WSO2: How admin can generate user access token without user password

Question

I'm trying to implement OTA (one time access) using WSO2 (IS 5.7.0, AM 2.5.0, EI 6.4.0), and I need to find a way to generate user access token.

I have tried:

• using admin service for password recovery. Disadvantage is email template is bound to password reset, but OTA is not a password reset scenario, so using password recovery email template will be spoiled.

• find admin service that generate user access token, but nothing was found

• find WSO2 extension\plugin, but nothing corresponding was found

• using OTP, but met an error like this: https://github.com/wso2/product-is/issues/1860

Answer 1

You can write a custom grant handler, to authenticate user, not via password, but using something he has unique(mobile no, email, etc) as per your requirement and generates an access token from that grant.

You can easily do a token call to WSO2 Identity Server through your custom grant and get the access token.

You can check out for more details in [1]

[1] https://docs.wso2.com/display/IS570/Writing+a+Custom+OAuth+2.0+Grant+Type

Answer 2

Even admins are not allowed to generate tokens for a user without their consent.

For one-time password, this should work. https://docs.wso2.com/display/IS570/Configuring+Email+OTP