Subscription validation issue in the APIM-3.2.0 with IS-5.10.0 as an external Key Manager

wso2 / product-apim

Welcome to the WSO2 API Manager source code! For info on working with the WSO2 API Manager repository and contributing code, click the link below.

http://wso2.github.io/

Apache License 2.0

851 stars 787 forks source link

Subscription validation issue in the APIM-3.2.0 with IS-5.10.0 as an external Key Manager #9599

Open sanethmaduranga opened 3 years ago

sanethmaduranga commented 3 years ago

Description:

Subscription validation is not effecting when configuring the APIM-3.2.0 with IS-5.10.0 as an external Key Manager while configuring the token validation method as 'Use introspect'.

Steps to reproduce:

Follow the steps mentioned in the documentation[1] to configure the IS-5.10.0 as an external Key Manager.
Select the token validation method as 'Use introspect'.
Create an API and Application.
Generate a token for the application by selecting the configured IS-5.10.0 as the Key-Manager.
Invoke the API using the same newly generated token without subscribing to the Application.
It will be a successful invocation.

[1] - https://apim.docs.wso2.com/en/latest/administer/key-managers/configure-wso2is-connector/

Affected Product Version: APIM-3.2.0

sanethmaduranga commented 3 years ago

The substription validation status(value of the 'status' object) is dependent on the 'infoDTO' object as per the return statement[1] of the 'validateSubscriptionDetails' method.
However, as per the flow inside the 'validateSubscriptionDetails' method[2], the 'api', 'app' and 'key' objects are loaded with values from the 'datastore' while the 'sub' object retains as null, even though as per the line[3] it tries to populate values for the 'sub' object.
Ultimately, the subscription validation status remains as the original authorization status of 'true'(original value returns from the 'TokenValidationContext')[4] even after going through the flows of the 'AbstractKeyValidationHandler.java' class, as per this flow.

[1] - https://github.com/wso2-support/carbon-apimgt/blob/support-6.7.206/components/apimgt/org.wso2.carbon.apimgt.keymgt/src/main/java/org/wso2/carbon/apimgt/keymgt/handlers/AbstractKeyValidationHandler.java#L200 [2] - https://github.com/wso2-support/carbon-apimgt/blob/support-6.7.206/components/apimgt/org.wso2.carbon.apimgt.keymgt/src/main/java/org/wso2/carbon/apimgt/keymgt/handlers/AbstractKeyValidationHandler.java#L203 [3] - https://github.com/wso2-support/carbon-apimgt/blob/support-6.7.206/components/apimgt/org.wso2.carbon.apimgt.keymgt/src/main/java/org/wso2/carbon/apimgt/keymgt/handlers/AbstractKeyValidationHandler.java#L239 [4] - https://github.com/wso2-support/carbon-apimgt/blob/support-6.7.206/components/apimgt/org.wso2.carbon.apimgt.keymgt/src/main/java/org/wso2/carbon/apimgt/keymgt/handlers/AbstractKeyValidationHandler.java#L55