API Gateways and Multiple Consumer Types
Sometimes at client sites, I see a separation of APIs advertised on an API Gateway based upon consumer type. Sometimes, this is unavoidable, but there should be a core set of APIs and a general push to create APIs that are reusable. Reusability of APIs is a foundational building block of API…
Making Authorization Decisions
This blog post continues our discussion of Authorization in the API space. It will explore common authorization patterns with API Gateways and the backend API Providers. Generally, the API Gateway will apply a Coarse Grained Authorization (CGA) decision and the API Provider will implement Fine…
HTTP POST vs GET: Is One More Secure For Use In REST APIs?
The use of HTTP POST vs HTTP GET for read-only (or query) operations in REST APIs recently came up in a conversation. For this particular shop, there had been a long-standing ban on the use of GET requests for use in homegrown applications. This had been the case since before REST APIs were in…
OAuth2 Access Tokens vs API Keys — Using JWTs
There are several approaches to securing APIs. Every API Gateway vendor supports the same core set of API security mechanisms. API Keys and OAuth2 are two examples of these authentication (plus authorization) mechanism. When should one be used over the other? What are the differences between the…
OAuth2 Configuration in 3Scale API Management (and APICast) with Red Hat SSO
This tutorial builds on the capabilities we explored in the “Red Hat SSO + 3Scale API Management” series and in particular in the first tutorial. In this post, we will:
Red Hat SSO and 3Scale API Management Series
This post contains a collection of links to blog posts I’ve written about the use of OAuth2 and OpenID Connect with Red Hat SSO and 3Scale API Management.
Performance Tuning Methodology
I’m taking a brief excursion from my usual identity and API-centric posts to answer a question about performance tuning that someone asked me earlier this year. In a previous incarnation of my career, I was focused on performance tuning and diagnostics — particularly involving Java systems.…
How To Submit Your Security Tokens to an API Provider, Pt. 2
This post was originally published as “How to Submit Tokens to an API Provider, Pt 2” on the Apigee Blog.
How To Submit Your Security Tokens to an API Provider Pt. 1
This post was originally published as “How to Submit Tokens to an API Provider, Pt 1” on the Apigee Blog.
Identity Propagation in an API Gateway Architecture
The power of end-to-end user security context with APIs
An Alternative to Delegated Access in the Enterprise
Extending OAuth2 and OpenID Connect as the enterprise standard for API security
Keeping Your APIs Secure for Multiple User Types
This post was originally published as “Keeping Your APIs Secure for Multiple User Types” on the Apigee Blog.