...
A lot of applications need access to non-sensitive data (P1). To provide for those needs we will use the Campus API Gateway to restrict access to only known clients. But, those clients will NOT need to be known to the Resource Server. This should be the simplest machine-to-machine interactions the Campus API Gateway needs to provide.
Real World Scenario: A web application needs to retrieve Registrar class level code translations in order to display it on the screen. The web application will need to call through the API Gateway to the Lookupsr service. The Lookups service does not need to know what client is calling it; it only needs to trust that the API Gateway verified the client has permissions to make the call.
Goals
- Provide access to non-sensitive data (P1)
- Provide the least amount of security needed to gain access
- Enforce security through all access going through the Campus API Gateway
- Enforce security through IP/DNS access restrictions to the Resource Servers
...