Configure IS-7.x as Third party KM for APIM - Official Documentation Improvement

Description

Hi Team,

If someone refers to this[1] and tries to configure IS as the Key Manager while using the /keymanager-operations/user-info endpoint, they will not know that an additional access control configuration is required. We should clearly mention in the documentation that if /keymanager-operations/user-info is used as the user-info endpoint, the following configuration is not required in IS:

[[resource.access_control]]
context="(.*)/scim2/Me"
secure=true
http_method="GET"
cross_tenant=true
permissions=[]
scopes=[]

However, if any other access controls are applied in IS, the following access control must also be added in the IS deployment.toml:

[[resource.access_control]]
context = "(.*)/keymanager-operations/user-info/claims/generate"
secure = true
http_method = "POST"
permissions = "/permission/admin/manage/identity/usermgt/list"
scopes = "internal_user_mgt_list"

[1]https://apim.docs.wso2.com/en/4.4.0/administer/key-managers/configure-wso2is7-connector/#configure-wso2-is-7x-as-a-key-manager:~:text=Add%20following%20configurations%20in%20the%20%3CIS7_HOME%3E/repository/conf/deployment.toml%20file.

Thanks and Regards,
Sujit

Suggested Improvement

It will be good if we update the APIM official doc with this.

Version(s)

4.x

Start with the linked APIM documentation page, “Configure WSO2 IS 7.x as a Key Manager,” and review its deployment.toml configuration section. Update the page to explain when the /keymanager-operations/user-info access control is required and when the /scim2/Me configuration is not required. Done means both conditions and the supplied configuration are clearly documented.