Versions Compared

Old Version 11

changes.mady.by.user Steven Maglio

Saved on

compared with

New Version 12

changes.mady.by.user Steven Maglio

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

  • Campus IdM will support client_credential grant using ucsbNetId and password for Application Accounts (Service Accounts).
  • Application Accounts (Service Accounts) Description from ETSC (UCSB isDesk):
    > 2018-05-25 10:06:09 - Laurie Branagan (Additional comments)
    > App accounts were created to allow for programmatic access to the
    > directory without embedding a person's credentials in the application. They
    > were not scoped to be used for authorization beyond access to the
    > directory. It's understood this utility is somewhat limited.
    > If what you're requesting is non-person entities in the directory - That
    > feature is on the roadmap document that the Identity Advisory Group drafted
    > last year. It has not been implemented.
  • Campus IdM will support an OAuth 2.0 introspection endpoint.
  • Campus IdM will be able to store the Apigee client_id.
  • All calls will be over HTTPS.
  • Basic Security Requirements

Requirements

Ticket(s)TitleUser StoryPriorityNotes

Call Non-Sensitive APIAs a Client Developer, I need to authenticate my calls to the Campus API Gateway in order to get access to non-sensitive endpoints (/students/lookups)
Status
colourGreen
titlemust have
  • Should only need to provide Service Account ucsbNetId and password.
  • OAuth call should go against Apigee OAuth endpoint.
    • Apigee will pass through the call to Campus IdM
    • The Campus IdM response will pass through back to the client

Authenticate ClientAs a Campus IdM Admin, I need to authenticate the Client Application before the Campus API Gateway can grant access
Status
colourGreen
titlemust have

Client Info Storage in Campus API GatewayAs a Campus API Admin, I need to retrieve Client Application information for future request verifications.
Status
colourGreen
titlemust have
  • Campus IdM access tokens will need to be stored in the Apigee OAuth Provider.
  • Apigee will need to store the access token and client_id in the OAuthV2/GenerateAccessToken policy. This will be used for verification/validation in subsequent calls from the client through Apigee.

...

Service Architecture (PowerPoint)

Image RemovedImage Added



Sequence Diagram (WebSequenceDiagrams Link)

...