Maintaining Logins and Passwords¶
This section covers the following topics:
- Changing the super admin credentials
- Recovering a password
- Login in via multiple user attributes in API Developer-portal
- Setting up an e-mail login
- Setting up a social media login
Changing the super admin credentials¶
Follow the instructions below to change the default admin password:
- Go to
<API-M_HOME>/repository/conf/deployment.tomland change the user credentials as below.
[super_admin] username = "your-name" password = "your-password"
Do you have any special characters in username or passwords?
Above credentials are applied to relevant xml configuration files such as user-mgt.xml.
If you specify passwords inside XML files, you have to be mindful when giving special characters in the user names and passwords. According to XML specification ( https://www.w3.org/TR/xml/#sec-cdata-sect/ ), some special characters can disrupt the configuration. For example, the ampersand character (&) must not appear in the literal form in XML files. It can cause a Java Null Pointer exception. You must wrap it with CDATA as shown below or remove the character:
Above credentials are applied to jndi.properties file.
- It is not possible to use the
@symbol in the username or password.
- It is also not possible to use the percentage (%) sign in the password. When building the connection URL, the URL with credentials is parsed.
This parsing exception happens because the percentage (%) sign acts as the escape character in URL parsing. If the percentage (%) sign in the connection string is required, use the respective encoding character for the percentage (%) sign in the connection string. For example, if you need to pass
adm%inas the password, then the
%symbol should be encoded with its respective URL encoding character. Therefore, you have to send it as
adm%25in. For a list of possible URL parsing patterns, see URL encoding reference. Add the following configuration.
- It is not possible to use the
Therefore, if you have special characters, add the following configurations.
If you have special characters, be mindful to wrap values with CDATA tag in super_admin configurations and to encode values in apim.throttling.jms configurations.
[super_admin] username = "your-name" password = "<![CDATA[your-password]]>" [apim.throttling.jms] username = "your-name" password = "your-encoded-password"
Note that the above password is written to the primary user store when the server starts for the first time. Thereafter, the password will be validated from the primary user store and not from the configuration file. Therefore, if you need to change the admin password stored in the user store, you cannot simply change the credentials as above. To change the super admin password, you must use the Change Password option from the management console.
Recovering a password¶
If you encountered an error similar to
ant: command not found, Please install ant before running the above script
Login in via multiple user attributes in Developer Portal¶
See Authentication using multiple Attributes in the WSO2 IS documentation. Follow those instructions on setting up similarly in API Manager.
Setting up an e-mail login¶
For information, see Email Authentication in the WSO2 IS documentation.
When setting up email login, specify the complete username with tenant domain. If you are in the super tenant mode the username should be as follows.
The "@" character is a reserved character in the WSO2 messaging component. Therefore, when specifying the username in JMS Connection URL, under
apim.throttling.jms.usernamesection in the
<PRODUCT_HOME>/repository/conf/deployment.tomlfile, "@" characters should be replaced by "!" character. An example is shown below.
Setting up a social media login¶
You can auto-provision users based on a social network login by integrating the API Manager with WSO2 Identity Server. Refer Log in to the API Developer Portal using Social Media for more information.
Note that auto-provision users based on a social network login are not supported in a multi-tenant environment.
In a multi-tenant environment, the system cannot identify the tenant domain in the login request that comes to the API Manager's Publisher/Developer portal. Therefore, the service provider is registered as a SaaS application within the super tenant's space. Configuring user provisioning is part of creating the service provider. In order to authenticate the user through a third-party identity provider such as social network login, you must enable identity federation. As the service provider is created in the super tenant's space, the provisioned user is also created within the super tenant's space. As a result, it is not possible to provision the user in the tenant's space.
To overcome this limitation, you can write a custom authenticator to retrieve the tenant domain of the user and write a custom login page where the user can enter the tenant domain, which is then added to the authenticator context. Then, write a custom provisioning handler to provision the user in the tenant domain that is maintained in the context.
- For information on writing a custom authenticator, see Creating Custom Authenticators in the WSO2 IS documentation.
- For information on writing a custom login page, see Customizing Login Pages in the WSO2 IS documentation.