July 2019
Beginner to intermediate
300 pages
7h 48m
English
Problem statement:
An internal API, meaning an API that is only accessible from within a corporate wide area network (WAN), needs to verify that the application users exist and have valid credentials in the corporate directory (for example, MS Active Directory and/or any other LDAP server). This means that the application is trusted.
Solution:
Assuming that HTTPS is used for transport encryption between the consuming application and the API gateway, a straightforward solution is to implement HTTP basic authentication at the API gateway level.
To this end, a consuming application must include the user's credentials in the HTTP header as follows:
Authorization: Basic <base64(username:password)>
Read now
Unlock full access