Apigee and Okta Partner for API Security
Apigee is excited to announce a partnership with Okta, a leader in the Identity-as-a-Service space.
A critical reason customers use Apigee is to secure their APIs. And one of the most critical aspects of security is the authentication and authorization of the APIs.
Apigee’s and Okta’s offerings complement one another to solve the AuthN/AuthZ problem for customers. Almost every customer using Apigee needs to integrate Apigee Edge with a central identity/SSO store. Enterprises traditionally have used legacy, on-premises identity providers.
But customers increasingly are choosing Apigee and Okta together as two critical platforms for digital transformation and their cloud journey.
There are two common use cases for this integration:
- Customers want to use Apigee’s API management capabilities and use Okta for identity management
- Customers use Okta as their OAuth/OpenID connect provider across the organization
As part of the partnership, we’ve created an out-of-the-box solution for the first scenario (learn about it here). The solution is intended as a reference implementation and is available as an open source solution.
Scenario 1: Apigee provides OAuth
In the first use case, Apigee acts as the OAuth provider while Okta provides the identity store and handles authentication of the identities.
Let’s take a quick look at what we’ve built here:
In the diagram above, Apigee provides the client_id and client_secret. Pre-work steps aren’t needed for the runtime API security; they’re performed beforehand:
- The Apigee admin registers Apigee as a valid client with Okta; Apigee receives the public key from Okta and stores it in its KVM or vault
- A developer self registers in the Apigee developer portal
- The developer registers an app in the Apigee dev portal.,Apigee issues a client ID and Client secret to the app.
In the runtime flow:
- The client makes a call to Apigee with the client ID and secret, which Apigee validates
- Apigee redirects the client app to Okta
- Okta collects the user credentials and authenticates and authorizes the user with support for multi-factor authentication ( if needed)
- If the user is validated, then Okta returns an id_token back to Apigee
- Apigee issues an access token against the id_token and stores a map of access_token to id_token in the key storage
- When a secured API is invoked, it is invoked with the access token, which Apigee validates; depending on requirements, it either sends the whole id_token or part of it to the backend
Scenario 2: Okta acts as the OAuth provider
This is another common integration pattern, but currently we are not providing an out-of-the-box solution for this. Often, when Okta is the enterprise-wide identity platform (for web, mobile, or APIs), the customer is likely to leverage Okta as the OAuth provider.
To follow this integration pattern, it’s important to keep a few things in mind.
For an API program, a developer portal is crucial. This is where developers register themselves as well as their apps. Once the apps are registered, developers receive their API key or client_id/client secret from the dev portal.
Okta can be used as an OAuth provider, but Apigee must have knowledge of the client_ID and client_secret because:
- It uses those IDs for throttling
- The IDs are crucial for analytics and API debugging
- IDs are used for app lifecycle management