Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Commit b109f6d

Browse files
committed
adding oci-apigw-authorizer-idcs-java
1 parent 35f38a2 commit b109f6d

22 files changed

+795
-0
lines changed
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
.DS_Store
2+
ResourceServerConfig.java
Lines changed: 178 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,178 @@
1+
# API Gateway authorizer function for IDCS
2+
This function provides authentication and authorization functionality for IDCS to an API gateway deployment.
3+
The implementation conforms to the guidelines in the OCI Documentation at https://docs.cloud.oracle.com/en-us/iaas/Content/APIGateway/Tasks/apigatewayusingauthorizerfunction.htm.
4+
5+
As you make your way through this tutorial, look out for this icon ![user input icon](./images/userinput.png).
6+
Whenever you see it, it's time for you to perform an action.
7+
8+
9+
## Prerequisites
10+
Before you deploy this sample function, make sure you have run step A, B and C of the [Oracle Functions Quick Start Guide for Cloud Shell](https://www.oracle.com/webfolder/technetwork/tutorials/infographics/oci_functions_cloudshell_quickview/functions_quickview_top/functions_quickview/index.html)
11+
* A - Set up your tenancy
12+
* B - Create application
13+
* C - Set up your Cloud Shell dev environment
14+
* D - Choose an back-end you would like to protect. This can be any back-end you already have access to, or you can use the [Display HTTP Request sample](../oci-apigw-display-httprequest-info-python)
15+
16+
17+
## List Applications
18+
Assuming your have successfully completed the prerequisites, you should see your
19+
application in the list of applications.
20+
```
21+
fn ls apps
22+
```
23+
24+
## Deploy a function that implements an API
25+
We need another function that will be a target for API Gateway. We suggest [oci-display-httprequest-info-python](../oci-display-httprequest-info-python).
26+
In Cloud Shell, run the *fn deploy* command to build the function and its dependencies as a Docker image,
27+
push the image to OCIR, and deploy the function to Oracle Functions in your application.
28+
29+
![user input icon](./images/userinput.png)
30+
```
31+
cd ../oci-display-httprequest-info-python
32+
fn -v deploy --app <app-name>
33+
```
34+
35+
## Create or Update your Dynamic Group for API Gateway
36+
In order to invoke functions, your API Gateway must be part of a dynamic group.
37+
38+
When specifying the *Matching Rules*, we suggest matching all functions in a compartment with:
39+
```
40+
ALL {resource.type = 'ApiGateway', resource.compartment.id = 'ocid1.compartment.oc1..aaaaaxxxxx'}
41+
```
42+
43+
44+
## Create or Update IAM Policies for API Gateway
45+
Create a new policy that allows the API Gateway dynamic group to invoke functions. We will grant `use` access to `functions-family` in the compartment.
46+
47+
![user input icon](./images/userinput.png)
48+
49+
Your policy should look something like this:
50+
```
51+
Allow dynamic-group <dynamic-group-name> to use functions-family in compartment <compartment-name>
52+
```
53+
54+
For more information on how to create policies, check the [documentation](https://docs.cloud.oracle.com/iaas/Content/Identity/Concepts/policysyntax.htm).
55+
56+
57+
## Configure Identity Cloud Service (IDCS)
58+
Login to IDCS admin console and create, add an Application and select "Confidential Application".
59+
60+
Enter a name for your IDCS Application, for example "myAPI".
61+
62+
![IDCS-appcreate1](./images/IDCS-appcreate1.png)
63+
64+
For "Allowed Grant Types", select "Client Credentials" and "JWT Assertion". Click *Next*.
65+
66+
![IDCS-appcreate2](./images/IDCS-appcreate2.png)
67+
68+
For Primary Audience, enter "display-httprequest-info" for example.
69+
For Scopes, click *Add*. In the dialog box, for field "Scope", enter "display-httprequest-info", click *Add*.
70+
71+
![IDCS-appcreate3](./images/IDCS-appcreate3.png)
72+
73+
Click *Next*.
74+
75+
![IDCS-appcreate4](./images/IDCS-appcreate4.png)
76+
77+
Click *Finish*.
78+
79+
![IDCS-appcreate5](./images/IDCS-appcreate5.png)
80+
81+
Now that the application is added, note the *Client ID* and *Client Secret*.
82+
83+
![IDCS-appcreate6](./images/IDCS-appcreate6.png)
84+
85+
Click *Close*.
86+
87+
Click *Activate* and click *Ok* in the dialog.
88+
89+
Click *Generate Access Token* and click *Download Token* in the dialog. Open the downloaded file with a text editor and copy the value of the "app_access_token" without quotes.
90+
91+
Note the *IDCS URL*, this is the URL you see in your browser URL bar, copy the scheme and host, do not include the path. For example: https://idcs-xxxxxxxxxxx.identity.oraclecloud.com/
92+
93+
94+
## Review and customize the function
95+
Review the following files in the current folder:
96+
- [pom.xml](./pom.xml) specifies all the dependencies for your function
97+
- [func.yaml](./func.yaml) that contains metadata about your function and declares properties
98+
- [src/main/java/com/example/fn/AuthFunction.java](./src/main/java/com/example/fn/AuthFunction.java) which contains the Java code
99+
100+
The name of your function *oci-apigw-authorizer-idcs-java* is specified in [func.yaml](./func.yaml).
101+
102+
Rename [src/main/java/com/example/utils/ResourceServerConfig.java.template](./src/main/java/com/example/fn/AuthFunction.java) to *src/main/java/com/example/utils/ResourceServerConfig.java* and set the following variable to the values you noted while configuring IDCS.
103+
```
104+
public static final String CLIENT_ID = "xxxxxxxxxxx";
105+
public static final String CLIENT_SECRET = "xxxxxxxxx";
106+
public static final String IDCS_URL = "https://idcs-xxxxxxxx.identity.oraclecloud.com";
107+
108+
//INFORMATION ABOUT THE TARGET APPLICATION
109+
public static final String SCOPE_AUD = "display-httprequest-info";
110+
```
111+
112+
113+
## Deploy the authorizer function
114+
In Cloud Shell, run the *fn deploy* command to build the function and its dependencies as a Docker image,
115+
push the image to OCIR, and deploy the function to Oracle Functions in your application.
116+
117+
![user input icon](./images/userinput.png)
118+
```
119+
fn -v deploy --app <app-name>
120+
```
121+
122+
123+
## Create the API Gateway
124+
The functions is meant to be invoked through API Gateway.
125+
126+
![user input icon](./images/userinput.png)
127+
128+
On the OCI console, navigate to *Developer Services* > *API Gateway*. Click on *Create Gateway*. Provide a name, set the type to "Public", select a compartment, a VCN, a public subnet, and click *Create*.
129+
130+
![APIGW create](./images/apigw-create.png)
131+
132+
Once created, click on your gateway. Under *Resources*, select *Deployments* and click *Create Deployment*.
133+
134+
* Provide a name, a path prefix ("/v1" for example).
135+
* Add Authentication
136+
* Authentication Type: *Custom*
137+
* Choose the application and the authorizer function
138+
* For "Authentication token", select *Header*
139+
* For the "Header Name", enter "Autorization"
140+
141+
Click *Save Changes* when you are finished
142+
![APIGW deployment create](./images/apigw-deployment-create.png)
143+
144+
Click *Next*. Provide a name to the route ("/display-httprequest-info" for example), select methods "GET" and "POST", select *Functions* for your back-end, and select your application and your function "oci-display-httprequest-info-python".
145+
146+
![APIGW deployment create](./images/apigw-deployment-create-2.png)
147+
148+
Click *Next* and finally, click *Save Changes*.
149+
150+
Note the endpoint of your API Gateway deployment.
151+
152+
![APIGW deployment endpoint](./images/apigw-deployment-endpoint.png)
153+
154+
155+
## Invoke the function
156+
The function returns the information of the HTTP request through API Gateway.
157+
158+
![user input icon](./images/userinput.png)
159+
160+
Set the Environment variable "APIGW_ENDPOINT" to the value of the endpoint of your API Gateway deployment, e.g.
161+
```
162+
export APIGW_ENDPOINT=https://xxxxx.apigateway.us-phoenix-1.oci.customer-oci.com/v1
163+
```
164+
165+
Set the Environment variable "TOKEN" to the value of the token downloaded in IDCS, e.g.
166+
```
167+
export TOKEN=<long string of ASCII characters>
168+
```
169+
170+
Use the curl command to make the HTTP request and specify the token in your request:
171+
```
172+
curl -v -H "Authorization: Bearer $TOKEN" $APIGW_ENDPOINT/display-httprequest-info
173+
```
174+
You should receive the information from the HTTP request (or whatever back-end you chose)
175+
176+
Try sending a request with a non-matching key, or no key at all.
177+
178+
The gateway will reject the request with an HTTP401.
Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
schema_version: 20180708
2+
name: oci-apigw-authorizer-idcs-java
3+
version: 0.0.9
4+
runtime: java
5+
build_image: fnproject/fn-java-fdk-build:jdk11-1.0.108
6+
run_image: fnproject/fn-java-fdk:jre11-1.0.108
7+
cmd: com.example.fn.AuthFunction::handleRequest
112 KB
Loading[フレーム]
143 KB
Loading[フレーム]
137 KB
Loading[フレーム]
124 KB
Loading[フレーム]
47.5 KB
Loading[フレーム]
157 KB
Loading[フレーム]
140 KB
Loading[フレーム]

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /