Skip to main content

An example of authentication at gateway while proxied API calls are "trusted"

API Cloud provides the authorization of the APIs published using basic auth. But what do we do if our back-end is also secured using a different mechanism. In this blog i will explain how we can create and API and invoke a back-end when the back-end has been secured using a user name and password.


To demonstrate this sample i will be using a JAX-RS based service used in the WSO2 APP cloud. It is a basic jax-rs application very much like the one found here. It is a service that can be used to get the id and name of a customer when the id is passed as a parameter which is the operation I will be using to demonstrate the example. This service cannot be accessed unless we provide the credentials.

The service was secured in the manner explained in this blog. A security constraint tag was included to the web.xml of the jax-rs service which will require credentials if we need to invoke the methods of this service using our API.

First Let’s create our API to demonstrate the scenario.

1. Log in to WSO2 Cloud and navigate to the API Cloud where it will direct you to the publisher portal. If you do not have an account you can find the steps here.

2. Create a new API and use the guidelines in the image below to design the API. Give the request URI as customerservice/customers/{id} and select implement.



3. In the implement tab we need to give the endpoint as https://appserver.dev.cloud.wso2.com/t/backstage/webapps/customerdetailservi-default-SNAPSHOT/services/customers/customerservice and select the Endpoint Security Scheme as ‘Secured’ under ‘Show more options’.


4. Here we need to provide the credential we have used to secure our back-end service.




5. After which the tiers were selected and the API was published in the store.


6. After the API has been successfully created we can invoking after subscribing to the API using an application and observe the result.


7. Provide the value 123 for the id and Try it. You will see a response as below.




8. Let’s remove the secured property and try to invoke the API again.


9. Go to the API Publisher and select edit option for the API created above.

10. In the implement tab click the ‘Show more options’ link and change the endpoint security scheme as ‘Non Secured’.

11. Save and Publish the API again.

12. Go back to the API Store and invoke the GET method using the id value as 123. You will be unauthorized since the back-end cannot be access unless we pass the required authorization.
   

References:

[1] http://wso2.com/blogs/cloud/your-own-jax-rs-as-an-oauth-web-api-in-minutes/

[2] https://appserver.dev.cloud.wso2.com/t/backstage/webapps/customerdetailservi-default-SNAPSHOT/services/
[3] https://docs.wso2.com/display/AS530/JAX-RS+Basics
[4] http://shenavid.blogspot.com/2015/10/wso2-cloud-wso2-cloud-consists-of-two.html
[5] https://docs.wso2.com/display/APICloud/Create+and+Publish+an+API
[6]https://docs.wso2.com/display/APICloud/Subscribe+to+and+Invoke+an+API

Comments

  1. API HUBNovember 1, 2023 at 6:05 AM

    API calls are the foundation of modern digital interactions, allowing different software systems to communicate and share data seamlessly. They're like the language that applications speak, enabling them to request and exchange information. These calls empower countless online services, from weather apps to social media, making them user-friendly and efficient. The reliability and speed of API calls are crucial, ensuring a smooth experience for users. As our digital world continues to expand, understanding and optimizing API calls remain pivotal for delivering responsive and interconnected software solutions.

    ReplyDelete

Post a Comment

Popular posts from this blog

Processing large payloads with the esb script mediator iteratively

Overview WSO2 ESB uses Rhino engine to execute JavaScripts. Rhino engine converts the script to a method inside a Java class. Therefore, when processing large JSON data volumes, the code length must be less than 65536 characters, since the Script mediator converts the payload into a Java object. However, you can use the following alternative options to process large JSON data volumes. The script mediator which is used in ESB is powered by the Rhino engine. Therefore, when processing large JSON data volumes, the code length must be less than 65536 characters which is a limitation in the script mediator being used in the esb versions less than 5.0.0. In ESB 5.0.0 there is a higher capability to process larger payloads using script mediator. In order to process such large payloads we can follow the below two approaches. 1. Replace the javascript tranformation logic using java code by writing a custom mediator. [1] 2. Break down the large payload and execute them as sections using ...
Post a Comment
Read more

Invoking external endpoints using the call mediator in wso2 api manager

Introduction In API Manager if you need to do any service chaining use cases the call mediator comes in handy. If you need to use the response received by invoking one endpoint and then use it to invoke another endpoint you can use the call mediator in API Manager. The call mediator behaves in a synchronous manner. Hence, mediation pauses after the service invocation and resumes from the next mediator in the sequence when the response is received. You can read more about the call mediator in the wso2 esb documentation [1] . In api manager 1.10.0 the call mediator works in the blocking mode. Prerequisite Before we can use the call mediator in API Manager 1.10.0 we need to make the following changes to some configs. We need to comment the jms transport sender in axis2_blocking_client.xml found in the location APIM_HOME/repository/conf/axis2. This will resolve the jms sender initialization issues.   <!--transportSender name="jms"        ...
1 comment
Read more

Configure WSO2 Identity Server for single sign on with Moodle - Part I

Introduction Moodle is a learning platform designed to provide educators, administrators and learners with a single robust, secure and integrated system to create personalized learning environments.[1]. This is commonly used in the education sector and there might be occurrences where it would require to use SAML to login to Moodle instead of the default basic authentication. For this we would need to have an Identity Provider capable of issuing such SAML tokens and Moodle configured to accept the tokens in order to do the authentication I will be discussing this in two parts. Part I - How to configure moodle for SSO with WSO2 Identity Server Part II - How to carry our user provisioning and attribute profile mapping with Moodle and WSO2 Identity Server Let's see how this can be achieved using a SAML authentication plugin provided by one login. Prerequisite  You need to have a working version of Moodle installed. If you want to try this tutorial from scratch you can ...
1 comment
Read more