API Manager 1.6.0 - tanancy

Came across a question on API Manager tenancy ...

As per docs [1]
"WSO2 API Manager supports creating multiple tenants and managing APIs in a tenant-isolated manner. When you create multiple tenants in an API Manager deployment, the API Stores of each tenant will be displayed in a muti-tenanted view for all users to browse and permitted users to subscribe to. "

Let's try it and see !!

Step 1 - Create a tenant

• Login to management console - https://localhost:9443/carbon/
• Create a new tenant from Home > Configure > Multitenancy > Add New Tenant - lets say my tenant is yumani.com. 
• Now if you check in API Store, you will see tenant domains there.

When you click on yumani.com above, you will be taken to yumani.com's API store.

Lets try working within a tenant and see;

Step 2 - Create users within the tenant

We need 3 user roles - creator, publisher and subscriber

• Login to management console, using tenant admin's credentials
• Create a new user role from Home > Configure > Users and Roles > Roles
• name - creator
• permissions - as given in [2]
• Create a role for subscriber
• name -subscriber
• permissions - login, Manage -> API ->Subscribe [3]
• Create a role for publisher
• name -publisher
• permissions -login, Manage -> API ->Publish [4]
• Create 3 users and assign them to each role.

Small test - if the permissions are correctly set as per above;

 

-  when you login to publisher (https://localhost:9443/publisher/) from creator's login- you should see an option to add APIs

 

 - When you login from publisher's login, you should not see an option to add APIs. You will only be able to list APIs and publish them.

 

- Finally, you will not have sufficient privileges to login to publisher using subscriber's login. 

Step 3 - Create and publish API

• Login to 'API Publisher' from creator's account and create a new API.

 Step 4 - View the API from store

• Now login to API Store using subscriber's account
• You will see the above API.

Another test: 

- Create another tenant, try login to tenant 1's (yumani.com) store, you are not allowed!

 

- Login to tenan 3's store and see if you see any of tenant 1's APIs. No! because of tenancy.

NOTE: In earlier versions of APIM (APIM-1.4.0), we had a concept of allowing selected tenant's view other tenant's APIs. But it is not available in latest releases.

 

[1] - http://docs.wso2.org/display/AM160/Configuring+Multiple+Tenants 

[2]- http://docs.wso2.org/display/AM160/User+Roles+in+the+API+Manager#UserRolesintheAPIManager-Addingthe creator role
[3] - http://docs.wso2.org/display/AM160/User+Roles+in+the+API+Manager#UserRolesintheAPIManager-Thedefault subscriber role
[4] - http://docs.wso2.org/display/AM160/User+Roles+in+the+API+Manager#UserRolesintheAPIManager-Addingthe publisher role

List of general rules about artifact.xml

Below is a list of general rules which Harshana (WSO2 Tooling guru) mentioned while he was supporting us with customer queries.

1. artifact.xml files in Dev Studio Projects as well as in Composite Application Archive (CAR) files are to manage Artifact metadata. Hence they should not be manipulated manually by users.

2. artifacts list in the artifacts.xml represents the order of artifacts getting deployed in Carbon 4.2.0 based servers including ESB 4.8.0.

3. If there are ESB Message Stores and Message Processors, then Message Stores will be placed before the Message Processors in the artifacts.xml. This process is automatically happens with Dev Studio 3.5.9 version.

4. If you are using Proxy services with Publish WSDL option where the WSDL itself is included in the CAR file in form of Registry Resource or Local entry, that entry need to appear before the Proxy itself because at the time of the Deployment of the proxy, it will use the wsdl pointed as the Publish WSDL.

5. In general the order of the artifacts in artifacts.xml will be Registry Resources, Local entries, Message Stores, Message Processors, other artifact types.

How to remove these UI bundles from worker node

To remove these UI bundles from worker node, you need to run the following command from [PRODUCT_HOME]/bin:

ant createWorker

The ant task createWorker removes the following set of UI bundles:

org.wso2.carbon.*ui_*
org.wso2.carbon.*stub_*
org.wso2.stratos.*ui_*
org.wso2.stratos.*stub_*
org.jaggeryjs.*ui_*
org.jaggeryjs.*stub_*
org.wso2.carbon.ui.menu.*
org.wso2.*styles_*
org.wso2.carbon.authenticator.proxy_*


A situation where this might not work is;

If you have used -DapplyPatches parameter to start ESB node at some point!! If so it will backup the original jar files in [PRODUCT_HOME]/repository/components/plugins to [PRODUCT_HOME]/repository/components/patches/patch0000 folder. In the next server startup these jars will get replaced in [PRODUCT_HOME]/repository/components/plugins. Hence, the UI bundles could appear again. If this is the case, you need to remove the UI bundles (mentioned in above comment) manually from [PRODUCT_HOME]/repository/components/patches/patch0000 folder.

After you install features from UI ..

When you install the features using the WSO2 management console it will copy the relevant jars to repository/components/plugins directory and will update the bundles.info file which is located in CARBON_HOME/repository/components/configuration/org.eclipse.equinox.simpleconfigurator/. There will not be changes to database with regard to this.

How to read properties file from custom UserStoreManager

Scenario : 

You have developed a XUserStoreManager extending an inbuilt userstoremanager implemetation (i.e. ActiveDirectoryUserStoreManager).

You need to read some configuration files from a property file, which you do not want embed in the XUserStoreManager.jar which is deployed in <IS_HOME>/repository/components/dropins

What is the best approach:

1. You can put your custom properties in <IS_HOME>/repository/conf/user-mgt.xml inside your <CustomUserStoreManager> section as below.

<Property name="customProperty">customValue</Property>

2. Put properties withing your CustomUserStoreManager configuration section. Then you can access your properties as below as in [1]

i.e.

String patterns = realmConfig.getUserStoreProperty(LDAPConstants.USER_DN_PATTERN); 

Applicable : WSO2IS-4.6.0

[1] - https://svn.wso2.org/repos/wso2/carbon/kernel/branches/4.0.0/core/org.wso2.carbon.user.core/4.0.2/src/main/java/org/wso2/carbon/user/core/ldap/ReadOnlyLDAPUserStoreManager.java

How to start CEP server without embedded cassandra

In case you need to start the CEP server without embedded Cassandra which makes is light weight CEP. You can do this, by starting the server with -Ddisable.cassandra.server.startup=true switch.

Eg:

 ./wso2server.sh -Ddisable.cassandra.server.startup=true &

useOriginalwsdl

I learnt a practical example on using 'useOriginalwsdl' parameters in an ESB proxy service which has a wsdl associated to it.  Thanks Charitha - as this was by listening to how Charitha approached and handled an ESB issue.

Firstly, there is a proxy service which is associating a wsdl and we were to access an operation in it via soap-ui. This particular wsdl-operation has a soap header specified. Issue being addressed is that the soap header is not appearing in the soap-request that was generated by soap-ui.

What we were doing to generate this request was generating ?wsdl of the proxy and using it in soap-ui.

When analyzing this auto generated wsdl (?wsdl), we found out that some of the parameters in the original wsdl are not appearing in it. This is because at the auto generation process ESB recreates the wsdl treating it as part of the proxy.

But for us to avoid this and have the wsdl syntax as its original we could use the parameter 'useOriginalwsdl'. After this correction, when the ?wsdl was used in soap-ui project we were able to see the correct request.

So when creating a proxy with a wsdl associated, if we need to make sure original wsdl is available for message invocation, we need to set useOriginalwsdl=true.
 

 Just now I read about enablePublishWSDLSafeMode  parameter in ESb proxies from one of Prabath's blog posts. Will write about it after trying the scenario.

Diagnosing if a bundle is not activated properly

Whe OSGI bundles fail to start, we should check the root cause using the OSGI commands.

• Start the server with OSGi console by using ;

sh wso2server.sh -DosgiConsole

• Once osgiConsole get started execute following command and see whether your bundle is in Active state.

osgi> ss

• Execute the following command to see whether there are any unresolved dependencies for this bundle.

osgi> diag <your_bundle_id>

When analyzing Thread Dumps

Thread States

BLOCKED            Thread state for a thread blocked waiting for a monitor lock.

NEW            Thread state for a thread which has not yet started.

RUNNABLE            Thread state for a runnable thread.

TERMINATED            Thread state for a terminated thread.

TIMED_WAITING            Thread state for a waiting thread with a specified waiting time.

WAITING            Thread state for a waiting thread.

Thread LC
http://bip.weizmann.ac.il/course/prog2/tutorial/essential/threads/lifecycle.html

Tool to analyse thread dumps: TDA

Some good guidelines:
http://nirmalfdo.blogspot.com/2013/05/how-to-find-culprit-when-cpu-starts-to.html