[Apiman-user] Forwarding HTTP requests to service implementations secured by OAuth

[Eric Wittmann]

Right - at this point a custom policy is probably the only reasonable 
approach.

I've added OAuth support between the Gateway and back-end API as a 
feature request here:

https://issues.jboss.org/browse/APIMAN-811

-Eric

On 11/30/2015 6:31 AM, Marc Savy wrote:
> Hi Ton,
>
> Sorry, I forgot to reply to this.
>
> In essence, you are correct. There's no in-built mechanism to achieve
> what you want (i.e. gateway acting as an OAuth2 *client*).
>
> You could indeed use the simple header policy to store a long-lived
> token, but this should not be considered a particularly secure approach
> (particularly if there's a chance that the token could be exposed
> somehow - e.g. by a user looking at the policy config in the UI).
>
> The second issue, which you are undoubtedly aware of, is that there is
> no mechanism to auto-refresh those token(s) once expired.
>
> Another option which you could explore is to create a custom policy
> which does the periodic refreshing of tokens for you.
>
> Regards,
> Marc
>
> On 18/11/2015 15:11, Ton Swieb wrote:
>> Hi Marc,
>>
>> That is correct.
>>
>> Regards,
>>
>> Ton
>>
>> 2015-11-18 16:02 GMT+01:00 Marc Savy <marc.savy at redhat.com
>> <mailto:marc.savy at redhat.com>>:
>>
>>      Hi Ton,
>>
>>      Just to clarify. From what I understand, you're trying to secure
>>      communications between the apiman gateway and back-end service using
>>      OAuth2/OpenID Connect?
>>
>>      I.e. You are *not* OAuth2 simply between the client to the apiman
>>      gateway.
>>
>>      Regards,
>>      Marc
>>
>>      On 18/11/2015 14:34, Ton Swieb wrote:
>>
>>          Hi,
>>
>>          I am using Apiman 1.1.8.Final and I want to use a backend service in
>>          Apiman which is secured by OAuth.
>>          So instead of securing the Apiman side of the service, using the
>>          Keycloak OAuth plugin, Apiman needs forward calls to a service
>>          implementation that is secured by OAuth. I have got an OAuth
>>          token with
>>          a very long time to live (days/weeks/months) which I can use.
>>
>>          Currently I only see the option to configure BASIC Authentication or
>>          MTLS/Two-Way-SSL on the service implementation.
>>          Would it be possible to add the HTTP Simple Header policy to the
>>          service
>>          and set the Authorization header with "Bearer........." or will
>>          that be
>>          stripped off by Apiman when forwarding the call to the backend
>>          service?
>>
>>          Kind regards,
>>
>>          Ton
>>
>>
>>          _______________________________________________
>>          Apiman-user mailing list
>>          Apiman-user at lists.jboss.org <mailto:Apiman-user at lists.jboss.org>
>>          https://lists.jboss.org/mailman/listinfo/apiman-user
>>
>>
>
> _______________________________________________
> Apiman-user mailing list
> Apiman-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/apiman-user
>