Extract App information using AccessEntity with multiple EntityIdentifier elements - Apigee Hybrid

[an90210]

I am trying to fetch 'App' information based off of two different references, both of which are of type 'consumerkey'. Some api proxies use api-key and others use client-id. Tried the below according to the documentation but it seems to be throwing an error while trying to save.  This policy is part of a shared flow that I plan to call as part of the Pre-Target-Flow.

When I try to use the option of extracting app information based on two different <EntityIdentifer> references for the same 'type' as below, as well as in the example provided in the Apigee X documentation on access-entity-policy#Entities,  which apparently seems to have a typo on the 'type' field (type*="identifier_type"), I keep getting the error EntityIdentifier ref must be non-empty. The 'ref' attribute is clearly not empty. On the other hand when not using the <Identifiers> element with multiple Identifiers, it works fine. Any help is appreciated. 

Non-working code:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<AccessEntity async="false" continueOnError="false" enabled="true" name="AE-Get-Developer-App">
	<DisplayName>AE-Get-Developer-App</DisplayName>
	<EntityType value="app"/>
	<Identifiers>
		<Identifier>
			<EntityIdentifier ref="request.header.api-key" type="consumerkey"/>
		</Identifier>
		<Identifier>
			<EntityIdentifier ref="request.header.client-id" type="consumerkey"/>
		</Identifier>
	</Identifiers>
</AccessEntity>

Working Code without the <Identifiers> element:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<AccessEntity async="false" continueOnError="false" enabled="true" name="AE-Get-Developer-App">
	<DisplayName>AE-Get-Developer-App</DisplayName>
	<EntityType value="app"/>
	<EntityIdentifier ref="request.header.api-key" type="consumerkey"/>
</AccessEntity>

Thanks.

[API-Evangelist]

Try below documentation helps narrowing results with secondary identifiers..

https://docs.apigee.com/api-platform/reference/policies/access-entity-policy#secondary_identifiers 

Good Luck.

[dknezic · Accepted solution]

You could consider using an assign message variable that determines the appropriate header to use, and then use that for access entity.. or have two access entity policies with a condition based on the available headers.

[an90210]

Thanks. I can definitely try that. Going back to the initial approach I tried, that is not working: is that a known issue or bug? There isn’t any documentation about that element anywhere either, so I’m curious to know if it is something that even works OOB.

[dknezic]

I think you're right, it looks like a validation bug when updating the API proxy revision. Whether or not AccessEntity with multiple EntityIdentifiers would support your use case though I'm not sure, but thanks for highlighting this, will raise this as a bug.