Capturing/Decoding messages with JWT using wire logs in WSO2 API Manager 1.7.0

This is intended for the users who have configured WSO2 API Manager 1.7.0 with JWT and wants to see the messages with JWT. If you haven’t configured it, please refer this

1. Enable debug logs for the following loggers in WSO2APIM_HOME/repository/conf/log4j.properties file 

       log4j.category.org.apache.synapse.transport.nhttp.wire=DEBUG

       log4j.category.org.apache.synapse.transport=DEBUG

2. Restart the WSO2 API Manager if already started

3. Access your API and have a look at carbon logs

4. You will get something similar to the following log

[2014-11-30 22:09:22,610] DEBUG - headers http-outgoing-2 >> X-JWT-Assertion: eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6Ik5tSm1PR1V4TXpabFlqTTJaRFJoTlRabFlUQTF
ZemRoWlRSaU9XRTBOV0kyTTJKbU9UYzFaQT09In0=.eyJpc3MiOiJ3c28yLm9yZy9wcm9kdWN0cy
9hbSIsImV4cCI6MTQxNzM2NjQ2MTk5OCwiaHR0cDovL3dzbzIub3JnL2NsYWltcy9zdWJzY3JpYmV
yIjoicmFqa3VtYXIiLCJodHRwOi8vd3NvMi5vcmcvY2xhaW1zL2FwcGxpY2F0aW9uaWQiOiIxIiwiaHR0
cDovL3dzbzIub3JnL2NsYWltcy9hcHBsaWNhdGlvbm5hbWUiOiJEZWZhdWx0QXBwbGljYXRpb24iLC
JodHRwOi8vd3NvMi5vcmcvY2xhaW1zL2FwcGxpY2F0aW9udGllciI6IlVubGltaXRlZCIsImh0dHA6Ly9
3c28yLm9yZy9jbGFpbXMvYXBpY29udGV4dCI6Ii9waG9uZXZlcmlmeSIsImh0dHA6Ly93c28yLm9yZy
9jbGFpbXMvdmVyc2lvbiI6IjEuMC4wIiwiaHR0cDovL3dzbzIub3JnL2NsYWltcy90aWVyIjoiVW5saW1pd
GVkIiwiaHR0cDovL3dzbzIub3JnL2NsYWltcy9rZXl0eXBlIjoiUFJPRFVDVElPTiIsImh0dHA6Ly93c28yL
m9yZy9jbGFpbXMvdXNlcnR5cGUiOiJBUFBMSUNBVElPTiIsImh0dHA6Ly93c28yLm9yZy9jbGFpbX
MvZW5kdXNlciI6InJhamt1bWFyQGNhcmJvbi5zdXBlciIsImh0dHA6Ly93c28yLm9yZy9jbGFpbXMvZ
W5kdXNlclRlbmFudElkIjoiLTEyMzQiLCAiaHR0cDovL3dzbzIub3JnL2NsYWltcy9lbWFpbGFkZHJlc3Mi
OiJyYWprdW1hcnJAd3NvMi5jb20iLCAiaHR0cDovL3dzbzIub3JnL2NsYWltcy9naXZlbm5hbWUiOiJtb2
1vIiwgImh0dHA6Ly93c28yLm9yZy9jbGFpbXMvbGFzdG5hbWUiOiJtb20iLCAiaHR0cDovL3dzbzIub3J
nL2NsYWltcy9yb2xlIjoiSW50ZXJuYWwvc3Vic2NyaWJlcixJbnRlcm5hbC9ldmVyeW9uZSJ9.eczrlpBg3
+38Y90voBIhei3wXMZqZWV5z4q4nSQoUPPlUYXAo6UGmsiwBkT17BivS16K0I69tGwpxKzju/Tg8slT
06bLVmOwIeFtMH86HLh/VPKqnZ0WKgsZw5fFxccIYDgIfnzo8Gg+x9+tL+R2i71e5EOc7098FXZOXH
nlYm0=

5. As you can see, this is the JWT token in encoded format. The above message contains three parts separated by dots. We can decode this message and see what it represents. You can go https://www.base64decode.org/  and decode this message party by part.

6. If you copy paste the first part of the message (blue) into the decoder, you will get something like below

 And that contains JWT headers.

7. If you copy paste the second part of the message (pink), into the decoder, you will get something like below

 
 And that contains JWT claims set.

 8. That’s it. You have decoded and viewed the end user details that have been sent to the back end.

WSO2 Identity Server - How to add users containing special characters?

You can't create users containing special characters like "raj-kumar", "raj.kumar", "raj_kumar" etc. by default in WSO2 IS.

If you try to create users like above, you will the following error.

However, you can configure WSO2 IS to allow what type of characters a username can contain.

In order to allow usernames with special characters you can do the following.

* Open IS_HOME/repository/conf/user-mgt.xml

* Change the value of the property 'UsernameJavaRegEx' in the user store configuration that is applicable as below.

* Restart the server.

* Now you should be able to add users like "raj-kumar", "raj.kumar" and "raj_kumar"

Limitations - Pipe character

The pipe character is used as a special character in WSO2 code base. Still you will be able to create users like "test|user".

But you will end up with several problems as mentioned below.

* Users will be created and populated in LDAP. But when you list the users from IS management console, you will see only the second part of the username. For example, if you create a user "test|user", then you will see only "user" is listed in management console.
 
* You will not be able to delete this user. It will report "Cannot delete user. Error is: Cannot delete user who is not exist".

 
Hence, avoid creating users with pipe character.