Oracle® Fusion Middleware
Part 3. Manage the API Gateway

By default, the API Gateway configuration data is stored unencrypted. However, you can encrypt sensitive information such as passwords and private keys using a passphrase. When the passphrase has been set (and the data has been encrypted with it), you must then enter the passphrase when connecting to the API Gateway with the Policy Studio, or when the API Gateway is starting up, so that the encrypted data can be decrypted. You can enter the encryption passphrase at the level of an API Gateway group or an API Gateway instance.

All sensitive information in the API Gateway configuration data is encrypted when you set an encryption passphrase. For example, this sensitive information includes passwords that the API Gateway requires for connecting to external systems (databases, LDAP, and so on), or private keys that are not stored on a Hardware Security Module (HSM).

This topic describes how to specify the encryption passphrase when connecting to the API Gateway with the Policy Studio, in your API Gateway configuration file, or when the API Gateway is starting up. It also describes how to change the API Gateway group passphrase when it has been set initially.

You can use the Policy Studio topology view to set the passphrase used to encrypt the API Gateway group data. This is the table displayed when you connect to the Admin Node Manager. To change the passphrase, right-click the API Gateway group name in the table (for example, QuickStart Group), and select Change Passphrase.

Complete the following fields on the Change Group Passphrase dialog:

Old Passphrase:

Enter the old passphrase that you wish to change in this field. Alternatively, you can leave this field blank if you are setting the passphrase for the first time.

New Passphrase:

Enter the new passphrase.

Confirm New Passphrase:

Re-enter the new passphrase to confirm it.

When you have set the encryption passphrase for the API Gateway group configuration data, you must enter this passphrase every time you connect to the API Gateway in the Policy Studio. You can enter it in the Passphrase field of the Open File dialog, which is displayed when connecting to a configuration file. Alternatively, you can enter it in the Enter Passphrase dialog, which is displayed before editing an active server configuration.

For the API Gateway to read (decrypt) encrypted data from its configuration, it must be primed with the passphrase key. You can do this using the Policy Studio, as explained in the previous section. You can also enter the passphrase directly in a configuration file, or prompt for it at startup.

Entering the Node Manager passphrase in a configuration file

You can enter a passphrase directly in the Node Manager's configuration file. Open the following file in your API Gateway installation:

INSTALL_DIR/system/conf/nodemanager.xml

This file contains values for general system settings, such as the server name and trace level, and also (if required) the passphrase key to use to decrypt encrypted API Gateway configuration data.

Typically, the passphrase is only entered directly in the file if the server must be started as a Windows service or UNIX daemon. In this case, the administrator cannot enter the passphrase manually when the server is starting. To avoid this, you must enter the passphrase in the configuration file. You should specify the passphrase as the value of the secret attribute as follows, where "myPassphrase" is the encryption passphrase:

secret="myPassphrase"

Enter the API Gateway instance passphrase in a configuration file

You can also enter the passphrase for individual API Gateway instances created using the managedomain script. To do this, enter the secret attribute in the service.xml file for your API Gateway instance. For example:

INSTALL_DIR/groups/group-id/instance-id/conf/service.xml

Prompt for the passphrase on server startup

If you do not wish to enter the passphrase directly in the Node Manager or API Gateway instance configuration file, and do not need to start as a Windows service or UNIX daemon, you can configure the Node Manager or API Gateway to prompt the administrator for the passphrase on the command line when starting up. To do this, enter the "(prompt)" special value for the secret attribute as follows:

secret="(prompt)"

For more details, see the API Gateway Installation and Configuration Guide.

When you promote and deploy passphrase protected configuration between environments (for example, from testing to production), the passphrase for the target configuration (production) must be the same as the passphrase in the source configuration (testing). If you are using a different passphrase in each environment, before the deployment takes place, you must make a copy of the configuration (for example, .fed file), and set it with the passphrase of the target configuration.

For more details, see the API Gateway Deployment and Promotion Guide.