It is not recommended to share user registries with multiple portal sites and this is precisely why.

Create a separate user registry for each portal site, even if each user registry points at the same backend authentication provider (eg same oidc server).

If the user already exists in the user registry then obviously register is not going to work twice. They should be able to create a new consumer org though in the second site. If I remember right if they try to login the portal will lock down most features but the create a consumer org option in the user menu top right should still be available.

or you can add them to a consumerorg from api manager.

But basically this setup is a pretty bad idea and is explicitly documented as something to avoid in the documentation.

thank you Chris. Yes we will follow this but we wont enable creation of Consumer org by them self. During Signup only they can create or Admin creating via apim.

but I am not able to understand what is difference between sharing vs having separate registry when both points to same backend server. Could you please elaborate more on this. maybe I am not following how internally developer works with unique email address.

It is not recommended to share user registries with multiple portal sites and this is precisely why.

Create a separate user registry for each portal site, even if each user registry points at the same backend authentication provider (eg same oidc server).

If the user already exists in the user registry then obviously register is not going to work twice. They should be able to create a new consumer org though in the second site. If I remember right if they try to login the portal will lock down most features but the create a consumer org option in the user menu top right should still be available.

or you can add them to a consumerorg from api manager.

But basically this setup is a pretty bad idea and is explicitly documented as something to avoid in the documentation.

The issue isnt where the backend server is, its what the UR is used for.

When you create an account for a given scope it creates a record in that user registry (UR). It wont contain a password or anything like that, since the authentication is being done externally, but we still need to have a user record to associate membership to. If you share that user registry across other scopes then various processes might not work how you might expect them. For example you can't create a new account since one already exists, but it might not have access since it was never explicitly added to this scope. There are a whole variety of flows where "quirks" can be seen.

There is no downside to having multiple user registries in api manager - it just means a table of user records specific to this scope which then allows you to more precisely manage access to that scope. Thats why it is documented best practice not to share user registries across scopes.

Hope that helps

thank you Chris. Yes we will follow this but we wont enable creation of Consumer org by them self. During Signup only they can create or Admin creating via apim.

but I am not able to understand what is difference between sharing vs having separate registry when both points to same backend server. Could you please elaborate more on this. maybe I am not following how internally developer works with unique email address.

It is not recommended to share user registries with multiple portal sites and this is precisely why.

Create a separate user registry for each portal site, even if each user registry points at the same backend authentication provider (eg same oidc server).

If the user already exists in the user registry then obviously register is not going to work twice. They should be able to create a new consumer org though in the second site. If I remember right if they try to login the portal will lock down most features but the create a consumer org option in the user menu top right should still be available.

or you can add them to a consumerorg from api manager.

But basically this setup is a pretty bad idea and is explicitly documented as something to avoid in the documentation.

but in the case of signup connects to some external registry LDAP , user will do sign up only on one catalog and even if user tries the signup will fail as user already exists on that external LDAP.

Lets say if different registry per catalog which connects to same backend LDAP server . during this time also user can do signup in one catalog only? because if user tries to do signup then it will fail saying user already exists on that external LDAP?

So are you saying even signup connected to external registry, there is user table that gets created internally ? if yes is it during sign up ?

when shared , once user is part of consumer org , he can login to another catalog.

The issue isnt where the backend server is, its what the UR is used for.

When you create an account for a given scope it creates a record in that user registry (UR). It wont contain a password or anything like that, since the authentication is being done externally, but we still need to have a user record to associate membership to. If you share that user registry across other scopes then various processes might not work how you might expect them. For example you can't create a new account since one already exists, but it might not have access since it was never explicitly added to this scope. There are a whole variety of flows where "quirks" can be seen.

There is no downside to having multiple user registries in api manager - it just means a table of user records specific to this scope which then allows you to more precisely manage access to that scope. Thats why it is documented best practice not to share user registries across scopes.

Hope that helps

thank you Chris. Yes we will follow this but we wont enable creation of Consumer org by them self. During Signup only they can create or Admin creating via apim.

but I am not able to understand what is difference between sharing vs having separate registry when both points to same backend server. Could you please elaborate more on this. maybe I am not following how internally developer works with unique email address.

It is not recommended to share user registries with multiple portal sites and this is precisely why.

Create a separate user registry for each portal site, even if each user registry points at the same backend authentication provider (eg same oidc server).

If the user already exists in the user registry then obviously register is not going to work twice. They should be able to create a new consumer org though in the second site. If I remember right if they try to login the portal will lock down most features but the create a consumer org option in the user menu top right should still be available.

or you can add them to a consumerorg from api manager.

But basically this setup is a pretty bad idea and is explicitly documented as something to avoid in the documentation.

I think you might be confusing the user registry in API Manager and the external authentication provider.

It is very rare to be using a writable LDAP server, so when someone clicks register account, it is creating an account in the apim user registry having authenticated against an existing set of credentials in the external LDAP server. It is not normally creating an account in the LDAP server since the use of writable LDAP is pretty rare.

Are you actually using writable LDAP ?

------------------------------
Chris Dudley
------------------------------


Original Message:
Sent: Wed April 03, 2024 07:46 AM
From: Syed Imtiyaz Alam
Subject: Multiple Catalog with single registry

but in the case of signup connects to some external registry LDAP , user will do sign up only on one catalog and even if user tries the signup will fail as user already exists on that external LDAP.

Lets say if different registry per catalog which connects to same backend LDAP server . during this time also user can do signup in one catalog only? because if user tries to do signup then it will fail saying user already exists on that external LDAP?

So are you saying even signup connected to external registry, there is user table that gets created internally ? if yes is it during sign up ?

when shared , once user is part of consumer org , he can login to another catalog.

------------------------------
Syed Imtiyaz Alam


Original Message:
Sent: Wed March 27, 2024 09:43 AM
From: Chris Dudley
Subject: Multiple Catalog with single registry

The issue isnt where the backend server is, its what the UR is used for.

When you create an account for a given scope it creates a record in that user registry (UR). It wont contain a password or anything like that, since the authentication is being done externally, but we still need to have a user record to associate membership to. If you share that user registry across other scopes then various processes might not work how you might expect them. For example you can't create a new account since one already exists, but it might not have access since it was never explicitly added to this scope. There are a whole variety of flows where "quirks" can be seen.

There is no downside to having multiple user registries in api manager - it just means a table of user records specific to this scope which then allows you to more precisely manage access to that scope. Thats why it is documented best practice not to share user registries across scopes.

Hope that helps

------------------------------
Chris Dudley


Original Message:
Sent: Wed March 27, 2024 08:02 AM
From: Syed Imtiyaz Alam
Subject: Multiple Catalog with single registry

thank you Chris. Yes we will follow this but we wont enable creation of Consumer org by them self. During Signup only they can create or Admin creating via apim.

but I am not able to understand what is difference between sharing vs having separate registry when both points to same backend server. Could you please elaborate more on this. maybe I am not following how internally developer works with unique email address.

------------------------------
Syed Imtiyaz Alam


Original Message:
Sent: Thu March 21, 2024 02:04 AM
From: Chris Dudley
Subject: Multiple Catalog with single registry

It is not recommended to share user registries with multiple portal sites and this is precisely why.

Create a separate user registry for each portal site, even if each user registry points at the same backend authentication provider (eg same oidc server).

If the user already exists in the user registry then obviously register is not going to work twice. They should be able to create a new consumer org though in the second site. If I remember right if they try to login the portal will lock down most features but the create a consumer org option in the user menu top right should still be available.

or you can add them to a consumerorg from api manager.

But basically this setup is a pretty bad idea and is explicitly documented as something to avoid in the documentation.

------------------------------
Chris Dudley

Maybe I am confused or missing something here.

So there is 2 part , one sign-up and another is Sign-in.

My understanding is that for both part (Signup/signin) it should point to same server.

Note: we are not using local registry because we already have our AD server where internal/external users are there.

Current: Self signup is disabled and only option is Sign in. So for now we add the user to this AD and just ask them to login with the credentials obviously after adding the user to existing consumer org.

New:  We want to enable self signup and during this time user should be added to the same AD server and this is what you are mentioning as Writable ?And Once user do self signup and email verification, user is able to login. And along with this all the default process should happen like creation of consumer org etc.

When you say >> when someone clicks register account, it is creating an account in the apim user registry >> this is when you are using local registry right ? 

see below: below image is shown when not using local registry. currently i don't see other fields like consumer org/email address etc ? which I would assume we need to add as custom field or am I missing something here.

------------------------------
Syed Imtiyaz Alam
------------------------------


Original Message:
Sent: Wed April 03, 2024 08:03 AM
From: Chris Dudley
Subject: Multiple Catalog with single registry

I think you might be confusing the user registry in API Manager and the external authentication provider.

It is very rare to be using a writable LDAP server, so when someone clicks register account, it is creating an account in the apim user registry having authenticated against an existing set of credentials in the external LDAP server. It is not normally creating an account in the LDAP server since the use of writable LDAP is pretty rare.

Are you actually using writable LDAP ?

------------------------------
Chris Dudley


Original Message:
Sent: Wed April 03, 2024 07:46 AM
From: Syed Imtiyaz Alam
Subject: Multiple Catalog with single registry

but in the case of signup connects to some external registry LDAP , user will do sign up only on one catalog and even if user tries the signup will fail as user already exists on that external LDAP.

Lets say if different registry per catalog which connects to same backend LDAP server . during this time also user can do signup in one catalog only? because if user tries to do signup then it will fail saying user already exists on that external LDAP?

So are you saying even signup connected to external registry, there is user table that gets created internally ? if yes is it during sign up ?

when shared , once user is part of consumer org , he can login to another catalog.

------------------------------
Syed Imtiyaz Alam


Original Message:
Sent: Wed March 27, 2024 09:43 AM
From: Chris Dudley
Subject: Multiple Catalog with single registry

The issue isnt where the backend server is, its what the UR is used for.

When you create an account for a given scope it creates a record in that user registry (UR). It wont contain a password or anything like that, since the authentication is being done externally, but we still need to have a user record to associate membership to. If you share that user registry across other scopes then various processes might not work how you might expect them. For example you can't create a new account since one already exists, but it might not have access since it was never explicitly added to this scope. There are a whole variety of flows where "quirks" can be seen.

There is no downside to having multiple user registries in api manager - it just means a table of user records specific to this scope which then allows you to more precisely manage access to that scope. Thats why it is documented best practice not to share user registries across scopes.

Hope that helps

------------------------------
Chris Dudley


Original Message:
Sent: Wed March 27, 2024 08:02 AM
From: Syed Imtiyaz Alam
Subject: Multiple Catalog with single registry

thank you Chris. Yes we will follow this but we wont enable creation of Consumer org by them self. During Signup only they can create or Admin creating via apim.

but I am not able to understand what is difference between sharing vs having separate registry when both points to same backend server. Could you please elaborate more on this. maybe I am not following how internally developer works with unique email address.

------------------------------
Syed Imtiyaz Alam


Original Message:
Sent: Thu March 21, 2024 02:04 AM
From: Chris Dudley
Subject: Multiple Catalog with single registry

It is not recommended to share user registries with multiple portal sites and this is precisely why.

Create a separate user registry for each portal site, even if each user registry points at the same backend authentication provider (eg same oidc server).

If the user already exists in the user registry then obviously register is not going to work twice. They should be able to create a new consumer org though in the second site. If I remember right if they try to login the portal will lock down most features but the create a consumer org option in the user menu top right should still be available.

or you can add them to a consumerorg from api manager.

But basically this setup is a pretty bad idea and is explicitly documented as something to avoid in the documentation.

------------------------------
Chris Dudley

The use of writable LDAP is pretty rare. We would definitely not recommend sharing the same user registry across catalogs - regardless of what user registry is being used.

I recommend you create multiple APIM user registries pointing to the same LDAP server. On the first catalog the user would click register and it would then ask for their LDAP credentials if they have an existing LDAP account or if you have enabled writable LDAP then it will let them create a new LDAP account. The same would then apply on subsequent catalogs.
There are 2 steps here and when we talk about "register new account" that is about creating a new account in the apim user registry - even if they already have an account in the backend LDAP server. They need to be added to this catalog and that means they need to register. If you disable self-service onboarding then only those users in the APIM user registry will be able to login - regardless of whether they exist in the LDAP server or not.
The LDAP server is purely providing authentication - authorisation is entirely done by the APIM user registry.

Hope that helps

------------------------------
Chris Dudley
------------------------------


Original Message:
Sent: Thu April 04, 2024 07:25 AM
From: Syed Imtiyaz Alam
Subject: Multiple Catalog with single registry

Maybe I am confused or missing something here.

So there is 2 part , one sign-up and another is Sign-in.

My understanding is that for both part (Signup/signin) it should point to same server.

Note: we are not using local registry because we already have our AD server where internal/external users are there.

Current: Self signup is disabled and only option is Sign in. So for now we add the user to this AD and just ask them to login with the credentials obviously after adding the user to existing consumer org.

New:  We want to enable self signup and during this time user should be added to the same AD server and this is what you are mentioning as Writable ?And Once user do self signup and email verification, user is able to login. And along with this all the default process should happen like creation of consumer org etc.

When you say >> when someone clicks register account, it is creating an account in the apim user registry >> this is when you are using local registry right ? 

see below: below image is shown when not using local registry. currently i don't see other fields like consumer org/email address etc ? which I would assume we need to add as custom field or am I missing something here.

------------------------------
Syed Imtiyaz Alam


Original Message:
Sent: Wed April 03, 2024 08:03 AM
From: Chris Dudley
Subject: Multiple Catalog with single registry

I think you might be confusing the user registry in API Manager and the external authentication provider.

It is very rare to be using a writable LDAP server, so when someone clicks register account, it is creating an account in the apim user registry having authenticated against an existing set of credentials in the external LDAP server. It is not normally creating an account in the LDAP server since the use of writable LDAP is pretty rare.

Are you actually using writable LDAP ?

------------------------------
Chris Dudley


Original Message:
Sent: Wed April 03, 2024 07:46 AM
From: Syed Imtiyaz Alam
Subject: Multiple Catalog with single registry

but in the case of signup connects to some external registry LDAP , user will do sign up only on one catalog and even if user tries the signup will fail as user already exists on that external LDAP.

Lets say if different registry per catalog which connects to same backend LDAP server . during this time also user can do signup in one catalog only? because if user tries to do signup then it will fail saying user already exists on that external LDAP?

So are you saying even signup connected to external registry, there is user table that gets created internally ? if yes is it during sign up ?

when shared , once user is part of consumer org , he can login to another catalog.

------------------------------
Syed Imtiyaz Alam


Original Message:
Sent: Wed March 27, 2024 09:43 AM
From: Chris Dudley
Subject: Multiple Catalog with single registry

The issue isnt where the backend server is, its what the UR is used for.

When you create an account for a given scope it creates a record in that user registry (UR). It wont contain a password or anything like that, since the authentication is being done externally, but we still need to have a user record to associate membership to. If you share that user registry across other scopes then various processes might not work how you might expect them. For example you can't create a new account since one already exists, but it might not have access since it was never explicitly added to this scope. There are a whole variety of flows where "quirks" can be seen.

There is no downside to having multiple user registries in api manager - it just means a table of user records specific to this scope which then allows you to more precisely manage access to that scope. Thats why it is documented best practice not to share user registries across scopes.

Hope that helps

------------------------------
Chris Dudley


Original Message:
Sent: Wed March 27, 2024 08:02 AM
From: Syed Imtiyaz Alam
Subject: Multiple Catalog with single registry

thank you Chris. Yes we will follow this but we wont enable creation of Consumer org by them self. During Signup only they can create or Admin creating via apim.

but I am not able to understand what is difference between sharing vs having separate registry when both points to same backend server. Could you please elaborate more on this. maybe I am not following how internally developer works with unique email address.

------------------------------
Syed Imtiyaz Alam


Original Message:
Sent: Thu March 21, 2024 02:04 AM
From: Chris Dudley
Subject: Multiple Catalog with single registry

It is not recommended to share user registries with multiple portal sites and this is precisely why.

Create a separate user registry for each portal site, even if each user registry points at the same backend authentication provider (eg same oidc server).

If the user already exists in the user registry then obviously register is not going to work twice. They should be able to create a new consumer org though in the second site. If I remember right if they try to login the portal will lock down most features but the create a consumer org option in the user menu top right should still be available.

or you can add them to a consumerorg from api manager.

But basically this setup is a pretty bad idea and is explicitly documented as something to avoid in the documentation.

------------------------------
Chris Dudley

The use of writable LDAP is pretty rare. We would definitely not recommend sharing the same user registry across catalogs - regardless of what user registry is being used.

I recommend you create multiple APIM user registries pointing to the same LDAP server. On the first catalog the user would click register and it would then ask for their LDAP credentials if they have an existing LDAP account or if you have enabled writable LDAP then it will let them create a new LDAP account. The same would then apply on subsequent catalogs.
There are 2 steps here and when we talk about "register new account" that is about creating a new account in the apim user registry - even if they already have an account in the backend LDAP server. They need to be added to this catalog and that means they need to register. If you disable self-service onboarding then only those users in the APIM user registry will be able to login - regardless of whether they exist in the LDAP server or not.
The LDAP server is purely providing authentication - authorisation is entirely done by the APIM user registry.

Hope that helps

Maybe I am confused or missing something here.

So there is 2 part , one sign-up and another is Sign-in.

My understanding is that for both part (Signup/signin) it should point to same server.

Note: we are not using local registry because we already have our AD server where internal/external users are there.

Current: Self signup is disabled and only option is Sign in. So for now we add the user to this AD and just ask them to login with the credentials obviously after adding the user to existing consumer org.

New:  We want to enable self signup and during this time user should be added to the same AD server and this is what you are mentioning as Writable ?And Once user do self signup and email verification, user is able to login. And along with this all the default process should happen like creation of consumer org etc.

When you say >> when someone clicks register account, it is creating an account in the apim user registry >> this is when you are using local registry right ? 

see below: below image is shown when not using local registry. currently i don't see other fields like consumer org/email address etc ? which I would assume we need to add as custom field or am I missing something here.

------------------------------
Syed Imtiyaz Alam


Original Message:
Sent: Wed April 03, 2024 08:03 AM
From: Chris Dudley
Subject: Multiple Catalog with single registry

I think you might be confusing the user registry in API Manager and the external authentication provider.

It is very rare to be using a writable LDAP server, so when someone clicks register account, it is creating an account in the apim user registry having authenticated against an existing set of credentials in the external LDAP server. It is not normally creating an account in the LDAP server since the use of writable LDAP is pretty rare.

Are you actually using writable LDAP ?

------------------------------
Chris Dudley


Original Message:
Sent: Wed April 03, 2024 07:46 AM
From: Syed Imtiyaz Alam
Subject: Multiple Catalog with single registry

but in the case of signup connects to some external registry LDAP , user will do sign up only on one catalog and even if user tries the signup will fail as user already exists on that external LDAP.

Lets say if different registry per catalog which connects to same backend LDAP server . during this time also user can do signup in one catalog only? because if user tries to do signup then it will fail saying user already exists on that external LDAP?

So are you saying even signup connected to external registry, there is user table that gets created internally ? if yes is it during sign up ?

when shared , once user is part of consumer org , he can login to another catalog.

------------------------------
Syed Imtiyaz Alam


Original Message:
Sent: Wed March 27, 2024 09:43 AM
From: Chris Dudley
Subject: Multiple Catalog with single registry

The issue isnt where the backend server is, its what the UR is used for.

When you create an account for a given scope it creates a record in that user registry (UR). It wont contain a password or anything like that, since the authentication is being done externally, but we still need to have a user record to associate membership to. If you share that user registry across other scopes then various processes might not work how you might expect them. For example you can't create a new account since one already exists, but it might not have access since it was never explicitly added to this scope. There are a whole variety of flows where "quirks" can be seen.

There is no downside to having multiple user registries in api manager - it just means a table of user records specific to this scope which then allows you to more precisely manage access to that scope. Thats why it is documented best practice not to share user registries across scopes.

Hope that helps

------------------------------
Chris Dudley


Original Message:
Sent: Wed March 27, 2024 08:02 AM
From: Syed Imtiyaz Alam
Subject: Multiple Catalog with single registry

thank you Chris. Yes we will follow this but we wont enable creation of Consumer org by them self. During Signup only they can create or Admin creating via apim.

but I am not able to understand what is difference between sharing vs having separate registry when both points to same backend server. Could you please elaborate more on this. maybe I am not following how internally developer works with unique email address.

------------------------------
Syed Imtiyaz Alam


Original Message:
Sent: Thu March 21, 2024 02:04 AM
From: Chris Dudley
Subject: Multiple Catalog with single registry

It is not recommended to share user registries with multiple portal sites and this is precisely why.

Create a separate user registry for each portal site, even if each user registry points at the same backend authentication provider (eg same oidc server).

If the user already exists in the user registry then obviously register is not going to work twice. They should be able to create a new consumer org though in the second site. If I remember right if they try to login the portal will lock down most features but the create a consumer org option in the user menu top right should still be available.

or you can add them to a consumerorg from api manager.

But basically this setup is a pretty bad idea and is explicitly documented as something to avoid in the documentation.

------------------------------
Chris Dudley

Hi Chris,

Looking for some guidance here to understand this.

is this not possible ? signup using writable LDAP and Sign in using OIDC.

The use of writable LDAP is pretty rare. We would definitely not recommend sharing the same user registry across catalogs - regardless of what user registry is being used.

I recommend you create multiple APIM user registries pointing to the same LDAP server. On the first catalog the user would click register and it would then ask for their LDAP credentials if they have an existing LDAP account or if you have enabled writable LDAP then it will let them create a new LDAP account. The same would then apply on subsequent catalogs.
There are 2 steps here and when we talk about "register new account" that is about creating a new account in the apim user registry - even if they already have an account in the backend LDAP server. They need to be added to this catalog and that means they need to register. If you disable self-service onboarding then only those users in the APIM user registry will be able to login - regardless of whether they exist in the LDAP server or not.
The LDAP server is purely providing authentication - authorisation is entirely done by the APIM user registry.

Hope that helps

Maybe I am confused or missing something here.

So there is 2 part , one sign-up and another is Sign-in.

My understanding is that for both part (Signup/signin) it should point to same server.

Note: we are not using local registry because we already have our AD server where internal/external users are there.

Current: Self signup is disabled and only option is Sign in. So for now we add the user to this AD and just ask them to login with the credentials obviously after adding the user to existing consumer org.

New:  We want to enable self signup and during this time user should be added to the same AD server and this is what you are mentioning as Writable ?And Once user do self signup and email verification, user is able to login. And along with this all the default process should happen like creation of consumer org etc.

When you say >> when someone clicks register account, it is creating an account in the apim user registry >> this is when you are using local registry right ? 

see below: below image is shown when not using local registry. currently i don't see other fields like consumer org/email address etc ? which I would assume we need to add as custom field or am I missing something here.

------------------------------
Syed Imtiyaz Alam


Original Message:
Sent: Wed April 03, 2024 08:03 AM
From: Chris Dudley
Subject: Multiple Catalog with single registry

I think you might be confusing the user registry in API Manager and the external authentication provider.

It is very rare to be using a writable LDAP server, so when someone clicks register account, it is creating an account in the apim user registry having authenticated against an existing set of credentials in the external LDAP server. It is not normally creating an account in the LDAP server since the use of writable LDAP is pretty rare.

Are you actually using writable LDAP ?

------------------------------
Chris Dudley


Original Message:
Sent: Wed April 03, 2024 07:46 AM
From: Syed Imtiyaz Alam
Subject: Multiple Catalog with single registry

but in the case of signup connects to some external registry LDAP , user will do sign up only on one catalog and even if user tries the signup will fail as user already exists on that external LDAP.

Lets say if different registry per catalog which connects to same backend LDAP server . during this time also user can do signup in one catalog only? because if user tries to do signup then it will fail saying user already exists on that external LDAP?

So are you saying even signup connected to external registry, there is user table that gets created internally ? if yes is it during sign up ?

when shared , once user is part of consumer org , he can login to another catalog.

------------------------------
Syed Imtiyaz Alam


Original Message:
Sent: Wed March 27, 2024 09:43 AM
From: Chris Dudley
Subject: Multiple Catalog with single registry

The issue isnt where the backend server is, its what the UR is used for.

When you create an account for a given scope it creates a record in that user registry (UR). It wont contain a password or anything like that, since the authentication is being done externally, but we still need to have a user record to associate membership to. If you share that user registry across other scopes then various processes might not work how you might expect them. For example you can't create a new account since one already exists, but it might not have access since it was never explicitly added to this scope. There are a whole variety of flows where "quirks" can be seen.

There is no downside to having multiple user registries in api manager - it just means a table of user records specific to this scope which then allows you to more precisely manage access to that scope. Thats why it is documented best practice not to share user registries across scopes.

Hope that helps

------------------------------
Chris Dudley


Original Message:
Sent: Wed March 27, 2024 08:02 AM
From: Syed Imtiyaz Alam
Subject: Multiple Catalog with single registry

thank you Chris. Yes we will follow this but we wont enable creation of Consumer org by them self. During Signup only they can create or Admin creating via apim.

but I am not able to understand what is difference between sharing vs having separate registry when both points to same backend server. Could you please elaborate more on this. maybe I am not following how internally developer works with unique email address.

------------------------------
Syed Imtiyaz Alam


Original Message:
Sent: Thu March 21, 2024 02:04 AM
From: Chris Dudley
Subject: Multiple Catalog with single registry

It is not recommended to share user registries with multiple portal sites and this is precisely why.

Create a separate user registry for each portal site, even if each user registry points at the same backend authentication provider (eg same oidc server).

If the user already exists in the user registry then obviously register is not going to work twice. They should be able to create a new consumer org though in the second site. If I remember right if they try to login the portal will lock down most features but the create a consumer org option in the user menu top right should still be available.

or you can add them to a consumerorg from api manager.

But basically this setup is a pretty bad idea and is explicitly documented as something to avoid in the documentation.

------------------------------
Chris Dudley

I think you are misunderstanding how OIDC works.

When you have an OIDC user registry a link appears on the page - that link takes you to your OIDC authentication provider. It can have all sorts of capabilities we dont need to be aware of - e.g. it could include MFA. It could also allow you to create an account if one doesnt already exist. The point is that once authenticated it returns back to APIC and we're happy. There is no dedicated "register" form for an OIDC user registry in the portal because its none of our concern - you would do that in the OIDC authentication provider when you are redirected there.

Look at how sites that use google login work - you click the authenticate with google button, you get redirected to google, and if you have an account you can login, if you don't you can create a new one and then login and it will redirect you back to the original site. That's the beauty of OIDC - the original website doesn't need to be involved in any of this.

Hi Chris,

Looking for some guidance here to understand this.

is this not possible ? signup using writable LDAP and Sign in using OIDC.

The use of writable LDAP is pretty rare. We would definitely not recommend sharing the same user registry across catalogs - regardless of what user registry is being used.

I recommend you create multiple APIM user registries pointing to the same LDAP server. On the first catalog the user would click register and it would then ask for their LDAP credentials if they have an existing LDAP account or if you have enabled writable LDAP then it will let them create a new LDAP account. The same would then apply on subsequent catalogs.
There are 2 steps here and when we talk about "register new account" that is about creating a new account in the apim user registry - even if they already have an account in the backend LDAP server. They need to be added to this catalog and that means they need to register. If you disable self-service onboarding then only those users in the APIM user registry will be able to login - regardless of whether they exist in the LDAP server or not.
The LDAP server is purely providing authentication - authorisation is entirely done by the APIM user registry.

Hope that helps

Maybe I am confused or missing something here.

So there is 2 part , one sign-up and another is Sign-in.

My understanding is that for both part (Signup/signin) it should point to same server.

Note: we are not using local registry because we already have our AD server where internal/external users are there.

Current: Self signup is disabled and only option is Sign in. So for now we add the user to this AD and just ask them to login with the credentials obviously after adding the user to existing consumer org.

New:  We want to enable self signup and during this time user should be added to the same AD server and this is what you are mentioning as Writable ?And Once user do self signup and email verification, user is able to login. And along with this all the default process should happen like creation of consumer org etc.

When you say >> when someone clicks register account, it is creating an account in the apim user registry >> this is when you are using local registry right ? 

see below: below image is shown when not using local registry. currently i don't see other fields like consumer org/email address etc ? which I would assume we need to add as custom field or am I missing something here.

------------------------------
Syed Imtiyaz Alam


Original Message:
Sent: Wed April 03, 2024 08:03 AM
From: Chris Dudley
Subject: Multiple Catalog with single registry

I think you might be confusing the user registry in API Manager and the external authentication provider.

It is very rare to be using a writable LDAP server, so when someone clicks register account, it is creating an account in the apim user registry having authenticated against an existing set of credentials in the external LDAP server. It is not normally creating an account in the LDAP server since the use of writable LDAP is pretty rare.

Are you actually using writable LDAP ?

------------------------------
Chris Dudley


Original Message:
Sent: Wed April 03, 2024 07:46 AM
From: Syed Imtiyaz Alam
Subject: Multiple Catalog with single registry

but in the case of signup connects to some external registry LDAP , user will do sign up only on one catalog and even if user tries the signup will fail as user already exists on that external LDAP.

Lets say if different registry per catalog which connects to same backend LDAP server . during this time also user can do signup in one catalog only? because if user tries to do signup then it will fail saying user already exists on that external LDAP?

So are you saying even signup connected to external registry, there is user table that gets created internally ? if yes is it during sign up ?

when shared , once user is part of consumer org , he can login to another catalog.

------------------------------
Syed Imtiyaz Alam


Original Message:
Sent: Wed March 27, 2024 09:43 AM
From: Chris Dudley
Subject: Multiple Catalog with single registry

The issue isnt where the backend server is, its what the UR is used for.

When you create an account for a given scope it creates a record in that user registry (UR). It wont contain a password or anything like that, since the authentication is being done externally, but we still need to have a user record to associate membership to. If you share that user registry across other scopes then various processes might not work how you might expect them. For example you can't create a new account since one already exists, but it might not have access since it was never explicitly added to this scope. There are a whole variety of flows where "quirks" can be seen.

There is no downside to having multiple user registries in api manager - it just means a table of user records specific to this scope which then allows you to more precisely manage access to that scope. Thats why it is documented best practice not to share user registries across scopes.

Hope that helps

------------------------------
Chris Dudley


Original Message:
Sent: Wed March 27, 2024 08:02 AM
From: Syed Imtiyaz Alam
Subject: Multiple Catalog with single registry

thank you Chris. Yes we will follow this but we wont enable creation of Consumer org by them self. During Signup only they can create or Admin creating via apim.

but I am not able to understand what is difference between sharing vs having separate registry when both points to same backend server. Could you please elaborate more on this. maybe I am not following how internally developer works with unique email address.

------------------------------
Syed Imtiyaz Alam


Original Message:
Sent: Thu March 21, 2024 02:04 AM
From: Chris Dudley
Subject: Multiple Catalog with single registry

It is not recommended to share user registries with multiple portal sites and this is precisely why.

Create a separate user registry for each portal site, even if each user registry points at the same backend authentication provider (eg same oidc server).

If the user already exists in the user registry then obviously register is not going to work twice. They should be able to create a new consumer org though in the second site. If I remember right if they try to login the portal will lock down most features but the create a consumer org option in the user menu top right should still be available.

or you can add them to a consumerorg from api manager.

But basically this setup is a pretty bad idea and is explicitly documented as something to avoid in the documentation.

------------------------------
Chris Dudley

Thank you So much Chris. after POC also everything now makes sense and am able to understand whole flow.

currently I am not able to test the register new account functionality as from my browser , OIDC always returns my user info as I am already there and is only able to create new consumer Org But based on this discussion, I can assume that if I am not part of registry then it would give me option of creating username/password right along with consumer org etc.

I think you are misunderstanding how OIDC works.

When you have an OIDC user registry a link appears on the page - that link takes you to your OIDC authentication provider. It can have all sorts of capabilities we dont need to be aware of - e.g. it could include MFA. It could also allow you to create an account if one doesnt already exist. The point is that once authenticated it returns back to APIC and we're happy. There is no dedicated "register" form for an OIDC user registry in the portal because its none of our concern - you would do that in the OIDC authentication provider when you are redirected there.

Look at how sites that use google login work - you click the authenticate with google button, you get redirected to google, and if you have an account you can login, if you don't you can create a new one and then login and it will redirect you back to the original site. That's the beauty of OIDC - the original website doesn't need to be involved in any of this.

Hi Chris,

Looking for some guidance here to understand this.

is this not possible ? signup using writable LDAP and Sign in using OIDC.

The use of writable LDAP is pretty rare. We would definitely not recommend sharing the same user registry across catalogs - regardless of what user registry is being used.

I recommend you create multiple APIM user registries pointing to the same LDAP server. On the first catalog the user would click register and it would then ask for their LDAP credentials if they have an existing LDAP account or if you have enabled writable LDAP then it will let them create a new LDAP account. The same would then apply on subsequent catalogs.
There are 2 steps here and when we talk about "register new account" that is about creating a new account in the apim user registry - even if they already have an account in the backend LDAP server. They need to be added to this catalog and that means they need to register. If you disable self-service onboarding then only those users in the APIM user registry will be able to login - regardless of whether they exist in the LDAP server or not.
The LDAP server is purely providing authentication - authorisation is entirely done by the APIM user registry.

Hope that helps

Maybe I am confused or missing something here.

So there is 2 part , one sign-up and another is Sign-in.

My understanding is that for both part (Signup/signin) it should point to same server.

Note: we are not using local registry because we already have our AD server where internal/external users are there.

Current: Self signup is disabled and only option is Sign in. So for now we add the user to this AD and just ask them to login with the credentials obviously after adding the user to existing consumer org.

New:  We want to enable self signup and during this time user should be added to the same AD server and this is what you are mentioning as Writable ?And Once user do self signup and email verification, user is able to login. And along with this all the default process should happen like creation of consumer org etc.

When you say >> when someone clicks register account, it is creating an account in the apim user registry >> this is when you are using local registry right ? 

see below: below image is shown when not using local registry. currently i don't see other fields like consumer org/email address etc ? which I would assume we need to add as custom field or am I missing something here.

------------------------------
Syed Imtiyaz Alam


Original Message:
Sent: Wed April 03, 2024 08:03 AM
From: Chris Dudley
Subject: Multiple Catalog with single registry

I think you might be confusing the user registry in API Manager and the external authentication provider.

It is very rare to be using a writable LDAP server, so when someone clicks register account, it is creating an account in the apim user registry having authenticated against an existing set of credentials in the external LDAP server. It is not normally creating an account in the LDAP server since the use of writable LDAP is pretty rare.

Are you actually using writable LDAP ?

------------------------------
Chris Dudley


Original Message:
Sent: Wed April 03, 2024 07:46 AM
From: Syed Imtiyaz Alam
Subject: Multiple Catalog with single registry

but in the case of signup connects to some external registry LDAP , user will do sign up only on one catalog and even if user tries the signup will fail as user already exists on that external LDAP.

Lets say if different registry per catalog which connects to same backend LDAP server . during this time also user can do signup in one catalog only? because if user tries to do signup then it will fail saying user already exists on that external LDAP?

So are you saying even signup connected to external registry, there is user table that gets created internally ? if yes is it during sign up ?

when shared , once user is part of consumer org , he can login to another catalog.

------------------------------
Syed Imtiyaz Alam


Original Message:
Sent: Wed March 27, 2024 09:43 AM
From: Chris Dudley
Subject: Multiple Catalog with single registry

The issue isnt where the backend server is, its what the UR is used for.

When you create an account for a given scope it creates a record in that user registry (UR). It wont contain a password or anything like that, since the authentication is being done externally, but we still need to have a user record to associate membership to. If you share that user registry across other scopes then various processes might not work how you might expect them. For example you can't create a new account since one already exists, but it might not have access since it was never explicitly added to this scope. There are a whole variety of flows where "quirks" can be seen.

There is no downside to having multiple user registries in api manager - it just means a table of user records specific to this scope which then allows you to more precisely manage access to that scope. Thats why it is documented best practice not to share user registries across scopes.

Hope that helps

------------------------------
Chris Dudley


Original Message:
Sent: Wed March 27, 2024 08:02 AM
From: Syed Imtiyaz Alam
Subject: Multiple Catalog with single registry

thank you Chris. Yes we will follow this but we wont enable creation of Consumer org by them self. During Signup only they can create or Admin creating via apim.

but I am not able to understand what is difference between sharing vs having separate registry when both points to same backend server. Could you please elaborate more on this. maybe I am not following how internally developer works with unique email address.

------------------------------
Syed Imtiyaz Alam


Original Message:
Sent: Thu March 21, 2024 02:04 AM
From: Chris Dudley
Subject: Multiple Catalog with single registry

It is not recommended to share user registries with multiple portal sites and this is precisely why.

Create a separate user registry for each portal site, even if each user registry points at the same backend authentication provider (eg same oidc server).

If the user already exists in the user registry then obviously register is not going to work twice. They should be able to create a new consumer org though in the second site. If I remember right if they try to login the portal will lock down most features but the create a consumer org option in the user menu top right should still be available.

or you can add them to a consumerorg from api manager.

But basically this setup is a pretty bad idea and is explicitly documented as something to avoid in the documentation.

------------------------------
Chris Dudley