Oracle® Fusion Middleware

Oracle API Gateway Administrator Guide

11g Release 2 (11.1.2.4.0)

Oracle API Gateway Administrator Guide, 11g Release 2 (11.1.2.4.0)

Copyright © 1999, 2015, Oracle and/or its affiliates. All rights reserved.

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

If this software or related documentation is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable:

U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, the use, duplication, disclosure, modification, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle USA, Inc., 500 Oracle Parkway, Redwood City, CA 94065.

This software is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure the safe use of this software. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software in dangerous applications.

Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners.

This software and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services. This documentation is in prerelease status and is intended for demonstration and preliminary use only. It may not be specific to the hardware on which you are using the software. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to this documentation and will not be responsible for any loss, costs, or damages incurred due to the use of this documentation.

The information contained in this document is for informational sharing purposes only and should be considered in your capacity as a customer advisory board member or pursuant to your beta trial agreement only. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. The development, release, and timing of any features or functionality described in this document remains at the sole discretion of Oracle.

This document in any form, software or printed matter, contains proprietary information that is the exclusive property of Oracle. Your access to and use of this confidential material is subject to the terms and conditions of your Oracle Software License and Service Agreement, which has been executed and with which you agree to comply. This document and information contained herein may not be disclosed, copied, reproduced, or distributed to anyone outside Oracle without prior written consent of Oracle. This document is not part of your license agreement nor can it be incorporated into any contractual agreement with Oracle or its subsidiaries or affiliates.

25 March 2015


Contents

What's new
New topics
Updated topics
1. API Gateway administration
Introduction to API Gateway administration
Overview
API Gateway form factors
Who owns the API Gateway platform and how is it administered?
Where do you deploy an API Gateway?
Where do you deploy API Gateway Analytics?
Secure the last mile
API Gateway administration lifecycle
Plan an API Gateway system
Overview
Policy development
Traffic analysis
Load balancing and scalability
SSL termination
High Availability and failover
Backup and recovery
Development staging and testing
Hardening—secure the API Gateway
Capacity planning example
How API Gateway interacts with existing infrastructure
Overview
Databases
Anti virus
Operations and management
Network firewalls
Application servers
Enterprise Service Buses
Directories and user stores
Access control
Public Key Infrastructure
Registries and repositories
Software Configuration Managment
2. Manage an API Gateway domain
Configure an API Gateway domain
Overview
Managedomain script
Register a host in a domain
Create an API Gateway instance
Test the health of an API Gateway instance
Manage domain topology in API Gateway Manager
Overview
Manage API Gateway groups
Manage API Gateway instances
Deploy API Gateway configuration
Configure Admin Node Manager high availability and security
Overview
Hierarchy of SSL certificates in a domain
How SSL certificates are generated for domain processes
Add the first Admin Node Manager to the domain
Add a Node Manager to the domain
Add an API Gateway instance to the domain
Change a Node Manager to an Admin Node Manager
Regenerate all SSL certificates in a domain
Managedomain command reference
Overview
Managedomain command interpreter mode
Managedomain interactive mode
Managedomain command mode
3. Manage API Gateway operation
Start and stop the API Gateway
Overview
Set passphrases
Start the Node Manager
Start the API Gateway instance
Connect to the API Gateway in Policy Studio
Stop the API Gateway instance
Stop the Node Manager
Start the API Gateway tools
Overview
Before you begin
Launch API Gateway Manager
Start Policy Studio
Run API Gateway as non-root on UNIX/Linux
Overview
Linux capabilities
Before you begin
Modify API Gateway file ownership
Set the CAP_NET_BIND capability on vshell
API Gateway appliance version 7.1.0 or later
Add API Gateway library locations
Modify the init.d script to use sudo
Modify the jvm.xml file
Restart the API Gateway
Run API Gateway as non-root on Solaris
Configure API Gateway high availability
Overview
HA in production environments
Load Balancing
Java Message System
File Transfer Protocol
Remote Hosts
Distributed caching
External Connections
Embedded Apache ActiveMQ
Embedded Apache Cassandra database
API Gateway backup and disaster recovery
Overview
Components that must be backed up
Back up API Gateway
Back up API Gateway Analytics
Back up databases and third-party systems
Disaster recovery plan and tests
Example of creating an API Gateway disaster recovery site
Further Information
Manage API Gateway settings
Overview
General settings
Logging settings
Messaging settings
Monitoring settings
Security settings
4. Manage API Gateway security
Configure an API Gateway encryption passphrase
Overview
Configure the passphrase in Policy Studio
Enter the passphrase when you edit configuration in Policy Studio
Provide the passphrase in a configuration file or at startup
Promotion between environments
Further information
Manage certificates and keys
Overview
View certificates and keys
Configure an X.509 certificate
Configure a private key
Configure HSMs and certificate realms
Configure SSH key pairs
Configure PGP key pairs
Global import and export options
Further information
Generate a CSR and import the certificate and key
Overview
How are certificates and keys stored in API Gateway?
What is OpenSSL?
Step 1: Create a private key and CSR
Step 2: Submit the CSR to the CA
Step 3: Import the certificate and key into Policy Studio
Further information
Manage API firewalling
Overview
Configure API firewalling
Monitor API firewalling
Further information
5. Deploy API Gateway configuration
Manage API Gateway deployments
Overview
Connect to a server in Policy Studio
Edit a server configuration in Policy Studio
Manage deployments in API Gateway Manager
Compare and merge configurations in Policy Studio
Manage Admin users in API Gateway Manager
Configure policies in Policy Studio
Deploy API Gateway configuration
Overview
Create a package in Policy Studio
Configure package properties in Policy Studio
Deploy packages in Policy Studio
Deploy a factory configuration in Policy Studio
Deploy currently loaded configuration in Policy Studio
Push configuration to a group in Policy Studio
View deployment results in Policy Studio
Deploy on the command line
Deploy packages in API Gateway Manager
6. Monitoring and reporting
Monitor services in API Gateway Manager
Overview
Ensure monitoring is enabled
View real-time monitoring
View traffic monitoring
View message content
View performance statistics
Detect malformed messages
Monitor real-time metrics
Configure dynamic trace, logging, and monitoring
Monitor and report on services with API Gateway Analytics
Redact sensitive data from API Gateway Manager
Overview
Redaction configuration
Enable redaction for an API Gateway
Redact HTTP message content
Redact JSON message content
Redact XML message content
Redact HTML form message content
Redact raw message content
Redact sensitive data from log files
Configure API Gateway for API Gateway Analytics
Overview
Connect to the API Gateway in Policy Studio
Configure the metrics database connection
Configure transaction audit logging to the metrics database
Configure the API Gateway to write to the transaction event log
Deploy the updated configuration to the API Gateway
Configure the Node Manager to process event logs and update the metrics database
Further information
Monitoring and reporting with API Gateway Analytics
Overview
Launch API Gateway Analytics
Monitor the API Gateway system
Monitor API services, methods, and clients
Monitor remote hosts
Monitor protocols
Audit transactions
Schedule custom reports
Further information
Configure scheduled report settings
Overview
Database configuration
Scheduled reports configuration
SMTP configuration
Purge the metrics database
Overview
Run the dbpurger command
Example commands
7. Troubleshoot your API Gateway installation
Configure API Gateway logging and events
API Gateway logs and events
Configure audit logs per domain
Configure transaction audit log destinations
Configure transaction audit logs per filter
Configure transaction event logs per API Gateway
Configure transaction access logs per path
Manage API Gateway events and alerts
Configure dynamic trace and log settings
Further information
Configure API Gateway diagnostic trace
Overview
View API Gateway trace files
Set API Gateway trace levels
Configure API Gateway trace files
Run trace at DEBUG level
Run trace at DATA level
Integrate trace output with Apache log4J
Get help with API Gateway
API Gateway performance tuning
Overview
General performance tuning
Advanced performance tuning
8. Manage user access
Manage API Gateway users
Overview
API Gateway users
Add API Gateway users
API Gateway user attributes
API Gateway user groups
Add API Gateway user groups
Update API Gateway users or groups
Manage Admin users
Overview
Admin user privileges
Admin user roles
Add a new Admin user
Remove an Admin user
Reset an Admin user password
Manage Admin user roles
Configure Role-Based Access Control (RBAC)
Overview
Local admin user store
RBAC Access Control List
Configure RBAC users and roles
Management service roles and permissions
Active Directory for authentication and RBAC of management services
Overview
Step 1: create an Active Directory group
Step 2: create an Active Directory user
Step 3: create an LDAP connection
Step 4: create an LDAP repository
Step 5: create a test policy for LDAP authentication and RBAC
Step 6: use the LDAP policy to protect management services
Add an LDAP user with limited access to management services
OpenLDAP for authentication and RBAC of management services
Overview
Step 1: create an OpenLDAP group for RBAC roles
Step 2: add RBAC roles to the OpenLDAP RBAC group
Step 3: add users to the OpenLDAP RBAC group
Step 4: create an LDAP connection
Step 5: create an OpenLDAP repository
Step 6: create a test policy for LDAP authentication and RBAC
Step 7: use the OpenLDAP policy to protect management services
9. Manage network-level settings
Configure a DNS service with wildcards for virtual hosting
Overview
DNS workflow
BIND DNS software
Configure a wildcard domain
10. Manage ActiveMQ messaging
Manage embedded ActiveMQ messaging
Overview
Manage messaging queues
Manage messages in a queue
Manage messaging topics
Manage messaging subscribers
Manage messaging consumers
11. API Gateway settings reference
General settings
Overview
Settings
MIME/DIME settings
Overview
Configuration
Namespace settings
Overview
SOAP Namespace
Signature ID Attribute
WSSE Namespace
HTTP Session settings
Overview
Configuration
Transaction audit log settings
Overview
Configure log output
Log to Text File
Log to XML File
Log to Database
Log to Local Syslog
Log to Remote Syslog
Log to System Console
Transaction access log settings
Overview
Configure the access log
Redact sensitive details from the access log
Transaction event log settings
Overview
Transaction event log formats
Configure the transaction event log
Embedded ActiveMQ settings
Overview
General messaging settings
SSL settings
Authentication settings
Traffic monitoring settings
Overview
Configuration
Real-time monitoring metrics
Overview
Enable monitoring
Configure real-time metrics