Invoke REST Adapter Trigger-Based Integrations with Oracle Cloud Infrastructure Principal Signed Requests

You can configure Oracle Cloud Infrastructure principal signed requests to pass both authentication and policy authorization details to REST Adapter trigger-based integrations.

This use case provides a high level overview of how to invoke and pass both authorization and authentication requests to Oracle Integration REST Adapter trigger-based integrations.

  1. Create and configure two integrations. For this example, an RPST_CLIENT_GET parent integration and an RPST_SERVICE_GET child integration are created.


    Screenshot of an integrations table showing two active integrations: RPST_SERVICE_GET (version 1.0.0, Application) and RPST CLIENT GET (version 1.0.0, Schedule). Debug tracing is set. The scheduled integration notes “No schedule defined.”

  2. Define an Oracle Cloud Infrastructure Identity and Access Management policy in the Oracle Cloud Console to use for authorization evaluation at runtime. For this example, the RPST_SERVICE_GET child integration to invoke is defined in this policy.
    allow any-user to {INTEGRATION_FLOW_RUN} in compartment development-adapters-l1 
where all {target.resource.id = 'ocid1.integrationinstance.oc1.iad.anaaaaaazxn3ynia5lvwsdgxnfrlsq1tjddvju4mzmqrke5286ldq3qm33ra', 
target.resource.kind = 'integration-instance', resource.type = 'integration-instance', target.flow.id = 'RPST_SERVICE_GET'}

    See Create Policies for Authorization Use with a Oracle Cloud Infrastructure Principal Signed Request.

  3. Create REST Adapter invoke and trigger connections in these integrations that are configured with the following security policies.
    Integration Connection Security Policies to Use Security Policy Defined
    RPST_CLIENT_GET

    (parent integration)

    Create and configure a REST Adapter invoke connection in this integration with the OCI Service Invocation security policy.

    This invoke connection signs the policy request with an OCI signature for authentication and sends it to the trigger connection in the RPST_SERVICE_GET child integration.


    Properties form for a REST API connection: connection type set to “REST API Base URL,” an Oracle Cloud connection URL, security policy set to “OCI Service Invocation,” and access type set to “Public gateway” for internet-facing endpoints.
    RPST_SERVICE_GET

    (child integration)

    Create and configure a REST Adapter trigger connection in this integration with the OCI Principal(s) Signature Authentication security policy to receive the request.

    Once the policy request from the invoke connection is authenticated, Oracle Cloud Infrastructure Identity and Access Management policies are used for authorization.


    Security settings showing the policy set to “OCI Principal(s) Signature Authentication” and access type set to “Public gateway,” allowing internet-facing endpoints.
  4. Run the RPST_CLIENT_GET parent integration. The invoke connection (for this example, named callRp) in this integration calls and passes both authentication and policy authorization details to the RPST_SERVICE_GET child integration.

    The activity stream shows the request for authorization was evaluated successfully and the integration was run.


    Oracle Integration “RPST CLIENT GET (1.0.0)” configuration page with user l1serviceadmin selected and “Ad hoc request” chosen. The activity stream on the right shows a scheduled run progressing through data mapping and the “Invoke callRp” step, then completing successfully.

    Note:

    In addition to RPST authentication, the OCI Service Invocation security policy also supports instance principals and OCI user signature authentications to invoke another integration.