API Connect

 View Only
  • 1.  Gateway variables

    Posted 14 days ago

    Hello,
    We are trying to implement migration from V5 to V10 and stuck with lack of documentation about gateway variables.
    Our code that worked on v5 not working on v10 because getting dp:variable('var://context/_apimgmt/consumer') return 'undefined'.
    Where is the guides or any documentation for gateway variables that described var://context?
    Also how can we to obtain consumer information on v10 in same manner its implemented on v5 :
    const ctx = session.name('_apimgmt') || session.createContext('_apimgmt');
    const consumer = ctx.getVariable('consumer'); ?

    If this impossible for v10 how can we implement this logic?

    Thanks



    ------------------------------
    Sergey Paponov
    ------------------------------


  • 2.  RE: Gateway variables

    Posted 7 days ago

    Hi Sergey,
    The v5 API Connect Gateway was a DataPower multi-protocol gateway implementation that used DataPower context variables for the APIC framework's purposes.  It was never intended that customers would use any of the framework's var://context/<contextname>/<varname> in customer API policies, but since there was a DataPower probe for the MPGW many could open up the hood of the implementation, see what variables looks like they had data that could be used and then used those variables.  In some cases where we saw that being done, we added functionality to the v5 apim module/xslt to provide an encapsulation to those variables for future portability.  After all we could have changed the variable name or the contents thereof and broken your API.  As such the use of these variables was not officially supported and is definitely a migration issue since the v10 API Gateway is not a MPGW and doesn't use those variables.

    There are a number of variables in the API Gateway context for the client.  See https://www.ibm.com/docs/en/api-connect/10.0.5.x_lts?topic=reference-api-connect-context-variables.  A recent customer issue related to this same v5 framework variable (perhaps that is your PMR??) is relating to the consumer certificate.  If that is what you're needing out of the consumer variable, see https://www.ibm.com/docs/en/api-connect/10.0.5.x_lts?topic=reference-api-connect-context-variables#rapim_context_var__cert-variables but you must enable application authentication.  In the yaml source

      application-authentication:
        certificate: true

    Application authentication will require the client to provide a certificate in SSL Mutual Authentication's SSL handshake.  Would this meet your requirement of what you're trying to get out of the v5 framework consumer context variable?

    Regards,
    Steve Linn


    ------------------------------
    Steve Linn
    Senior Consulting I/T Specialist
    IBM
    ------------------------------



  • 3.  RE: Gateway variables

    Posted 4 days ago

    Hi Steve,

    Thank you for your answer,

    and thanks for  shared links, we'll try to change logic and flow of APIs with this features. (and yes, that is my PMR.)

    But we used these variables not only for certificate validation, in our logic we also using these variables for verifying customer existence on Developer Portal 

    as part of Dynamic Onboarding process, and with commons API Connect context variables this impossible to do ( correct me please if I wrong).

    So I would be like for sharing any suggestions about Onboarding and client existence verifying dynamic implementation.

    I also would be like to have your opinion about another approach like obtaining resource data by APIs. If this approach is good and still best practice? 
    I mean if any pod/s will be down or not available on API Management/Portal Nodes (in worse case or due to upgrading system for example) should be impact for business logic that use API Requests for reaching this data in Management/Portal Nodes?

    Thanks,

    Sergey.



    ------------------------------
    Sergey Paponov
    ------------------------------



  • 4.  RE: Gateway variables

    Posted 3 days ago

    Api manager owns the consumer user records, so that is what you'd query rather than the portal, the portal is just the ui, apim owns the data.

    However I don't think you want to be querying api manager from the gateway, you'd be making api manager a runtime component and requirement and that's not recommended.

    What's the use case? If the user doesn't exist how did they create an application and get valid application credentials to be able to invoke an api on the gateway?



    ------------------------------
    Chris Dudley
    ------------------------------



  • 5.  RE: Gateway variables

    Posted 3 days ago

    Hi Chris,

    Thank you for your participation in discussion.

    Regarding to your questions

    - "What's the use case? If the user doesn't exist how did they create an application and get valid application credentials to be able to invoke an api on the gateway?" 

    - If user doesn't exist he'll verified by various fields in the certificate's details  and will be authorized or not to able to get services(API). If he'll authorized an application will be created dynamically and API will be invoked. (use case of PSD2 Regulation and it's work in v5 last few years)



    ------------------------------
    Sergey Paponov
    ------------------------------