How to setup WSO2 APIM with WSO2 IS and an identity provider?

Question

My question is rather large as I didn't know exactly what to ask, if you have a more specific title don't hesitate to edit.

I'm currently working on a poc where the scenario is the following :

• the end user (bob) wants to access some application (randomApp)
• randomApp calls our apim which will first check that the randomApp is registered onto the store with an access token and has access to the API
• then pass it to the identity server (IS) which will check with the inbound authentication component with for example openID Connect that the randomApp is registered as a service provider and that OAuth key & secret match
• this randomApp has some federated authentication declared in the local & outbound auth component to redirect it to an openID Connect (OIC) server where bob will actually authenticate to access the ressource
• the OIC server is declared as an identity provider with some credentials from the OIC server, all the URL from the OIC server are declared auth, token and callback endpoint.
• bob authenticate correctly, the info is then passed back to the IS which give it to the SP who can finally call the API and display bob's information.

Is this scenario conceivable ? I'm having a hard time grasping every single interaction between all the components. Let me know if some steps are not necessary, overkill or else. I've been playing around with the playground from wso2 but I'm not sure that it depicts exactly the scenario I want.

To summarize : end user -> service provider -> wso2 identity server -> OIC server and go back the other way. What would be the best "setup" for this ?

Answer 1

I hope the article use-cases-of-utilizing-saml-with-wso2-api-manager will be useful for your requirement. In this article, the flows are explained with SAML protocol. You can use the same functionality with OIDC as well.