How to restrict access to particular resources for end users?

Let's say I have this REST resource http://example.com. In this I can access A, B, C, D resources.

Ex: http://example.com/A, http://example.com/B, http://example.com/C etc.

Here, for any user I would like to restrict access to C(http://example.com/C), D(http://example.com/D) resources. When a user try to access them a fault message should be thrown.

I am new to apigee. How to implement this in apigee layer..?

0 4 860
4 REPLIES 4

sidd-harth
Participant V

Hi @Sai Allada , this is possible in Apigee. But you need to tell us on how are you planning to restrict particular user access to Resource C & D? Are you planning to use any Key/Header/Token?

In Apigee we can create multiple Conditional Flows and then add multiple policies in each flow to restrict particular user access.

We can use RaiseFault policy with conditions on resource C & D to give them a custom fault message. Also, provide info/conditions on which users needs to access these resources.

Thank you for your reply. I am not clear about key/header/token concepts. I just started learning. Could you provide document for all these possibilities?

One more doubt is, I have http://example.com resource. In this I have sub-resources A, B, C, D etc as mentioned in question. Do I need to create proxy for each resource like http://example.com/A , http://example.com/B then apply restrictions or I can create proxy for http://example.com and can add restrictions directly on C, D?

We can have one proxy with many resources. While creating a proxy we give the backend url as https://example.com

Within the proxy, we create ConditionalFlow(one flow per resource). So for A,B,C,D you will be creating 4 Conditional flows.

Now for adding restriction, you need to think about,

How to restrict? (Using authentication(apikey or oauth or jwt) or simple header value)

The best way to learn is to start exploring and doing some PoC samples. Start doing a sample and post your queries here. It will be easy to answer.

Check these docs,

https://docs.apigee.com/api-platform/get-started/get-started

https://docs.apigee.com/api-platform/fundamentals/understanding-apis-and-api-proxies

Thank You..