Cloud-native API Administration with Red Hat 3scale API Management

The Zync component is responsible for the credential synchronization with RHSSO. When you create a new application, the Sidekiq component schedules Zync to synchronize the data with RHSSO. Zync asynchronously communicates with RHSSO and creates the API credentials.

For the synchronization to be successful, the Zync must be able to:

For example, on Red Hat OpenShift Container Platform, if the zync-queue pods do not trust the RHSSO TLS certificates then the communication fails.

Additionally, Zync must authenticate with RHSSO by using a confidential Service Account client with the manage-clients role. Otherwise, Zync cannot create clients in RHSSO.

See the references section for more information about implementing the prerequisite steps.

You can configure OIDC integration for each product in your 3scale API Management installation. When you configure OIDC integration for a particular product:

To configure OIDC for a product, navigate to the Admin Portal, select your product, and click Integration → Settings. Then, select the OpenID Connect Use OpenID Connect for any OAuth 2.0 flow. authentication option.

You must provide the OIDC issuer URL with the following parameters:

The following URL is an example of the RHSSO issuer URL:

https://zync-client:zync-secret@keycloak-rhsso.apps.ocp4.example.com/auth/realms/example-realm

Figure 4.10: Configuring OIDC provider for a product

You can use the JWT Claim Check policy to configure advanced JWT claim checks. Consequently, you can secure resources and methods of your APIs by specifying additional JWT claim values that you require for a JWT token to be valid.

For example, consider the following policy:

{
  "name": "apicast.policy.jwt_claim_check",
  "configuration": {
    "error_message": "Invalid JWT check",
    "rules": [
      {
        "operations": [
          {"op": "==", "jwt_claim": "role", "jwt_claim_type": "plain", "value": "admin"}
        ],
        "combine_op":"and",
        "methods": ["GET"],
        "resource": "/resource",
        "resource_type": "plain"
      }
    ]
  }
}

For the GET /resource request, the policy enforces that the provided JWT token contains the role claim with the value admin. Other resources and methods do not require the role claim check. All resources and methods still require a valid JWT token.

The preceding example requires RHSSO to provide the role claim for some JWT tokens.

You can configure the policy check for a particular product. Click Integration → Policies, then click Add policy and select JWT Claim Check.

Figure 4.11: Example JWT Claim Check policy

The following list provides the most common sources of misconfiguration and errors when you integrate 3scale API Manager with RHSSO.