      <execution forEvent="Deploy as a Prototype"

                                       class="org.wso2.carbon.apimgt.impl.executors.APIExecutor">

                      </execution>

                  </data>

                        

                  <data name="transitionPermission">

                     <permission forEvent="Block" roles="blockrole" />

                  </data>

              </datamodel>

              <transition event="Block" target="Blocked"/>

              <transition event="Deploy as a Prototype" target="Prototyped"/>

              <transition event="Demote to Created" target="Created"/>

              <transition event="Deprecate" target="Deprecated"/>

              <transition event="Publish" target="Published"/>

       </state>

Note the newly added data element "transitionPermission" . The newly created role "blockrole" is assign for the event "Block".  

      <data name="transitionPermission">

          <permission forEvent="Block" roles="blockrole" />

      </data>

Test

Now log in to the API manager publisher (I will use the default admin user for this.)  and publish an api. Then go to the Overview section of the api and select the 'Lifecycle' tab and you will notice that the "Block" Operation is not there anymore.

The reason for this is the user admin does not have the role "blockrole". Now Log in the the Management console and assign the role "blockrole" to the admin user refresh the Lifecycle tab in the API manager publisher. You will notice the "Block" button in the tab.

You can extend this feature to provide different roles for different API Lifecycle states.

WSO2 API Manager 1.10.0 - Introducing a custom Lifecycle to an API

WSO2 API Manager 1.10.0 comes with many new features. One of them is the facility to attach custom lifecycle to an API. API manager before 1.10 had only CREATED, PUBLISHED , DEPRECATED, RETIRED , BLOCKED, PROTOTYPED states for an api. With the new version, user can attach more states to an api.

WSO2 api manager uses WSO2 Governance registry Lifecycle features to implement this.  You can get more information about this from the Extending the API Life Cycle section in WSO2 api manager documentation

I'll use this feature to implement a scenario where user sends a notification about  a state change of an api.  this will implement a scenario where user sends an email notification to the business owner of the api when he retires the api.

Main steps:

1. Create a custom executor to handle the custom state change.

When creating a custom executor you have to use org.wso2.carbon.governance.registry.extensions.interfaces.Execution interface for the implementation and implement execute()method


import java.util.Map;
import org.wso2.carbon.governance.registry.extensions.interfaces.Execution;
import org.wso2.carbon.registry.core.jdbc.handlers.RequestContext;

public class CustomExecutor implements Execution {

    String param;

    @Override
    public boolean execute(RequestContext context, String currentState, String targetState) {
        if(something){
            return true;
        } else {
            return false;
        }
    }

    @Override
    public void init(Map arg) {
     param = (String) arg.get("param");

    }
}

For this scenario I created an executor to send email. See MailExecutor.java. You can pass parameters to the executor through the lifecycle.  Refere following property definition in the lifecycle on how this is done (In the next section)

<parameter name="emailUsername" value="xxxxxxxxxx" />

<parameter name="emailPassword" value="xxxxxxxxxx" />

I followed http://crunchify.com/java-mailapi-example-send-an-email-via-gmail-smtp/ when creating the email sender. 

If you are interested in how the default executor works you can refere source code for the default executor org.wso2.carbon.apimgt.impl.executors.APIExecutor in here. 

Once you created the custom executor, build .jar and deploy it in the wso2am-1.10.0/repository/components/lib location. 

I attached the sample custom-executor.zip for the reference

2. Create a custom lifecycle and deploy it.

First log in to Carbon management console and update the lifecycle configuration. Please refer  Extending the API Life Cycle on how to access that resource.

For this I use the default lifecycle and removed the "Deprecated" section and add the following section. Full lifecycle xml can be found in here

   <state id="Deprecated">
        <datamodel>
            <data name="transitionExecution">
                <execution forEvent="Notify Business Owner" class="org.wso2.carbon.apimgt.MailExecutor">
                    <parameter name="emailUsername" value="xxxxxxxxxx" />
                    <parameter name="emailPassword" value="xxxxxxxxxx" />
                </execution>
            </data>
        </datamodel>
        <transition event="Notify Business Owner" target="Notified"/>
    </state>
    <state id="Notified">
        <datamodel>
            <data name="transitionExecution">
                <execution forEvent="Retire"
                                       class="org.wso2.carbon.apimgt.impl.executors.APIExecutor"></execution>
            </data>
        </datamodel>
        <transition event="Retire" target="Retired"/>
    </state>

Note that I have used org.wso2.carbon.apimgt.MailExecutor instead of the default executor org.wso2.carbon.apimgt.impl.executors.APIExecutor  and passed the username password parameters in the <execution> section.

Provide valid email username and a password for this property

<parameter name="emailUsername" value="xxxxxxxxxx" />

<parameter name="emailPassword" value="xxxxxxxxxx" />

In this Lifecycle we have introduced a new state "Notified" and provided a transition event "Notify Business Owner" in the Deprecated state.

<transition event="Notify Business Owner" target="Notified"/>

Once user in the Deprecated state, a button will be displayed with the label Notify Business Owner to change the state to Notified

Note: add following entry to the wso2am-1.10.0/repository/deployment/server/jaggeryapps/publisher/site/conf/locales/jaggery/locale_default.json file. The key element is in the lower case. 

 "notify business owner" : "Notify Business Owner"

Test

The scenario is based on sending an email to the business owner of that api regarding API deprecation.

1. Create an API . See Create and Publish an API in the product documentation for more details.
2. Go to the Manage section in the publisher application and fill the Business Information section and save it. business owner email address is used to send the notification.



3. Go to the Overview section of the api and select the lifecycle tab. If you have published the api, It would show a "Deprecate" button. Select it and it would navigate to the newly created state.



Once you click this, User defined as the business owner would get an email

Enable CORS on WSO2 Data Services Server (DSS)

CORS enable/disable feature does not come as an out of the box feature from WSO2 DSS. But this can be achieve by adding a cors filter. We can use the method described in cors filter installation document in DSS as well because DSS uses a tomcat server.

Step 1 : add necessary libraries to DSS

Download and copy cors-filter-2.4.jar and java-property-utils-1.9.1.jar files to the <dss_home>/repository/components/lib folder. Latest libraries can be found in this site.

Step 2 : Add CORS configuration to tomcat web.xml

Open  <dss_home>/repository/conf/tomcat/web.xml file and add CORS Filter declaration and mapping.

<filter>
   <filter-name>CORS</filter-name>
   <filter-class>com.thetransactioncompany.cors.CORSFilter</filter-class>
</filter>

<filter-mapping>
   <filter-name>CORS</filter-name>
   <url-pattern>/*</url-pattern>
</filter-mapping>

Step 3 : Restart the server

Customizing API Manager – Adding Workflow Extension

API Manager comes with capability to add custom workflows to user signup, application creation, registration and subscription. By default API manager comes with two workflows. Simple Workflow Executor and WS Workflow Executor. Simple workflow executor is the simplest one and it is enabled by default and it executes the default flow.

In WSO2 API Manager documentation, you will find a post regarding creating a custom workflow. In this post I’ll try to show in more details how this workflow process happens. Once you understand the process you could use this feature much more effectively in your own environment.

Workflows can be used to add extra steps in to the processes like self signup, application creation, etc. For example we can use a workflow for user self signup in the store and add extra steps to approve this user before giving him the permission to access the store. (the default process just create the user and grant him the rights to access the store). WS Workflow Executor has implemented this feature. The sample executor in the api manager documentation sends an email during the workflow. So we can do whatever we want. At the moment workflows can be used for only user signup, application creation, registration and subscription.

Following image describes the steps. Knowing the steps would make it easier to implement a custom workflow

When an action occurs (ex user signup, etc) API manager selects the executor to execute for that action. This is defined in the registry workflow-extension.xml file (refer https://docs.wso2.com/display/AM180/Adding+Workflow+Extensions)

Then it execute the execute() method first (please refer to the code example in https://docs.wso2.com/display/AM180/Customizing+a+Workflow+Extension). This method is called by the previous mentioned action. WorkflowDTO object is passed to this method which contains a unique reference id for that workflow (externalWorkflowReference) this reference needs to be there all the time to complete the execution.
All the custom executors should extend the base class WorkflowExecutor.
By calling the parent execute() method, an entry related to this workflow is added to the database with 'Created' as the status.
super.execute(workflowDTO);

Inside this method we could do our additional work. (sending email, etc). WS Workflow Executor which comes with API manager as one of the default executors sends a request to external business process server (WSO2 BPS) for an approval process.

We can also call the complete() method from the execute() method. This way we can finish the workflow from there (Simple Workflow Executor and the sample executor in the documentation use this method).

NOTE: some processes need to change their states in the complete stage. For example in application creation workflow you have to set the status of that application to ‘REJECTED’ or APPROVED in the complete() method (before the execute() method the application state is in ON_HOLD ).

Do not forget to call parent method at the end of the complete method
super.complete(workflowDTO);
API manager has deployed a web service to handle the situations where we call external applications (step 2 and 3). A web service'WorkflowCallbackService' is hosted to accept external requests related to workflows and call the complete() method.

The service endpoint is http://127.0.0.1:8280/services/WorkflowCallbackService and the wsdl file can be viewed using http://127.0.0.1:8280/services/WorkflowCallbackService?wsdl

The reference id I mentioned in the execute() method needs to be sent as workflowReference and status should be APPROVED, REJECTED or REGISTERED

WS Workflow Executor

WS Workflow Executor is one of the default executors in API manager. This can be used to add an approval/rejection process. WSO2 Busines Process Server is used as an external server to handle the approval process. The process is defined in BPL and deployed in WSO2 BPS. Following is the overall picture of how it is used. You could understand it with the previous information

Customizing API Manager – Adding custom handlers

API Manager comes with a built in ESB. It acts as the gateway and handles all the api calls. API creator can manipulate the requests before they are sent back to the actual back end by configuring the api gateway. Handlers can be used to achieve this task.

There are some default handlers added to an api once it is created. To check this first create and publish an api by login in to API manager publisher and then go to the <AM_HOME>/repository/deployment/server/synapse-configs/default/api location. If the api is created successfully, there will be an xml file with the name of the api in this location (creator_name_version.xmlwould be the exact name ). Under the <hanlders> element, all the default handlers are defined. These handlers execute (in the order) first once a request hits the api before sending it to the back end.

These handlers handle different tasks related to the api call. First handler handles the authentication part of the request. For example, to call an published api, we need to use an access token ( adding it to the Authorization header of the request). APIAuthenticationHandler handler is used to validate the token and reject invalid requests.

Adding a custom handler to an existing api

api creator may need to add his own processing. (for example validate some other headers) . He can develop a custom handler and plug it in to the api. Tutorial on creating a custom handler can be found in the Api manager documentation. After creating the handler, put it in to the<AM_HOME>/repository/components/lib folder and insert an entry inside the <handlers> element

<handler class="org.wso2.customhandlers.testhandler"/>

Note: To build the custom handler you need the have the synapse libraries in the class path. You can point to<AM_HOME>/repository/components/plugins folder for this.

Adding a custom handler to all the apis.

If this handler needs to be added to every new api, then it is not practical to add it manually once the api is created. API manager provides templates to define the structure of the api and we can modify this to have the custom handler as a default handler. This way every api will have the custom handler inside the<handlers> element

For this we need to modify the velocity_template.xml file in the<AM_HOME>/repository/resources/api_templates/ location. Open it and find the location '<handlers>'

Add the custom handler inside the <handlers> element after the #end tag. This will add the custom handler after the default handlers.

Self signup for tenants – API manager 1.8

Api manager comes with user signup feature for user store by accessing API store application. One limitation  in Api Manager 1.7 was that users were able to  signup only to super user’s API store. Tenant users were added through the management console. Api Manager 1.8 comes with the self signup feature for tenant store as well.

To enable self signup in AM 1.7, admin has to modify following configuration in the api-manager.xml file in <AM_HOME>/repository/conf

This is removed from api-manager.xml configuration file and moved to registry location. For each tenant doman there is a sign-up-config.xml configuration file. Tenant admin can log in to the management console and edit this configuration. This way each tenant domain can have different configurations for self signup.

The configuration file related to self signup in Api Manager 1.8. this can be found in the ‘/_system/governance/apimgt/applicationdata/sign-up-config.xml‘ registry location. Login to http://localhost:9443/carbon by using tenant admin credentials

following is the configuration file

To enable self signup for tenant API store <EnableSingup> element needs to be ‘true’. Otherwise the self signup option would not be visible in the tenant store. This is ‘true’ by default for super tenant.

AM 1.8 provides option to set the user storage to store these users.<SignUpDomain> defines this. PRIMARY refers to the primary user store. This can be pointed to secondary user store as well. More on creating user stores can be found in API manager documentation related to configuring secondary user stores . The Domain name used for that user store can be used in <SignUpDomain>

<SignUpRoles> defines the roles that are assigned to the users. AM 1.8 provides facility to assign more than one role for the user by adding <SignUpRole> element inside the <SignUpRoles> element.

NOTE: These roles are not created automatically so these roles needed to be created by the admin user. See more on how to create user roles and assigning permission.

IMPORTANT: At least one role has to have ‘subscriber’ permission. Otherwise user won’t be able to login to the tenant store.

After configuring this, you will be able to see the self signup button in the tenant API store

This feature can be extended by enabling user signup in workflow extension . This will enable an approval process for newly Signed up users. More information on this can be found in Api Manager documentation

Optimize the OS to handle large number of concurrent requests

Theoretically Node.js can handle huge number of concurrent requests without blocking the application. This means server created using Node.js can handle concurrent requests without any problem unlike thread based server applications such as Apache servers.

I had to create a server application using Node.js to handle high level of concurrent requests. During the testing for higher level of concurrency one error I got was connect EMFILE . 

This error means that the OS is not allowing your program to open more files or sockets. So to handle higher levels of requests, you need to optimize the OS. We can do this by changeing the maximum number of files that can be open. To check the current limit in Linux system type

ulimit -n

For a Linux based system, this can be done using following instructions

One method is reset the limit for your current shell. This can be done easily by typing ulimit -n 4096. 4096 is the new maximum limit

The other way is by editing /etc/security/limits.conf file. open it using your favorite editor.

sudo gedit /etc/security/limits.conf

Add following two lines before the end of file

* soft nofile 4096

* hard nofile 65535

soft limit is the current value. Hard limit is the maximum limit. The soft value cannot exceed the hard value.Then logout and re login to your system. you can check the limit by  ulimit -n