Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 16 Next »

Project TitleCampus API Gateway
Target Release
Epic
Document Status
DRAFT
Document Owner

Document Sign-Off
Subject Matter Expert(s)
Technical Expert(s)

Background & Business Value

A lot of applications need access to non-sensitive data (P1). To provide for those needs we will use the Campus API Gateway to restrict access to only known clients. But, those clients will NOT need to be known to the Resource Server. This should be the simplest machine-to-machine interactions the Campus API Gateway needs to provide.

Goals

  • Provide access to non-sensitive data (P1)
  • Provide the least amount of security needed to gain access
  • Enforce security through all access going through the Campus API Gateway
  • Enforce security through IP/DNS access restrictions to the Resource Servers

Out of Scope

  • Anything that has to do with data classified as P2 or higher.

Assumptions

Requirements

Ticket(s)TitleUser StoryPriorityNotes

Call Non-Sensitive APIAs a Client Developer, I need to authenticate my calls to the Campus API Gateway in order to get access to non-sensitive endpoints (/students/lookups)MUST HAVE
  • Should only need to provide Service Account ucsbNetId and password.
  • OAuth call should go against Apigee OAuth endpoint.
    • Apigee will pass through the call to Campus IdM
    • The Campus IdM response will pass through back to the client

Authenticate ClientAs a Campus IdM Admin, I need to authenticate the Client Application before the Campus API Gateway can grant accessMUST HAVE

Client Info Storage in Campus API GatewayAs a Campus API Admin, I need to retrieve Client Application information for future request verifications.MUST HAVE
  • Campus IdM access tokens will need to be stored in the Apigee OAuth Provider.
  • Apigee will need to store the access token and client_id in the OAuthV2/GenerateAccessToken policy. This will be used for verification/validation in subsequent calls from the client through Apigee.

User Interaction, Design & Architecture

Service Architecture (PowerPoint)



Sequence Diagram for OAuth Token (WebSequenceDiagrams Link)



Sequence Diagram for JWT (WebSequenceDiagrams Link)

Examples and References

Questions

Below is a list of questions to be addressed as a result of this requirements document:

QuestionOutcomeDecision Date
What is the format of the result JWT contents?

Do Service Accounts have to be created in a particular way to ensure the desired claims are always returned?

Desired Claims

  • ucsbNetId of Resource Owner
  • ucsbCampusId of Resource Owner
  • ucsbNetId of Client


  • No labels