title: Token validation at WSO2 API Manager (and Identity Server)
body: <p>We building our API with wso2 API manager + separate identity server.</p>
  
  <p>For implementation of resource server we need to </p>
  
  <ol>
  <li>validate token (that it's valid)</li>
  <li>get information about user (roles, username, full name etc.)</li>
  <li>details of authentication through OAuth (scope)</li>
  </ol>
  
  <p>User roles and auth scope are necessary to do determine user capabilities and apply security settings (as an intersection of user roles and granted scopes)</p>
  
  <p>Currently it seems that I can get all necessary information with 2 requests:</p>
  
  <ol>
  <li><p>call "<em>validate</em>" method at SOAP web service, that is located at <strong>/services/OAuth2TokenValidationService/</strong> (IS or ApiManager in case of no dedicated IS)</p>
  
  <p>Response contains information about token validity, expiration data and user scopes. </p></li>
  <li><p>do GET on  <strong>/oauth2/userinfo?schema=openid</strong> </p>
  
  <p>Response contains JSON with information about user (roles, username etc.)</p></li>
  </ol>
  
  <p>First request requires a basic auth with the credentials of user, registered at wso2 IS server. The second one requires only OAuth token that a resource server obtained from a client.</p>
  
  <p><strong>So the question is</strong>: are this 2 requests with the different technologies are necessary for this use case (to get scopes and user info at resource server) or maybe I'm missing something?</p>
  
  <p>The second request is almost good, but it does not contains information about token scope, thus the server can't restrict access to resource if a user, in general, has access to it (according to his roles)</p>
  
  <p>If 2 request are necessary what are the minimum system roles at wso2 app the user should have to access SoapService? Using admin credentials (like default admin/admin) seems too unsecure to me and I'd like to create user for token validation with minimum permissions.</p>