[APIM 4.7.0] Multi Tenant Authenticator and `/select-tenant/` endpoint missing from Docker image

[Lenghak-Hok]

Description

The documented multi-tenant OIDC SSO flow cannot be completed with the public wso2/wso2am:4.7.0 Docker image.

The documentation describes a Multi Tenant Authenticator, a default /select-tenant/ page, commonsp, tenant-local OIDC IdPs, and tenant-aware JIT provisioning.

Initially, /select-tenant/ returned HTTP 401. After adding the documented public resource rule and force-recreating APIM, it returns HTTP 404.

The generated identity.xml contains the unsecured /select-tenant/ rule, confirming that APIM loaded the access-control configuration. However, searches of both the running container and pristine Docker image found no selector web application, related WAR/JSP, or identifiable MultiTenantAuthenticator class.

Expected result: /select-tenant/ returns the default tenant-selection page or an expected authentication redirect.

Actual result:

HTTP/1.1 404
Server: WSO2 Carbon Server

Please confirm whether this feature requires a separate APIM update, subscription update channel, feature package, or updated Docker image.

Steps to Reproduce

1. Start wso2/wso2am:4.7.0.
2. Add the documented tenant context, organization JIT listener, and public /select-tenant/ resource rule to deployment.toml.
3. Force-recreate APIM.
4. Confirm that generated identity.xml contains:

<Resource context="(.*)/select-tenant(.*)"
          secured="false"
          http-method="all">
</Resource>

5. Request:

curl -k -i https://APIM_HOST:9443/select-tenant/

6. Observe HTTP 404.
7. Search the pristine image:

docker run --rm --entrypoint sh wso2/wso2am:4.7.0 -c 'grep -RniE "select-tenant|TenantSelection|tenant-selection" /home/wso2carbon/wso2am-4.7.0 2>/dev/null'

8. Observe no result.

Version

WSO2 API Manager 4.7.0
Docker image: wso2/wso2am:4.7.0
Image ID: sha256:4de3aabbb11d16a1c00d122312503070ea8617e0829133cbcc83f35d6868b889
Docker source label: v4.7.0.1

Environment Details

• All-in-one APIM deployment using Docker Compose
• WSO2 Identity Server 7.3.0 as external IdP
• Microsoft SQL Server
• AMD64 container
• APIM tenant: rhbbcpuat.com.kh
• No applied patch or service pack detected
• Reproduced with curl, without a reverse proxy

Security Note

Credentials, secrets, internal IP addresses, and certificates are intentionally excluded.

Version

WSO2 API Manager 4.7.0

Environment Details (with versions)

Host OS: Ubuntu 24.02 LTS
Docker image: wso2/wso2am:4.7.0
Image ID: sha256:4de3aabbb11d16a1c00d122312503070ea8617e0829133cbcc83f35d6868b889
Docker source label: v4.7.0.1