CODEWITHSUNDEEP
oauthjwtauth0apigee
Chris Jager
Chris Jager

Reputation: 123

Let Apigee do authentication (oauth) for client

I have a service protected with OAuth. For it to use, you first require a token. I have an app, that has only access to an Apigee proxy. I would like Apigee to do the authentication for the client (app), and setup protection with an API key for the client in Apigee. How do I do that?

Upvotes: 0

Views: 2040

Answers (3)

wottle
wottle

Reputation: 13619

I think what you are trying to do is what Apigee refers to as Last Mile Security. Unfortunately, it's not as simple as adding a policy and configuring it with a token URL, client ID, and secret. You'll want to make sure you securely store the credentials, cache the token appropriately, and pass the token on to the proxy target.

Fortunately for you, Apigee has a demo project that does what I believe you are trying to do. Basically, your proxy will be configured with simply the Verify API Key Policy (Do this first as if the api key isn't correct, no need to do all the OAuth handshaking). Once confirmed, you can use Javascript policies to check the cache for a token, and then call the OAuth token endpoint to get one if there is a cache miss. I believe it then uses the AssignMessage policy to set the Authorization header to the token. (Note that the example project does not include the Verify API Key policy, but that should be easy enough to add)

Additionally, the demo project stores the client ID and secret in a js file, which I would not recommend. Maybe store it in an encrypted KVM entries?

The Outbound OAuth sample project can be found here.

Upvotes: 2

rafapc2
rafapc2

Reputation: 466

You can use Ouath2 - client credential grant Type, that implies that you must add and configure security policies in your proxy, check the following link that explains this flow.

https://docs.apigee.com/api-platform/security/oauth/oauth-20-client-credentials-grant-type

Upvotes: 0

Aman Malviya
Aman Malviya

Reputation: 86

please refer to below videos for using oauth authentication in your API proxies:

https://www.youtube.com/watch?v=zn94GhcdgHc&list=PLsWqc60hQz4clQ4ykjCu4qyEhdKe11Lvy

Upvotes: 0

Related Questions