apiGrove GUI WSSE authentication

Purpose

This apiGrove tutorial demonstrates how to use WSSE authentication to restrict access your API.

Prerequisites

Please ensure the following prerequites are met

• A working install of apiGrove and apiGroveGUI
• A web browser

Instructions

Create the API

1. Open your installed apiGrove GUI url in a browser
2. Login to apiGroveGUI /dev/images/apiGroveGUI_Login.png
3. Click on API in the top menu
4. Click Create New
5. Enter a Name for your API 'myWSSETweets'
6. Enter an Endpoint
7. Enter the target host where this API is hosted
8. Click Part Advanced button
9. Click The Enabled button (makes your API active immediately upon creation)
10. Unclick the No Auth button (disable anonymous access)
11. Click the ‘WSSE’ button for Authenitcation Type
12. Leave the HTTPS button unclicked
13. Enter 9 for the Transactions Per Second (TPS) Threshold
14. Enter 10 for the Transactions Per Minute (TPM) Threshold
15. Select the GET button for allowed HTTP calls
16. Click Save
17. apiGrove GUI returns a success message and lists your onboarded API

Create the Auth

1. Click on Auth in the top menu
2. Click Create New
3. Enter an ID 'WSSEtwitter' for this auth
4. Click the WSSE Type button
5. Enter Username 'test'
6. Enter Pasword Tester
7. Click Save /dev/images/apiGroveGUI_Auth_WSSE.png
8. 'wssetwitter' is displayed in a listing of your auths

Create a policy

The policy associates the auth with your API.

1. Click on Policy in the top menu
2. Click Create New
3. Enter ID twittterWSSEPolicy
4. Select the API created in earlier steps
5. Select the Auth created
6. Click submit query
7. Attempting to access the API without the correct username and password returns a unauthorized message
8. Accessing the API with the correct username and password returns search results from the twitter API