Archive for api

Protecting API Access with BIG-IP using OAuth

Posted in security, f5, big-ip, application delivery, devcentral, api by psilva on March 21st, 2017

As more organizations use APIs in their systems, they've become targets for the not-so-good-doers so API Security is something you need to take seriously. Most APIs today use the HTTP protocol so organizations should protect them as they would ordinary web properties.

Starting in v13, BIG-IP APM is able to act as an OAuth Client, OAuth Resource Server and OAuth Authorization Server. In this example, we will show how to use BIG-IP APM to act as an OAuth Resource Server protecting the API.

In our environment, we’ve published an API (api.f5se.com) and we’re trying to get a list of departments in the HR database. The API is not natively protected and we want APM to enable OAuth protection to this API.

api1.jpg

 

First, let’s try an unauthenticated request.

api2.jpg

 

You can see we get the 401 Unauthorized response which is coming from the BIG-IP. In this instance we’re only sending 3 headers, Connection (close), Content Length (0) and WWW Authenticate (Bearer), indicating to the client that it wants Bearer Token authentication.

api3.jpg

 

So we’ll get that authorization and a new access token.

api4.jpg

 

Here the Getpostman.com (Postman toolchain for API developers) is preconfigured to get a new access token from the OAuth authorization server, which is a BIG-IP.

api5.jpg

 

We will request the OAuth token and will need to authenticate to the BIG-IP.

api6.jpg

 

After that, we get an authorization request. In this case, BIG-IP is acting as an Authorization server and is indicating to the resource owner (us) that there is a HR API application that wants to use certain information (about us) that the authorization server is going to provide.

api7.jpg

 

In this case, it is telling us that the resource server wants to get scope api-email.

We’ll click Authorize and now we have our auth token and is saved in the Postman client.

api8.jpg

 

Within the token properties we see that it expires in 300 seconds, it is a Bearer token and the scope is api-email and we get a refresh token as well.

api9.jpg

 

Now we can add this token to the header and try to make a request again. And this time, we get a much better response.

api91.jpg

We get a 200 OK, along with the headers of the application server. We’ll click on the Body tab within Postman, we’ll see the XML that the API has returned in response to the query for the list of departments that are available. There were no cookies being returned by the server if you were wondering about that tab. In the Headers tab we see the Authorization header that was being sent and the content of the Bearer token.

A simple way to easily protect your APIs leveraging OAuth 2.0 Resource Server capabilities in BIG-IP.

Special thanks to Michael Koyfman for the basis of the content and check out his full demo here.

ps

Related:

 

 

 

 

 

 

 

 

 

 

 

 

 




F5 Agility 2015 EMEA – ACI with F5 & Cisco

Posted in f5, silva, video, agility, api, cisco by psilva on May 20th, 2015

Ravi Balakrishnan, Cisco Sr. Marketing Manager, discusses the Application Centric Infrastructure and how F5 & Cisco, former fierce competitors, have come together in a joint integrated solution to solve many customer challenges. Cisco’s SND strategy in bringing together programmability, openness of the ecosystem, the agnostic nature of physical and virtual and the ability to support multi-tenant type deployments gives organizations agility and low TCO. With F5, customers can achieve L2-7 ADC control without the risks of manual error. Best of network control and application awareness!

ps

Related

Connect with Peter: Connect with F5:
o_linkedin[1] o_rss[1] o_twitter[1]   o_facebook[1] o_twitter[1] o_slideshare[1] o_youtube[1]
Watch Now: