Support tenancy sharing with WSO2 Identity Server as Key Manager

[tgtshanika]

Business Problem

Problem
From 7.x versions onwards, WSO2 Identity Server does not support tenancy sharing as it only configured as external Key Manager without DB sharing. Hence, the users who use both products in a single deployment have to manage tenancy in both products independently, which leads to a bad user experience.

Suggested Improvement

Solution
Tenant sync between API Manager and Identity server.

Version

No response

[RusJaI]

2025 -05-19

Had the initial discussion on the feature

Notes :
Tenant management APIs
For tenant management, use REST API from IS and ADMIN SOAP API from APIM
No need of bringing tenant management REST API to APIM (let’s use as is)
Keep reserved admin users for the communication
(password in optional for IS REST API since inline/email based authentication)
Create tenant in IS -> HTTP call to create the tenant in APIM (dont need the tenant pw)
Create tenant in APIM -> HTTP call to create the tenant in IS
DCR call to create SP app
How to get the tenant credentials ? send password reset email from IS (to log into IS console and change pw) or password update event from IS listener.
In case of a failure at syncing the tenants, to the other side, there should be a rollback.
Have to implement this rollback logic for both IS and APIM.

Action items :
Check how authentication happens for DCR call
Check if tenant mgt API supports MTLS

[RusJaI]

2025 -05-22

A meeting was held with IS team to clarify some points related to this. Furthermore, as per the documentation of IS, there was a config to be added and a mention about user validation. When trying out with the config enabled it required a cert which CN= and the same user to be reside in IS side.

Notes :
The IS team clarified that their Events feature does not support triggering exclusively for tenant creation events. Therefore, only the kernel-level tenant management listener can be used to capture tenant creation events. However, this listener is invoked for tenant, organization, and sub-organization creation events alike, making it difficult to distinguish between them. To specifically identify tenant creation events, the IS team suggested utilizing an existing API available on their side.

Since the authentication challenge affects not just the DCR flow but several other scenarios (introspection, resource registration for scopes) as well, the APIM team is exploring a broader, more sustainable authentication mechanism, with a particular focus on revamping the current MTLS (Mutual TLS) approach.

As per the doc, One key issue with the current MTLS implementation in a multi-tenant context is the requirement for a client certificate with CN = . The corresponding user must also exist in IS, and the certificate must be trusted by the IS. This per-tenant certificate generation is not scalable. As such, the concern was raised, and the IS team was asked whether a configuration option could be introduced to disable user-based certificate validation, especially since this is not enforced by the MTLS specification.

Action items :
IS team to explore the possibility of introducing a configuration option to disable user verification in MTLS.
APIM team to initiate an email thread sumarizing the above discussion and follow up with the IS team.

[RusJaI]

2025-05-28

Initiated the email " [Architecture] [APIM] Supporting Tenant Synchronization Between API Manager and IS7"

Did research on possible authentication approaches for each API call involved and and clarified the possibility of using MTLS going through the implementation of IS.

Had a meeting within the APIM team to discuss the findings and make related decisions. The following are the meeting notes:
https://docs.google.com/document/d/1-OnJu_VmOcAfP7wBpzlL3eG5HnmZm1AR4m2lueRIVJs/edit?usp=sharing

[RusJaI]

2025-05-30

Research on the follow up topics from prev discussion.
Documented the user stories and discussed the issues identified