Need a way to update Console's Callback & Allowed Origins

[brionmario]

Is your suggestion related to an experience ? Please describe.

ATM, the API restricts any updates to the api/server/v1/applications/<ID>/inbound-protocols/oidc endpoint with PUT operations for Console application since it's treated as a system application by default.

Describe the improvement

We need to allow this since it's needed if a user wants to externalize the Console.

Proposed UI

Additional context

A similar improvement was done to allow the update of Authentication Sequence of Console. (https://github.com/wso2/identity-api-server/pull/536/files)

[brionmario]

@UdeshAthukorala FE PR is merged: wso2/identity-apps#4842

And the tab is disabled. Please enable after BE PRs are merged.

[malithie]

There's no requirement to externalize the console in Identity Server perspective.
Which actually means this doesn't need to come to the UI. Ideally, it's a deployment.toml level config or "Server" level config.

This requirement is there for Asgardeo. So treat this as a blocker to get IS RC deployed on Asgardeo.

FYI: @darshanasbg @thanujalk

[malithie]

Changing the priority level as this is a blocker for Asgardeo

[brionmario]

The UI implementation is already merged to the Console and is hidden from the UI for now until the API is merged.

@malithie Should we keep it hidden and document to use the API for updating these URLs?

[malithie]

Is this a tenat wide config ? Is that why we have an API ?
Or this API is not tenant level but server level ?

[UdeshAthukorala]

Is this a tenat wide config ? Is that why we have an API ? Or this API is not tenant level but server level ?

Hi @malithie ,

With this improvement we can change console application's callBack URLs and allowed origins, from this updateInboundOAuthConfiguration API[1]. Since this is a tenanted API we can change it tenant wise.

[1] https://is.docs.wso2.com/en/latest/apis/application-rest-api/#/Inbound%20Protocols%20-%20OAuth%20%2F%20OIDC/updateInboundOAuthConfiguration

[UdeshAthukorala]

@brionmario BE PRs are merged.

[malithie]

IMO, this is a server level requirement. Externalizing the console is not a requirement from the Identity Server perspective but from Asgardeo perspective.
And there's no requirement anyway to have this tenant wise.
@darshanasbg what's your view on this

[darshanasbg]

IMO, this is a server level requirement. Externalizing the console is not a requirement from the Identity Server perspective but from Asgardeo perspective. And there's no requirement anyway to have this tenant wise. @darshanasbg what's your view on this

Yes, externalizing the console, don't needed to be a tenant wise option. Having server level config should be enough.

[UdeshAthukorala]

Hi all,
Previous Tenant wise api improvement to upodate console application's callbaclk urls & allowed orgins willl be reverted with the below PRs.

• Revert "Allow to update console's callback urls & allowed origins" identity-api-server#556
• Revert "Allow to update system apps for set of scenarios" identity-apps#5015

[UdeshAthukorala]

After having a further discussions with the team we have decided to introduce a new toml config as a server level to update console & myacount callback urls.

For update allowed orgins we can use the existing cors configuration toml config. SO no need to have a seperate improvement for this.

[UdeshAthukorala]

This will be fixed with:

• Introduce a config to update console & myaccount callback url & access url carbon-identity-framework#5304
• Resolve console & myaccount callback urls based on a toml config wso2-extensions/identity-inbound-auth-oauth#2301

[UdeshAthukorala]

• Introduced a toml config to update console & myaccount callback url & access urls

  New Toml Configs

  [console]
  callback_url = "https://localhost:9001/t/{TENANT_DOMAIN}/console"
  access_url = "https://localhost:9001/t/{TENANT_DOMAIN}/console"
  
  [myaccount]
  callback_url = "https://localhost:9000/t/{TENANT_DOMAIN}/myaccount"
  access_url = "https://localhost:9000/t/{TENANT_DOMAIN}/myaccount"