MuleSoft Integration with AWS Cognito Client Credentials and Mule JWT Validation Policy,MuleSoft as OAuth provider.Dedicated Load Balancer v/s Shared Load Balancer

AWS Cognito and Mule JWT Validation Policy

All contents © MuleSoft Inc. What is AWS Cognito? 2 Amazon Cognito is a simple user identity and data synchronization service that helps you securely manage and synchronize app data for your users across their mobile devices. You can create unique identities for your users through a number of public login providers (Amazon, Facebook, and Google) and also support unauthenticated guests. You can save app data locally on users’ devices allowing your applications to work even when the devices are offline. With Amazon Cognito, you can save any kind of data in AWS Cloud, such as app preferences or game state, without writing any backend code or managing any infrastructure. This means you can focus on creating great app experiences instead of having to worry about building and managing a backend solution to handle identity management, network state, storage, and sync. Amazon Cognito User Pools is a standards-based Identity Provider and supports identity and access management standards, such as OAuth 2.0, SAML 2.0, and OpenID Connect. In addition to using the Amazon Cognito-specific user APIs to authenticate users, Amazon Cognito user pools also support the OAuth 2.0 authorization framework for authenticating users.

All contents © MuleSoft Inc. AWS Cognito Uses 3

All contents © MuleSoft Inc. Integrating AWS Cognito Authorization Code With MuleSoft API Manager 4 Authorization Code Grant The authorization code grant is the preferred method for authorizing end users. Instead of directly providing user pool tokens to an end-user upon authentication, an authorization code is provided. This code is then sent to a custom application that can exchange it for the desired tokens. Because the tokens are never exposed directly to an end-user, they are less likely to become compromised.

All contents © MuleSoft Inc. Integrating AWS Cognito Authorization Code With MuleSoft API Manager 5

All contents © MuleSoft Inc. Integrating AWS Cognito Client Credentials With MuleSoft API Manager 6 Client Credentials Grant The client credentials grant is much more straightforward. While the previous grants are intended to obtain tokens for end users, the client credentials grant is typically intended to provide credentials to an application in order to authorize machine-to-machine requests. Note that, to use the client credentials grant, the corresponding user pool app client must have an associated app client secret.

All contents © MuleSoft Inc. Integrating AWS Cognito Client Credentials With MuleSoft API Manager 7

All contents © MuleSoft Inc. JWT Validation Token 8 JSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between the two parties. The claims in a JWT are encoded as a JSON object that is used as the payload of a JSON Web Signature (JWS) structure or as the plaintext of a JSON Web Encryption (JWE) structure, enabling the claims to be digitally signed or integrity protected with a Message Authentication Code(MAC) and/or encrypted. ● JWTs are stateless, making tokens easier to manage. ● JWTs can be used to transfer claims securely between parties. ● JWTs are scalable. ○ The payload of a token can be expanded to increase new claims easily. ● JWTs are decoupled in nature allowing authentication to happen on a different server. ● The tokens are compact. JSON format makes the token less verbose than XML. The smaller size allows easier transmission over HTTP. ● JWTs are JSON-based and can be easily parsed by multiple receiving systems, especially mobiles. This enables an industry-wide adoption.

All contents © MuleSoft Inc. JWT Validation Token 9

All contents © MuleSoft Inc. JWT Token Algorithm 12 ● Symmetric algorithms – HMAC using SHA-256, SHA-384, and SHA-512. ● Asymmetric algorithms – RSA using SHA-256, SHA-384, and SHA-512. ● None – no signature validation.

Live Demonstration - AWS Cognito & Mule JWT Validation Policy

All contents © MuleSoft Inc. MuleSoft as OAuth Provider 15 The OAuth2 Provider module allows a Mule runtime engine (Mule) app to be configured as an Authentication Manager in an OAuth2 dance. With this role, the application will be able to authenticate previously registered clients, grant tokens, validate tokens, or register and delete clients, all during the execution of a flow. MuleSoft supports various third party OAuth 2.0 providers as listed below ● Okta ● OpenID Connect ● Open AM ● PingFederate MuleSoft can be also used as an OAuth provider for securing the applications.

All contents © MuleSoft Inc. MuleSoft as OAuth Provider 16

All contents © MuleSoft Inc. MuleSoft as OAuth Provider 17

Live Demonstration - MuleSoft As OAuth Provider

MuleSoft Dedicated Load Balancer and Mapping Rules

All contents © MuleSoft Inc. MuleSoft Dedicated Load Balancer 20 The OAuth2 Provider module allows a Mule runtime engine (Mule) app to be configured as an Authentication Manager in an OAuth2 dance. With this role, the application will be able to authenticate previously registered clients, grant tokens, validate tokens, or register and delete clients, all during the execution of a flow. MuleSoft supports various third party OAuth 2.0 providers as listed below ● Okta ● OpenID Connect ● Open AM ● PingFederate MuleSoft can be also used as an OAuth provider for securing the applications.

All contents © MuleSoft Inc. MuleSoft Dedicated Load Balancer 21 Mapping rules are used on dedicated load balancers to translate input URI to call applications deployed on CloudHub. A pattern is a string that defines a template for matching an input text. Whatever value is placed within curly brackets ({ }) is treated as a variable. Variable names can contain only lowercase letters (a-z) and no other characters, including slashes. Let's consider that we have 2 DNS (i.e. api-dev.example.com and api-test.example.com) setup on a dedicated load balancer. api-dev.example.com is for the Dev environment whereas api-test.example.com is for the Test environment.

All contents © MuleSoft Inc. MuleSoft Dedicated Load Balancer - Use Case 1 22 Use Case 1 We are receiving requests on the DLB https://api-dev.example.com/ecommerce/v1.0/invoice and need to redirect them to http://org-ecommerce-api.cloudhub.io/v1.0/invoice (the CloudHub application name will be org-ecommerce-api) We can use this mapping rule to achieve this. This above rule will be applied when requests come on DLB and route to the CloudHub application in the VPC.

All contents © MuleSoft Inc. MuleSoft Dedicated Load Balancer - Use Case 1 23 https://api-dev.example.com/ecommerce/v1.0/invoice ==> http://org-ecommerce- api.cloudhub.io/v1.0/invoice

All contents © MuleSoft Inc. MuleSoft Dedicated Load Balancer - Use Case 1 24 But here we have some problems that on our DLB, we have set up 2 DNSs, one for Dev and another for Test. Now, how will the DLB know this is a request that needs to route to either the Dev or Test application because the same rule will be applied for both? To avoid this, we will be using a subdomain in the next use case.

All contents © MuleSoft Inc. MuleSoft Dedicated Load Balancer - Use Case 2 25 In this case, we will be using a subdomain for routing the request to the correct environment from DLB. Our application name format must be org-app-subdomain (e.g. org-ecommerce-api-dev for dev environment and org-ecommerce-api-test for test environment) when deploying to CloudHub workers in VPC . So, our mapping rule will look like this.

All contents © MuleSoft Inc. MuleSoft Dedicated Load Balancer - Use Case 2 26 subdomain is variable to map any subdomain. ● https://api-dev.example.com/ecommerce/v1.0/invoice (DLB) ==> http://org-ecommerce-api-dev.cloudhub.io/v1.0/invoice (CloudHub Dev Environment) ● https://api-test.example.com/ecommerce/v1.0/invoice (DLB) ==> http://org-ecommerce-api-test.cloudhub.io/v1.0/invoice (CloudHub Test Environment) subdomain is variable to map any subdomain. ● https://api-dev.example.com/ecommerce/v1.0/invoice (DLB) ==> http://org-ecommerce- api-dev.cloudhub.io/v1.0/invoice (CloudHub Dev Environment) ● https://api-test.example.com/ecommerce/v1.0/invoice (DLB) ==> http://org-ecommerce- api-test.cloudhub.io/v1.0/invoice (CloudHub Test Environment)

All contents © MuleSoft Inc. MuleSoft Dedicated Load Balancer - Use Case 2 27 subdomain is variable to map any subdomain. ● https://api-dev.example.com/ecommerce/v1.0/invoice (DLB) ==> http://org-ecommerce-api-dev.cloudhub.io/v1.0/invoice (CloudHub Dev Environment) ● https://api-test.example.com/ecommerce/v1.0/invoice (DLB) ==> http://org-ecommerce-api-test.cloudhub.io/v1.0/invoice (CloudHub Test Environment) subdomain is variable to map any subdomain. ● https://api-dev.example.com/ecommerce/v1.0/invoice (DLB) ==> http://org-ecommerce- api-dev.cloudhub.io/v1.0/invoice (CloudHub Dev Environment) ● https://api-test.example.com/ecommerce/v1.0/invoice (DLB) ==> http://org-ecommerce- api-test.cloudhub.io/v1.0/invoice (CloudHub Test Environment)

All contents © MuleSoft Inc. MuleSoft Dedicated Load Balancer - Use Case 2 29 In this use case, we solve the issue of routing the request from DLB to the correct environment. Let's consider another scenario where you want to route the request to CloudHub on the basis of the application version. We will see this in the next use case.

All contents © MuleSoft Inc. MuleSoft Dedicated Load Balancer - Use Case 3 30 In this case, when we will deploy an application to CloudHub, and it will be in format org-app-subdomain- version (e.g. org-ecommerce-api-dev-v1-0 for Dev environment and org-ecommerce-api-test-v1-0 for Test environment). Whenever we will get request on DLB, then the version in the URL will be v1.0 and v2.0 but when you deploy application on CloudHub it doesn't allow to use "." in the application name. That is the reason we are using "- " in the version of the application deploying to CloudHub. So, our mapping rule will look like this.

All contents © MuleSoft Inc. MuleSoft Dedicated Load Balancer - Use Case 3 31 ● https://api-dev.example.com/ecommerce/v1.0/invoice (DLB) ==> http://org-ecommerce-api-dev- v1-0.cloudhub.io/v1.0/invoice (CloudHub Dev Environment) ● https://api-test.example.com/ecommerce/v1.0/invoice (DLB) ==> http://org-ecommerce-api-test- v1-0.cloudhub.io/v1.0/invoice (CloudHub Test Environment)

All contents © MuleSoft Inc. MuleSoft Dedicated Load Balancer Rule Priority 33 DLB will apply the first matching rule regardless of more exact matching rules available. A rule defined first, at index 0 has higher priority against other rules defined after it. The higher the index assigned, the less priority the mapping rule has.

All contents © MuleSoft Inc. References - Articles 34 Implementing Mapping Rules With MuleSoft Dedicated Load Balancer https://dzone.com/articles/implementing-mapping-rules-with-mulesoft-dedicated Authorizing the MuleSoft API Using AWS Cognito User Pool and Mule JWT Validation Policy https://dzone.com/articles/authorizing-the-mulesoft-api-using-aws-cognito-use Implementing MuleSoft AnyPoint Platform Identity Management Using AWS Cognito Authorization Code https://dzone.com/articles/implementing-mulesoft-anypoint-platform-identity-m

All contents © MuleSoft Inc. References - Articles 35 Implementing MuleSoft as OAuth Provider for securing Mule Application https://dzone.com/articles/implementing-mulesoft-as-oauth-provider-for-securi

All contents © MuleSoft Inc. References - Videos 36 Implementing MuleSoft as OAuth Provider For Securing the MuleSoft Application https://youtu.be/IYKaps1ndxI Implementing MuleSoft AnyPoint Platform Identity Management Using AWS Cognito Authorization Code https://youtu.be/PGkORD1CPh8 Authorizing the MuleSoft API Using AWS Cognito User Pool and Mule JWT Validation Policy https://youtu.be/X4KXwzi5yoU

MuleSoft Integration with AWS Cognito Client Credentials and Mule JWT Validation Policy,MuleSoft as OAuth provider.Dedicated Load Balancer v/s Shared Load Balancer

MuleSoft Integration with AWS Cognito Client Credentials and Mule JWT Validation Policy,MuleSoft as OAuth provider.Dedicated Load Balancer v/s Shared Load Balancer

More Related Content

What's hot

Similar to MuleSoft Integration with AWS Cognito Client Credentials and Mule JWT Validation Policy,MuleSoft as OAuth provider.Dedicated Load Balancer v/s Shared Load Balancer

More from Manish Kumar Yadav

Recently uploaded

MuleSoft Integration with AWS Cognito Client Credentials and Mule JWT Validation Policy,MuleSoft as OAuth provider.Dedicated Load Balancer v/s Shared Load Balancer