Make carbon mgt console & soap services disabled by default

[darshanasbg]

Is your suggestion related to an experience ? Please describe.
Carbon Management Console has been deprecated with IS 7.0.0
https://is.docs.wso2.com/en/latest/references/about-this-release/#deprecated-features

SOAP Services has been deprecated since IS 6.0.0
https://is.docs.wso2.com/en/6.1.0/references/about-this-release/#deprecated-features

As the first step retiring these functionality, its better to disable these two in the default pack.

Describe the improvement
Have soap services and the carbon management console not accessible in the default pack.

Need to consider giving a feature flag to enable soap services to keep the backward compatibility for anyone who is migrating from an old version.

Additional context
Fully retiring these features would possibly be done with next major IS version.

[janakamarasena]

Would be good if soap services can be selectively enabled so anyone can enable only the ones they require.

[darshanasbg]

Would be good if soap services can be selectively enabled so anyone can enable only the ones they require.

Yeah.. We can consider that..

[shashimalcse]

Identified a couple of SOAP services used in IS7 management console features related to API access management and authroization. Giving a feature flag to enable these features would be ideal.

• Entitlement (XACML)
  • EntitlementAdminService (PDP Configurations)
  • EntitlementService (PDP Endpoint)
  • EntitlementPolicyAdminService (PAP)
• Roles List (Managing permissions of old roles. mail : Revamping Management Console in IS 7.0.0
  )
  • UserAdmin (role management)
• Consent Purpose (Don't know the exact SOAP service used for this)

The following are some SOAP services not used in the console (We can disable these for the default pack):

• OAuth2TokenValidationService (token validation)
• ServerRolesManager (manage server roles)
• OAuthAdminService (manage oauth apps)
• IdentityApplicationManagementService (application mgt)
• ResourceAdminService

[darshanasbg]

Thanks for the analysis @shashimalcse..

IMO, we should not ask to access management console or soap services for any features that are not deprecated in the product.. We should have corresponding REST APIs and new UIs to use them..

We may allow selective access to soap services, considering the backward compatibility of the legacy deprecated features.. But that should be only used for that purpose..

[shashimalcse]

@darshanasbg agree! there is an effort ongoing with XACML REST APIs and the new console UI. Let's track those.

[darshanasbg]

Carbon products have a inbuilt capability to avoid registering the axis services that come through the OSGi bundles by setting a system property named optimize.
Ref: https://github.com/wso2/carbon-kernel/blob/6b7b18a83a551227bcda7484cf3735eb60dca52c/core/org.wso2.carbon.core/src/main/java/org/wso2/carbon/core/init/CarbonServerManager.java#L482

For example if we start the product using sh wso2server.sh -Doptimize=true, it will not register the soap services.

Although this does not have the capability to enable services selectively, IMO we should use this capability and have the all the soap services disabled as the default functionality of the product as the starting point giving the benefit of reduced exposed surface for the majority of the product users..

[darshanasbg]

Carbon products have a inbuilt capability to avoid registering the axis services that come through the OSGi bundles by setting a system property named optimize. Ref: https://github.com/wso2/carbon-kernel/blob/6b7b18a83a551227bcda7484cf3735eb60dca52c/core/org.wso2.carbon.core/src/main/java/org/wso2/carbon/core/init/CarbonServerManager.java#L482

For example if we start the product using sh wso2server.sh -Doptimize=true, it will not register the soap services.

Although this does not have the capability to enable services selectively, IMO we should use this capability and have the all the soap services disabled as the default functionality of the product as the starting point giving the benefit of reduced exposed surface for the majority of the product users..

• Implemented above with: Make soap services disabled by default #23158

[darshanasbg]

Disabling soap services restrict the use of the management console, thus management console landing page updated to look like following , if the soap services are disabled.. Note the header banner is updated and the sign-in form has been removed.

[darshanasbg]

In summary, with the changes

• Make soap services disabled by default #23158
• Disable management console when soap services off carbon-kernel#4242

it will make the management console and the soap services disabled by default and in order to make them available, product needs to start with the system param-Doptimize=false added.

ex:

sh wso2server.sh -Doptimize=true