content_image/972113.jpg
<img src='content_image/972113.jpg'>

We can now choose from a range of options to add sophistication to how we secure access to the API. In this section we will enable OAuth to control access. 

IBM API Connect supported by DataPower provides advanced security features, which include but are not limited to, OAuth, JWT, encryption, throttling, etc. As described in section 4.9, “Cloud-native security – an application-centric perspective” on page 128 we can cover many different use cases. 

We will demonstrate how to secure your API with OAuth token. We will also discuss the JWT token generation. 

First you must identify which scheme you want your flow to follow. For more information, see the following article: https://www.ibm.com/support/knowledgecenter/en/SSMNED_5.0.0/com.ibm.apic.toolkit.d oc/tutorial_apionprem_security_OAuth.html 

To choose an OAuth scheme. You must first establish whether your implementation is considered public or confidential. This will narrow your choices to three schemes. A brief outline of each scheme and the characteristics of the three public and three confidential schemes follows. 

In our example here, we will use a Confidential (For internal application) scheme with password flow to demonstrate how to secure the API. 

A confidential scheme is suitable when an application is capable of maintaining the secrecy of the client secret. This is usually the case when an application runs in a browser and accesses its own server when it gets OAuth access tokens. As such, these schemes make use of the client secret. 

In Figure 6-159 we are showing the overall scenario, in which the developer initiates the request using one of the available channels (mobile, web), then the application uses the confidential scheme to obtain the token from the gateway. Then if authorized, the application calls the back-end microservice to get the data. 

