To achieve this, We can use custom mediation extensions in APIM 2.0. For more details on Custom mediation, please have a look at this document [1].
When you write your custom sequence, below I have given the synapse source and explanation. In this example, we are going to do our action based on the claim value enduser as an example.
1. First we have set the X-JWT-Assertion header value in to a property named authheader.
<property name="authheader" expression="get-property('
Sample X-JWT-Assertion is as below :
X-JWT-Assertion = eyJ0eXAiOiJKV1QiLCJhbGciOiJSUz
2. Then we have used a script mediator to split and decode our value from the authheader.
var temp_auth = mc.getProperty('authheader').
var val = new Array();
val= temp_auth.split("\\.");
By the above javascript, we have split the value we get by "." I have highlighted it by Yellow color.
Grean colored value has got our JWT claims.
3. Then we access the 2nd value as val[1] and decode it using Base64.
var auth=val[1];
var jsonStr = Packages.java.lang.String(
If you decode the particular value using a base64, you wil be able to see the below value.
eyJodHRwOlwvXC93c28yLm9yZ1wvY2
{"http:\/\/wso2.org\/claims\/
"http:\/\/wso2.org\/claims\/
"http:\/\/wso2.org\/claims\/
"iss":"wso2.org\/products\/am"
"http:\/\/wso2.org\/claims\/
"http:\/\/wso2.org\/claims\/
"http:\/\/wso2.org\/claims\/
"http:\/\/wso2.org\/claims\/
"http:\/\/wso2.org\/claims\/
"http:\/\/wso2.org\/claims\/
"http:\/\/wso2.org\/claims\/
"exp":1486459587,
"http:\/\/wso2.org\/claims\/
4. Since we get the claims values with an escape character, we need to replace the "/" with a blank.
This is the actual value we get : "http:\/\/wso2.org\/claims\/
Replace function : jsonStr=jsonStr.replace("\\", "");
After Replace : "http://wso2.org/claims/
5. Then if we need to perform our acceptation and rejection based on enduser value as we have decided, we should split the enduser value by the below claim. You can use any claim value from the above.
var tempStr = new Array();
tempStr= jsonStr.split('http://wso2.
6. We have split it in to 2 values. So the rest of the value after the enduser claim which is in tempStr[1], we split again to retrieve only the enduser value which is admin@carbon.super.
Value needs to be split :
admin@carbon.super",
"http://wso2.org/claims/
"http://wso2.org/claims/
"http://wso2.org/claims/tier":
"http://wso2.org/claims/
var decoded = new Array();
decoded = tempStr[1].split("\"");
7. To access the enduser value in our synapse level, we need to set the decoded enduser value in to message context as below by setting it as a property. I have set it as username.
setProperty(String key, Object value)
Set a custom (local) property with the given name on the message instance
mc.setProperty("username",
8. Then use a filter mediator to perform action based on the username. In here, I have logged a message if the username = admin@carbon.super and dropped the request if it is another user. For more information on Filter mediator, please have a look at this [2]
xml version="1.0" encoding="UTF-8"
<filter source="get-property('
9. I have uploaded my custom mediation extension via publisher as given in the below screen. You have to republish the API once you save it, if it is already published.
So my complete mediation extension is as below :
<sequence xmlns="http://ws.apache.org/ns/synapse" name="JWTDec"> <log level="custom"> <property name="X-JWT-Assertion" expression="get-property('transport','X-JWT-Assertion')"/> </log> <property name="authheader" expression="get-property('transport','X-JWT-Assertion')" scope="default" type="STRING" description="get X-JWT-Assertion header"/> <script language="js" description="extract username"> var temp_auth = mc.getProperty('authheader').trim(); var val = new Array(); val= temp_auth.split("\\."); var auth=val[1]; var jsonStr = Packages.java.lang.String(Packages.org.apache.axiom.om.util.Base64.decode(auth), "UTF-8"); jsonStr=jsonStr.replace("\\", ""); var tempStr = new Array(); tempStr= jsonStr.split('http://wso2.org/claims/enduser\":\"'); var decoded = new Array(); decoded = tempStr[1].split("\""); mc.setProperty("username",decoded[0]); </script> <log level="custom"> <property name="username" expression="get-property('username')"/> </log> <filter source="get-property('username')" regex="admin@carbon.super"> <then> <log level="custom"> <property name="accept" value="Accept the message"/> </log> </then> <else> <drop/> </else> </filter> </sequence>
No comments:
Post a Comment