Protecting APIs on Apigee X Gateway

Log in to your SecureAuth tenant.

Open your authorization server (workspace).

Go to Authorization > Gateways.

Select Create Gateway. A list of available gateways appears.

Select Apigee X. Provide the name and description.

Optionally, enable the Create and bind services automatically check box.

Download the authorizer's package from the Quickstart instruction.

In GCP service accounts for your project, create a new key that you will use for authenticating your authorizer to your Google Cloud organization.

The key should be in the JSON format.

Unzip the package and open the docker-compose.yaml file.

Move the key that you have created in the first step to your authorizer's directory.

Edit the docker-compose.yaml file for your authorizer.

1. Add the GOOGLE_APPLICATION_CREDENTIALS environment variable under the environment node. The value of your variable should be a path to the JSON file that contains the authentication key from GCP.

   For example:

   environment:
   - APIGEE.APIGEE_PRODUCT=ApigeeX
   - APIGEE.ACP_RELOAD_INTERVAL=5s # for demo purposes only, increase for production!
   - GOOGLE_APPLICATION_CREDENTIALS=/apigee/apigee-integration-sample.json
   - SHARED_FLOW_PATH=/data/data                     

2. Add a volumes parameter. For example:

   volumes:
   - /Path/To/Your/Authorizer/apigee-x-authorizer:/apigee                     

   volumes attaches the defined catalog (/Path/To/Your/Authorizer/apigee-x-authorizer) to your authorizer's docker image and maps it to a catalog that, from now on, exists on your docker image (apigee). This is the place where your Google Application credentials are stored on your authorizer's docker deployment.

3. Save the docker-compose.yaml file once you are done with your changes.

Run the docker-compose run apigee-authorizer install command in your terminal.

When you run the command, a shared Authorizer flow is created automatically for you in your Apigee X instance. The shared flow consists of two policies:

Run docker-compose up. After a short while, Apigee X authorizer should be running.

docker-compose up
Starting apigee-x-authorizer ... done
Attaching to apigee-x-authorizer
apigee-x-authorizer  | time="2021-09-28T13:55:28Z" level=info msg="starting apigee authorizer" commit=b132c7c version=1.13.0
apigee-x-authorizer  | time="2021-09-28T13:55:29Z" level=info msg="apigee-authorizer listening on https://localhost:8442"
apigee-x-authorizer  | time="2021-09-28T13:55:34Z" level=info msg="Starting authorizer reload..."
apigee-x-authorizer  | time="2021-09-28T13:55:36Z" level=info msg="Authorization configuration reloaded (1.0898772s)"                  

Go to Authorization > Gateways > Your Apigee X instance > APIs. You should see a familiar list of services deployed using Apigee X.

Select Connect > Create new service on a protected API from the list to add it to the list of SecureAuth-protected services. Give this new SecureAuth service a name when prompted.

Your Apigee X-protected API is now on the list of SecureAuth-protected services.

Deploy your Apigee X authorizer so that it is available publicly.

In your Apigee X Proxy settings, go to the DEVELOP tab.

In the Navigator > Policies add a policy of the Flow Callout type.

Provide a name and a display name for your policy.

As a shared flow, use the Authorizer shared flow.

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<FlowCallout async="false" continueOnError="false" enabled="true" name="Flow-Callout">
  <DisplayName>Flow Callout</DisplayName>
  <FaultRules/>
  <Properties/>
  <SharedFlowBundle>Authorizer</SharedFlowBundle>
</FlowCallout>                     

Configure your policy so that it points to your Apigee X authorizer's /authorize endpoint that you have deployed in the seventh step of the Integrate SecureAuth and Apigee X section

For example:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<FlowCallout async="false" continueOnError="false" enabled="true" name="microPerimeter">
   <DisplayName>microPerimeter</DisplayName>
   <FaultRules/>
   <Properties/>
   <Parameters>
       <Parameter name="authorizer_url">https://yourAuthorizerURL/authorize</Parameter>
       <Parameter name="proxy_body">false</Parameter>
   </Parameters>
   <SharedFlowBundle>Authorizer</SharedFlowBundle>
</FlowCallout>                     

Add your new policy as a <step> element to your Proxy Endpoints PreFlows.

For example:

<PreFlow name="PreFlow">
   <Request>
       <Step>
           <Name>microPerimeter</Name>
       </Step>
   </Request>
   <Response/>
</PreFlow>                     

Select Save.

In SecureAuth, create a policy.

Select Enforcement > APIs.

Select a service protected by the Apigee X authorizer and any API with authorization status Unrestricted.

In the popup window, select a policy from the dropdown list and click Save to proceed.

Add a volumes parameter to your docker-compose.yml file:

volumes:
- /Path/To/Your/Authorizer/apigee-{your_authorizer_version}-authorizer:/apigee                  

The {your_authorizer_version} variable can be set to either x or edge.

volumes attaches the defined catalog (/Path/To/Your/Authorizer/apigee-{your_authorizer_version}-authorizer:/apigee) to your authorizer's docker image and maps it to a catalog that, from now on, exists on your docker image (apigee). This is the place where your configuration is stored on your authorizer's docker deployment.

Use the --config option to specify the YAML file with your configuration. For example, assuming that you have created a apigee_edge_config.yaml file in your current directory, your docker run command would look like the following:

docker-compose run apigee-authorizer --config=/apigee/apigee_edge_config.yaml