I am new to API gateways and am trying to understand how they work. I am using WSo2 but figured they all probably work on same fundamentals.
I have a backend API written in SOAP which works fine.
I created a WSo2 API that connects to my backend SOAP API through swagger and works fine.
I also ran Wso2 endpoint from SOAP ui and got my response.
Next step is to create a client that will invoke WSo2 API and will eventually hit the backend SOAP API and get a response back. Should I use SOAP Backend API WSDL to create java objects while writing client for WSO2 API I created in step 2?
So:
wso2 client -> wso2 API -> backend SOAP API
and I create backend SOAP API WSDL to create java objects for wso2 client?
Usually, for REST APIs the gateways expose OAS documents and you can use those to generate REST API clients.
However, in case of SOAP APIS, the gateways mostly work in passthrough manner. In that case, if you want to generate a client you can use the backend WSDL.
Related
How to setup wso2 api gateway.
Is it possible to modify/customize behavior of WSO2 gateway
We have our own OAuth server and want to redirect each and every request to OAuth server for authorizing request.
Once request is authorized then gateway should redirect that to back end service/api
We want add some filtering logic as well.
Yes, this is possible with third party key manager support in WSO2 API Manager [1].
The basic idea in here is when generating a token, the token request will go to the OAuth server of yours via the key manager component of API Manager.
When an API request comes in, the gateway send the token validation request to the key manager component of the API manager. From here, you can call the OAuth server of yours to validate the token.
To accomplish your requirement you have to write your logic in Java language. Sample can be found in [2].
https://apim.docs.wso2.com/en/latest/install-and-setup/setup/distributed-deployment/configure-a-third-party-key-manager/#configure-a-third-party-key-manager
https://github.com/wso2-extensions/apim-keymanager-okta/blob/OKTA-OAuth-Client-2.0.0/docs/config.md
WSO2 Documentation is not clear on how does the publishing of new API works.
Is is the publisher that pushes new API to the gateways ?
or
Is is the gateways that pulls or call new API configurations from the Manager ?
or
It is done through the database ?
And which protocol and ports does is uses ? An API Call, thrift, binairy ?
Thanks
There are 2 things happening when you publish an API.
1) Persist API metadata in the database. Both the API Publisher and the API store pull these data from the database to display APIs.
2) Runtime artifact (i.e. Synapse file) is deployed in the gateway. This is done via a SOAP web service call. The API Publisher calls a SOAP web service exposed in the gateway for this.
Hope I answered your question.
Using my API Gateway WSO2, I want to call my backend services (my endpoints) that are secured with OAuth (ACCES-Token). But I cannot find how to do that.
It's even mentioned on the WSO2 website that by using API publisher (of WSO2 AM) you can only configure your APIs to call services secured with username/password : https://docs.wso2.com/display/AM210/Working+with+Endpoints
You cannot call backend services secured with OAuth through APIs created in the API Publisher. At the moment, you can call only services secured with username/password.
Do you know if there is another way to do this without using the API Publisher ?
Mu browser (SET API Gateway Access-Token) -- API Gatewau WSO2 (SET my Backend services Acess-Token) --> My backend services
Thank you !
You cannot call backend services secured with OAuth through APIs created in the API Publisher. At the moment, you can call only services secured with username/password.
Out-of-box from the API Publisher you can directly authenticate with the backend using Basic authentication (username and password)
Do you know if there is another way to do this without using the API Publisher ?
well - the Publisher app is always involved
I want to call my backend services (my endpoints) that are secured with OAuth (ACCES-Token)
There are multiple ways how to authenticate with the backend, not all are so straightforward
Basic authentication (this is what you don't want)
JWT token - the API Manager is able to send a signed JWT token with the API calls to the backend and the backend service could authenticate and extract client details from the JWT token.
Using the inbound mediation configuration you could manipulate the request payload and metadata
With the point 3 you should be able to send a custom OAuth/Authorization header. The question is - with what identity provider your service is authenticating/authorizing?
The problem is that there's no unified configuration how your service's client (API manager calling the backend) would fetch / cache / refresh / revoke the token which would work with all possible identity providers.
In theory you could implement the OAuth authentication with external IdP using the inbound mediations (sequences), but I strongly urge do not put anything complex as API mediation for sake of maintainability (been there, done that, screw it badly)
Maybe the simplest option would be having a permanent token you could pass in the HTTP headers, it sounds simple enough.
There is a custom Oauth2 mediator which you can try. https://github.com/imesh/wso2-oauth-mediator
I was thinking of using my own custom api gateway running on a separate box using nginx.
Is there any way in which the WSO2 API Manager can integrate to my api gateway?
In case there isn't, wanted to know if there's the possibility to run WSO2 API Manager without (or disabling) the API Gateway and if you could tell me which WSO2 API Manager's features would be unavailable.
Currently there's no way of replacing the gateway since we do the authentication, throttling, etc using synapse handlers. Here I am not sure about your use case of using nginx but what you can do is you can use nginx endpoint when you create the API or on the other way around you can route nginx traffic to API Gateway (you need to fix the API endpoints appearing in the API manager store view to point to nginx). Basically API layer need to be on top of service layer.
I 'm looking for a tool to host and publish APIs documentation so
that users of the api can browse it and test it right from the
documentation web page
If i got it correctly, you need a API store only to host your APIs.You can try enterprise store The documentation can be found here
In the link
http://blog.facilelogin.com/2008/10/wsas-hiddedn-services.html I saw WSo2 Soap apis , can I get it's equivalent rest apis. And an example which shows how to pass authentication details. I need this one for wso2 Identity server.
In Identity server, You can find many management web services API that can be used for authentication, authorization, user management and so on. Could you let us know the API that you are looking for.. then we can say what is exact web service that you could use. As an example for XACML based authorization, there are "EntitlementService" web service where you can find more details here. But still rest API is not available for this service.
Normally it is mentioned these web service API as admin services in WSO2 products.
Currently (With IS 450), It has a rest API for user management based on SCIM where you find them here. However, you can expose all SOAP based API as Rest API using WSO2 APIM product.