Loading Product

[#1]

Hi anyone,

I have a problem about getting product attributes.

I have a proxy as below:

+ base path: /object

+ path: getObject

And I add that proxy into product (Object product) as below:

+ resource path: /**, /

+ Attributes: {product-name: object_attribute}

And I add that product into Dev app (Object dev app) but I added that under others as below:

I used to verifyapikey.{policy_name}.apiproducts.{attribute_name} to get an attribute product. But My proxy didn't load exactly Object product. My proxy loaded the first product in devapps.

I don't understand why?

Could you please help me resolve that problem.

Thanks

Chien Ngo

[willwitman]

Hi Chien,

I did a little more research into this question and have edited my previous answer. It was not quite correct about how a product is chosen to set flow variables.

Here’s how API product logic works:

1. The APIKey policy executes and verifies the API Key.

2. As a result of executing the policy, the key is matched to a developer app.

3. The API products associated with the developer app are enumerated. The order of the enumeration is random (not guaranteed).

4. Now, Edge looks at each product in the list and for each product:

a. Edge checks if the proxy.pathsuffix in the request maps to (matches) a Resource Path added to the proxy.

b. The first product that matches with the proxy.pathsuffix is chosen.

c. The chosen product is used to set variables on the request. You may use these variables subsequent policies.

d. If no products match, then the API call is rejected.

This logic is also followed for OAuth token validation.

It's good to note too that if a product does not have any Resource Paths defined, then all Resource Paths are allowed and the product is a candidate for a match.

Example One: If a request comes in with a proxy.pathsuffix of /forecastrss, then the product test2 would be chosen:

Product name: test1 Resource Path: /hello

Product name: test2 Resource Path: /forecastrss

Example Two: If a request comes in with a proxy.pathsuffix of /forecastrss, then the product test1 would be chosen if it occurs prior to test2 in the product enumeration, because it has no resource path defined, and therefore it will match any resource path:

Product name: test1 Resource Path:

Product name: test2 Resource Path: /forecastrss

[ozanseymen]

@wwitman - can you elaborate a little bit on "first product that matches"? What is the sorting/selection criteria for this? In my tests it looks like "desc product-app-assignment-datetime" so first product assigned to the app wins. Is this correct?

[willwitman]

Hi @Ozan Seymen

I edited my reply after doing a little more research. Apparently the order of enumerated products is random, and the product that is chosen for setting flow variables is the first one in the list where proxy.pathsuffix in the request matches a Resource Path in the product.

[#5]

I have also encountered this odd behaviour and would like to challenge how the "the chosen product is used to set variables on the request".

I have a developer app mapped against multiple products. I have a custom attribute set on the product to which the proxy I am hitting is linked. I would expect that Product (actually linked to the Proxy) to be the one used to set variables. Nonetheless, according to wwitman's explanation, which is confirmed by my testing, linking a proxy with a product does not ensure that is the product from which variables will be populated. Instead, the product path seems to be part of the logic. I do not set any specific paths in the products. Should the selection here not revert to providing the values for the product for which a proxy has been matched instead?

On the other hand, proxy permissions work correctly despite never showing the Product that allowed the access. Could the values for that Product be accessed as variables in some other way instead then?

This feature, product custom attribute usage, in general seems to be too unpredictable to be used. Could it be that is a bug?