[Apiman-user] Securing apiman admin resources and ports

[Eric Wittmann]

Hi Paul.  Thanks for the questions.  I'll do my best to answer each one, 
inline below:

On 11/24/2015 11:53 AM, Paul Blair wrote:
> One alternative for us would be to run the gateway and management
> console with embedded Jetty instead of Wildfly as described in the
> recent post on micro-services. Since we want all authentication to go
> through Keycloak it looks like we'd need to modify the authentication
> handlers/filters in the gateway. Is there a good example of how to go
> about writing an authentication handler for Keycloak?

I think KeyCloak already has a Jetty adapter implementation.  Of course, 
you would still need a standalone KeyCloak server running somewhere to 
take advantage of that.

http://keycloak.github.io/docs/userguide/keycloak-server/html/ch08.html#jetty9-adapter

> What would we be giving up if we were to go with the micro-service
> approach rather than running on Wildfly? One thing I know we'd be giving
> up is the HA clustering. Is apiman stateless? Could we just run multiple
> Jetty instances and load balance across them?

Once the authentication issue is resolved, I don't think you give up 
anything except for the ease of mind you get running on an application 
server like EAP or WildFly versus an embedded instance of Jetty. 
Certainly there is no loss in terms of feature set.

As for HA clustering - apiman doesn't take advantage of that.  The API 
Manager is basically a simple CRUD application - you can start up 
multiple nodes and point them all at the same database.  Likewise, the 
Gateway shares state and configuration information by sharing a common 
data store (e.g. elasticsearch).

You can definitely start up multiple instances of the apiman 
micro-service(s) and load balance across them!

> If we stay on Wildfly we'd like to secure the Wildfly management console
> using Keycloak, which I read is possible using Wildfly 9. Is there any
> issue with deploying apiman to Wildfly 9?

We don't currently have a WildFly 9 distribution.  I admit I simply 
haven't had time to try it out.  It may work flawlessly or it may 
require some tweaks.  We won't know until we try.  :)  In the near 
future (early in the 1.2.x line) we will be upgrading our keycloak 
support, which will require us to upgrade to WildFly 9 - so that should 
be coming soon (i.e. in the next month or two).

-Eric