Restrict access to microgateway

I have a backend service "core" with following endpoints:

- /path1
- /path2
- /path3

I use microgateway in the organizations, so I created API proxy "edgemicro_core" with access to backend service "core". The path is "/core"

Then I've created product "my-internal-product", with full access to "edgemicro_core"

Then I've created apps "my-internal-apps" with apikey "my-internal-apikey" to access "my-internal-products".

------------------

Now, we have a different application. This application is vendor application, located on our internal network. It needs access to "core" backend through apigee, but it restricted. This vendor app only allowed to access "/path3". The other paths is restricted

So I created product "my-vendor-product", with access to "edgemicro_core", but I restrict access to "/path3" only.

Then I've created apps "my-vendor-apps" with apikey "my-vendor-apikey" to access "my-vendor-products".

-------------------

However, the "my-vendor-apikey" is not working. IT always get 403 status every time I access https://myapigee/core/path3.

What happened?
How can I restrict vendor app only to "/path3" using microgateway?
The product path restriction seems not working on microgateway.

Thanks

Solved Solved
0 1 111
1 ACCEPTED SOLUTION

sidd-harth
Participant V

I guess you need to add edgemicro-auth proxyto the my-vendor-product as well.

Note - The edgemicro-auth proxy must be present in the product if you want to use API Key or OAuth security.

https://docs.apigee.com/api-platform/microgateway/3.0.x/setting-and-configuring-edge-microgateway#pa...

View solution in original post

1 REPLY 1

sidd-harth
Participant V

I guess you need to add edgemicro-auth proxyto the my-vendor-product as well.

Note - The edgemicro-auth proxy must be present in the product if you want to use API Key or OAuth security.

https://docs.apigee.com/api-platform/microgateway/3.0.x/setting-and-configuring-edge-microgateway#pa...