Hi Mayur,
Exposing the REST APIs to application users/owners, require a good understanding of the ISAM (Verify access) technology. Not every application owner should create a new WebSEAL instance , when a new application is deployed. The application onboarding process is of course company specific. But once you open the box, all the tools within the box are accessible. Do you want a non-admin suddenly restart the instance or restart a runtime component ? Here are the REST APIs which are available :
https://www.ibm.com/support/knowledgecenter/SSPREK_10.0.0/com.ibm.isva.doc/develop/rapi/docker/index.html. You will have to define account(s) and assign what they can/ can't do and restrict, but I'm not sure if this 100 % possible.
If you are looking to a Self service model, my suggestion would be to look at IBM Application Gateway (OIDC RP) in combination with ISAM 9 . IAG is basically a lightweight WebSEAL container , but which is completely configurable by means of yaml files . It is much easier to allow a self service model where the application owner(s) is responsible for the resource_server yaml file(s), which also includes references to authorization
See (https://iamdevportal.us-east.mybluemix.net/iag/references/yaml/logging/request-log)
See
https://iamdevportal.us-east.mybluemix.net/iag/concepts/configuration#using-multiple-configuration-yaml-documentsHere is the image in DockerHub :https://hub.docker.com/r/ibmcom/ibm-application-gateway .
Hope this helps,
Regards,
Serge
------------------------------
Serge Vereecke
------------------------------