Versions Compared

Version Old Version 8 New Version Current
Changes made by

Frank Asseg

Julien Simon

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

CDCM often interacts with various external systems in an infrastructure. For example, a server-side guard JavaScript may call an external system while verifying that a concept may be saved, or CDCMs creates a UI for the selection of a work product reference by accessing the REST API of Storage Location. These calls to external systems may require different forms of authentication. It is not safe to assume that all external systems may be authenticated using the authenticated users bear token obtained from the customer’s identity provider (IDP hereafter); some system may not be directly integrated with the customers IDP or may not support REST calls using the IDP’s bearer token (e.g. IBM ELM). Also for some external systems it may be desirable to authenticate with a Service Principal (aka technical user).

The Connection routing Routing feature configures the authentication calls to all external systems. For each outbound call to an external system CDCM consults the connection-routing.ymlfile to determine how this call should be authenticated.

...

and a list of connections, that define the authentication mechanism used, based on the common key (in this example elm):

Code Block
languageyaml
  elm:
    connection-type: OAUTH10A
    consumer-key: my-consumer-key
    consumer-secret: my-consumer-secret
    root-services: https://example.com/oauth10a/rootservices
    service-principal-enabled: false

If an outgoing Http request matches https://my.elm.host1/** connection routing will use OAuth 1.0a for authentication with the external server.

Supported

...

Authentication Mechanisms

The supported authentication mechanism are OAuth 2.0, OAuth1.0a, Fixed Headers and Bearer Token Forward. They operate in different ways and require different connections settings in the connection-routing.yml file.

...

This authentication flow uses the bearer token in the Authorization header in the incoming request for the request to the external server. This could e.g. be a JWT or an OAuth2.0 token.

Connections via the Gateway Proxy

Connections to external servers can be established via the Gateway Proxy. Simply provide the Gateway URI and the external URIs, that should be proxied in connection-routing.yml.

If the Proxy itself requires authentication, it can be referenced in the Connections Configuration and the Connection Routing Configuration in the same way that authentication to external servers is configured.

See Example Configuration

See Reference

Configuration

Connection routing is configured using the file connection-routing.yml. This file has to be put in the application’s working directory.

...

Example connection-routing.yml

This examples defines various external servers and their required authentication mechanisms and a Gateway Proxy configuration. Connections to the Gateway Proxy in this example are authenticated using OAuth 2.0.

Code Block
gateway-proxy:
    uri: http://gateway-proxy.host/proxy/stream
    root-uris:
        - https://elmdemo.smartfacts.com:9443/**

connection-routing:
  - cdcm-connection-id: proxy-oauth2
    methods: ALL
    root-uris:
      - http://gateway-proxy.host/proxy/**
  -
    cdcm-connection-id: forward-bearer
    methods: ALL
    root-uris:
      - https://host1/**
      - https://host2/data/**
  -
    cdcm-connection-id: oauth20
    methods: GET,POST
    root-uris:
      - https://host3:4552/v1.0/**

  -
    cdcm-connection-id: oauth10a
    methods: ALL
    root-uris:
      - https://host4/oauth10a/**

  -
    cdcm-connection-id: fixed-headers
    methods: ALL
    root-uris:
      - https://host5:8080/**

connections:
  forward-bearer:
    connection-type: BEARER_TOKEN_FORWARD
  proxy-oauth20:
    connection-type: OAUTH20
    client-id: <client-id>
    client-secret: <client-secret>
    user-info-uri: <user-info-uri>
    scopes: openid, profile, email, Sites.Read.All
    authorization-uri: <authorization-uri>
    token-uri: <token-uri>
  oauth20:
    connection-type: OAUTH20
    client-id: <client-id>
    client-secret: <client-secret>
    user-info-uri: <user-info-uri>
    scopes: openid, profile, email, Sites.Read.All
    authorization-uri: <authorization-uri>
    token-uri: <token-uri>
  oauth10a:
    connection-type: OAUTH10A
    consumer-key: <key>
    consumer-secret: <secret>
    root-services: <root-services-uri>
    service-principal-enabled: false
  fixed-headers:
    connection-type: FIXED_HEADERS
    headers:
      Authorization: <auth-header-value>
      X-Custom-Auth-Header: <custom-auth-header-value>

Reference

Gateway Proxy

Key

Description

uri

The URI of the gateway proxy stream endpoint.

E.g. http://gateway-proxy.host/proxy/stream

root-uris

A list of URIs that can use ant path notation as described in the Spring Framework documentation.
Connections to URIs matching one of the root-uriswill be established via the Gateway Proxy

Configuration Routing Table

...