<div dir="ltr"><div>Here is the feedback on the discussion about the API GW authzen profile that I also posted on OpenID Authzen Slack for the official mailing list record: </div><div><br></div><div>1. IMHO, the Resource type should be "HTTP_Request" not "path" -- there is always way more to an API proxy decision than just a path. And the path itself is not even enough to uniquely identify a resource. The entitlement request is to perform an HTTP Request with a certain method and context--not to just access a certain path.<br><br>2. We can define a minimum required schema but allow room for extension. I guess what I'm wondering is if we can reduce the scope of this profile more.</div><div><br></div><div>3. A URL may include schema, host, port, path, query, and fragment. Also, I wonder if the host should allow for policies based on the domain, i.e. for <a href="http://google.com">google.com</a> domain do this.. for <a href="http://gmail.com">gmail.com</a> domain... do something else.<br><br>4. The HTTP request includes url , headers, body . These are all things the developer is sending from Postman in the request. IMHO, Context should be for data that is external to the resource, like the time of day, which you don't send in the Postman request.<br><br>5. It's unclear why the sample shows the route as ".../pets/{id}". The request would be for an exact path3. It may seem trivial, but we don't want to define any kind of replacement or regex syntax here. </div><div><br>6. For the resource id (or the subject id), why not make it a hash of the properties? That way it will be unique, and represent the totality of the request. It's really quick and easy for the API gateway to generate a sha-256 hash. <br><br>7. I really don't like the subject sent as "JWT" with the value as the id. At a minimum, you should use the fingerprint of the token, and not the token itself. Perhaps it would be better to send client claims in the subject properties, like client_id, scopes, and allow for extension for customers who have custom access token claims?<br><br>8 .For the resource... what about something like this:</div><div><br>"type": "AuthZen::HTTP_REQUEST",<br>"id": "31d342599750a22f90a1d6b3d765549231e6b3091530f8f813e2f754e9d62422",<br>"properties": {<br> "header": {<br> "Accept": "application/json",<br> "User-Agent": "AuthzenClient/1.0",<br> "Host": "<a href="http://www.acme.com">www.acme.com</a>",<br> "Content-Type": "multipart/form-data"<br> },<br> "url": {<br> "scheme": "https",<br> "host": "www",<br> "domain": "<a href="http://acme.com">acme.com</a>",<br> "port": 443,<br> "path": "/protected",<br> "query": "query": {<br> "param1": "value"<br> }<br> "fragment": "TOC"<br> },<br> "body": {<br> "form1": {<br> "field1": "value1",<br> "field2": "value2"<br> } <br> }<br> }<br><br><br></div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><font style="vertical-align:inherit"><font style="vertical-align:inherit"><font style="vertical-align:inherit"><font style="vertical-align:inherit">--------------------------------------</font></font></font></font></div><div><font style="vertical-align:inherit"><font style="vertical-align:inherit"><font style="vertical-align:inherit"><font style="vertical-align:inherit">Michael Schwartz</font></font></font></font></div><div><font style="vertical-align:inherit"><font style="vertical-align:inherit"><font style="vertical-align:inherit"><font style="vertical-align:inherit">Glue</font></font></font></font></div><div><font style="vertical-align:inherit"><font style="vertical-align:inherit"><font style="vertical-align:inherit"><font style="vertical-align:inherit">Founder/CEO</font></font></font></font></div><div><a href="mailto:mike@gluu.org" target="_blank"><font style="vertical-align:inherit"><font style="vertical-align:inherit"><font style="vertical-align:inherit"><font style="vertical-align:inherit">mike@gluu.org</font></font></font></font></a></div><div><a href="https://www.linkedin.com/in/nynymike" target="_blank"><font style="vertical-align:inherit"><font style="vertical-align:inherit"><font style="vertical-align:inherit"><font style="vertical-align:inherit">https://www.linkedin.com/in/nynymike</font></font></font></font></a></div></div></div></div>
<br>
<div></div><div></div><div><font size="1"><img src="https://github.com/GluuFederation/docs-gluu-server-prod/blob/master/docs/source/small_logo.png?raw=true"><br></font></div><div><hr></div><div><font size="1"><b style="color:rgb(128,128,128);font-family:"Sans Serif"">CONFIDENTIALITY NOTICE</b><br></font></div><font face="Sans Serif" color="#808080" size="1">This message may contain confidential or legally privileged information.<br>If you are not the intended recipient, please immediately advise the sender by reply e-mail that you received this message, and delete this e-mail from your system.<br>Thank you for your cooperation</font><br>