Virtualize REST APIs in API Manager

• Name: Enter the required name for the device. Defaults to API Key Device.

• API key field name: Enter a required name used to store the API key field in the inbound request. Defaults to KeyId.

• API key location: Select the required location of the API key in the inbound request (Request Headers or Query string/form body). Defaults to Request Headers.

• Remove credentials on success: Select whether to remove the user credentials from the message after successful authentication. This is selected by default.

• Name: Enter a required name for the device. Defaults to AWS Signing Device (Authorization Header).

• Remove credentials on success: Select whether to remove user credentials from the message after successful authentication. This is selected by default.

• Name: Enter a required name for the device. Defaults to AWS Signing Device (Query String).

• API key field name: Enter a required name of the query-string parameter used to store the API key field in the inbound request. Defaults to AWSAccessKeyId.

• Name: Enter a required name for the device. Defaults to HTTP Basic Device.

• Realm: Enter the realm required for HTTP basic authentication purposes (for example, Flickr). This enables clients to identify the zone that they are accessing. For example, the browser can then cache user credentials on a per-realm basis. The realm is required for all authentication schemes that issue an authentication challenge.

• Remove credentials on success: Select whether to remove user credentials from the message after successful authentication. This is selected by default.

Configure the following to use a custom authentication policy:

• Name: Enter the name of the custom security device. Defaults to Invoke Policy.
• Policy to invoke: Select the authentication policy that this security device invokes. This lists policies already configured in Policy Studio in Server Settings > API Manager > Inbound Security Policies. For more details, see Configure API management settings in Policy Studio.
• Use client registry: Select whether the authentication.subject.id identifier must match one of the application's external credentials in the Client Registry in API Manager. This is selected by default.
• Traffic Monitor subject: If Use client registry is not selected, the API has no client information. Enter the subject name to display in the Traffic tab in API Gateway Manager. Defaults to ${authentication.subject.id}.

• Description: Select where the Markdown description for this security device is located. For details on writing documentation with Markdown, see http://daringfireball.net/projects/markdown/. Select one of the following:

• • Use original policy description: Use the policy description specified when creating the policy in Policy Studio.
  • Use manual description: Get the description from the contents of a field. Enter the description in the Manual Description field.
  • Use markdown file location: Get the description from a file located on the server. Enter the path to this file in the Markdown file location field.

  Note

  For security reasons, this file must start with an environmentalized variable and cannot attempt directory traversal. For example, the following path is valid:

  ${env.DOCUMENTS}/markdown/api.md

  The following paths are invalid:

  /opt/documents/api.md

  ${env.DOCUMENTS}/../markdown/api.md

  • Use external URL: Get the description from an external URL. Enter the URL in the External URL location field.

Configure the following to enable OAuth authorization:

General:

• Access token store: Select a required OAuth access token store from the list. For details on how to add OAuth access token stores to this list, see Configure API Manager.
• Scopes must match: Select whether the OAuth scopes match Any or All of the OAuth scopes configured in the next field. OAuth scopes are used to control how access tokens are accepted. For more details on OAuth scopes, see the API Gateway OAuth User Guide.
• Scopes: Enter a comma-separated list of OAuth scopes used to manage how access tokens are accepted. Defaults to resource.WRITE, resource.READ.
• Remove credentials on success: Select whether to remove user credentials from the message after successful authentication and authorization. Enabled by default.

Authorization:

• Access token location: Select the required location of the OAuth access token in the inbound request (Request Header or Query string/form body). Defaults to Request Header.

• Authorization header prefix: Select the header prefix used to authorize the request (Bearer or OAuth). Defaults to Bearer.

Grant Type: Implicit:

• Enabled: Select whether to enable this simplified authorization code flow optimized for browser-based clients. Enabling advertises this grant type in the API Catalog. It is the role of the OAuth authorization server to support it. Disabling excludes this grant type from the API Catalog.

• Login endpoint URL: Enter the authorization endpoint where resource owners can interact with the OAuth service to authorize access for the client application. This is the URL where client applications will redirect end users. Defaults to http://localhost:8089/api/oauth/authorize.

• Login token name: Enter the response parameter name that will contain the access token. Defaults to access_token.

Grant Type: Authorization Code:

• Enabled: Select whether the authorization code is obtained using an authorization server as an intermediary between the client and resource owner. Enabling advertises this grant type in the API Catalog. It is the role of the OAuth authorization server to support it. Disabling excludes this grant type from the API Catalog.

• Request endpoint URL: Enter the authorization endpoint where resource owners can interact with the OAuth service to authorize access for client application. This is the URL where client application will redirect end users. Defaults to http://localhost:8089/api/oauth/authorize.

• Request client ID name: Enter the name of the request parameter that will contain the client application ID. Defaults to client_id.

• Request client secret name: Enter the name of the request parameter that will contain the client application secret. Defaults to client_secret.

• Token URL: Enter the token endpoint URL where the client application will exchange an authorization code for an access token. Defaults to http://localhost:8089/api/oauth/token.

• Token name: Enter the request parameter name that will contain the access code. Defaults to access_token.

Configure the following to enable OAuth authorization:

General:

• Token information policy: Select a required OAuth token information policy from the list. This is a custom policy used to obtain and extract token information from the external OAuth provider. For details on how to add OAuth token information policies to the list, see Configure API Manager.

• Scopes must match: Select whether the OAuth scopes match Any or All of the OAuth scopes configured in the next field. OAuth scopes are used to control how access tokens are accepted. For more details on OAuth scopes, see the API Gateway OAuth User Guide.

• Scopes: Enter a comma-separated list of OAuth scopes used to manage how access tokens are accepted. Defaults to resource.WRITE, resource.READ.

• Remove credentials on success: Select whether to remove user credentials from the message after successful authentication and authorization. Enabled by default.

• Use client registry: Select whether to use the Client Registry in API Manager. If this is not selected, the API is effectively pass-through and the Client Registry does not apply API access or enforce quotas. If this is selected, API Manager can use OAuth external credentials to identify the client application, apply quotas, and assign a subject identifier for traffic monitoring. This is not selected by default because external OAuth providers typically use their own client registries.

• Traffic monitor subject: Enter the identifier name used for clients from the external OAuth provider, which is displayed on the Traffic tab in the API Gateway Manager console. This value can be a selector. Defaults to ${oauth.token.client_id}.

• Extract token attributes: Click the add button to specify OAuth token attributes to be extracted from the configured Token information policy and copied to the message whiteboard. For example, these can then be passed to request, response, or routing policies downstream. Specifying attributes ensures their values are retained on the whiteboard after invoking the policy. By default, the following attributes are extracted:

  • oauth.token.client_id

  • oauth.token.scopes

  • oauth.token.valid

Authorization: See the OAuth security device settings.

Grant Type: Implicit: See the OAuth security device settings.

Grant Type: Authorization Code: See the OAuth security device settings.

• Name: Enter a required name for the device. Defaults to Pass Through Device.

• Subject ID: Enter a required authentication subject ID. Defaults to Pass Through. This will be displayed in the Traffic view in the API Gateway Manager when the API is invoked using this device.

• Name: Enter a required name for the profile. Defaults to HTTP Basic.

• Username: Enter the required username (API key) used to access the API.

• Password: Enter the optional password (API secret) used to access the API.

• Name: Enter a required name for the profile. Defaults to HTTP Digest.

• Username: Enter the required username (API key) used to access the API.

• Password: Enter the optional password (API secret) used to access the API.

• Name: Enter a required name for the profile. Defaults to API key.

• API key field name: Enter a required name used to store the API key field in the outbound request (for example, KeyId).

• API key: Enter the API key required to access the API (for example, AIzaSyB6CzrBlkzuzDKJw0QaZhW9WwBV5IxXMS7).

• Pass credentials as HTTP: Select the required location of the API key in the outbound request (Header, Query string, or Form).