APIC community,
We are using IBM API Connect 10.0.8.5-3580 and use IBM Verify (ISAM) as a 3rd party OAuth provider. Any API client should obtain a JWT token from ISAM before calling the API hosted in APIC. My use case is exactly the one described by OAuth introspection for third-party OAuth providers - IBM Documentation. To improve the throughput yet maintain the JWT token based security, we like to explore options we can cache the initial token introspection result until it expires.
Currently, we have a complete custom gateway script to extract the bearer token from incoming HTTP request (in the HTTP header), initiate a url connection with ISAM (POST with the JWT token), and parse the ISAM JSON response for status and claims (if active:true)
Step 1: extract the token
var auth_t = context.get("request.headers.Authorization");
var tokenArray = auth_t.split(" ");
var token = tokenArray[1];
Step 2: OAuth introspection
var t_data = "client_id=" + introspect_client_id + "&client_secret=" + introspect_client_secret + "&token="+token;
var options = {
target: token_introspect_endpoint,
method: 'post',
contentType: 'application/x-www-form-urlencoded',
data: t_data,
timeout: 60,
sslClientProfile: 'tls-client-profile-catalog-default'
};
urlopen.open(options, function(error, response) ....
Step 3: Parse introspection result for status and claims
if (responseData.active) {
..... extract claims
}
One unique constraint: we can not use the peering node setting with our current setting, so two API gateway (Datapower) nodes are running independently and are only workload balanced.
Questions:
1. Can I cache the token introspection result (the JSON response) in the custom gateway script? and how?
2. If it is a better option to cache using built in policies, can you please advise how to configure in this scenario considering we are using 3rd party IDP and datapower peering is not possible? In my use case, how which flow an API client obtain the token from ISAM is irrelevant as the bearer token payload structure is same, and APIC only needs the introspection result for auth purpose.
Any advice and guidance is greatly appreciated.
Thanks and regards,
------------------------------
Z Yu
------------------------------