Page Comparison

Authorization

Gateway provides different mechanisms to manage authorization in secured environments. One of the most effective and powerful methods is secured endpoints allowing MOC administrators to restrict restricting access to internal MOC endpoints though through configuration properties at the Gateway.

Securing endpoints through the gateway

This configuration requires two components:

1. Rule base authorities

2. Protected endpoints.

1- Rule base authorities:

Allow mappings between OAuth2 token claims and Granted Authorities.

...

- authority-name: GrantedAuthorityNameToBeAssigned
    claim-value-condition:
        claims: token_claim_name_one,token_claim_name_two
        values: expected_value_one,expected_value_two

Which can be translated to:

If token claims contains any of the next keys: token_claim_name_one OR token_claim_name_two, and the value equals any of expected_value_one OR expected_value_two then request will get GrantedAuthorityNameToBeAssigned as Granted Authority.

Sample configurations:

oauth2:
  resource-server:
    authorization:
      rule-based-authorities:
        - authority-name: modelopEngineOnlyModelManage
          claim-value-condition:
            claims: user_id,client_id
            values: model-manage
        - authority-name: modelopEngineOnlyModelManageAndMlc
          claim-value-condition:
            claims: user_id,client_id
            values: model-manage,mlc-service
        - authority-name: modelop-monitor
          claim-value-condition:
            claims: user_id,client_id
            values: model-manage,mlc-service

...

modelopEngineOnlyModelManage,modelopEngineOnlyModelManageAndMlc,modelop-monitor

2- Protected endpoints

These protected endpoints are defined under:

...