Home › Custom REST Authentication

Custom REST Authentication

An Authority that calls a REST service that makes the authentication decision for the authority. The REST service must implement the Custom REST Authority API that provides a mechanism for developers to extend and enhance the access control capabilities of Resilient Access to meet their requirements.

Configuring the authority

To configure the authority, complete the following steps.

  1. Sign into the Administrative Console.
  2. Click Create New Authority.
  3. Ensure that Custom REST Authentication – V2 is selected in the Authority Type list box.
  4. Type a name for the authority in the Authority Name box.
  5. Type a name for the authority in the Authority Display Name box.
  6. Type a description of the authority in the Authority Description box (optional).
  7. Use the Configuration Parameters area to specify static name/value pairs to be sent with each evaluation request at runtime. Since the same value is sent every time, this type of parameter may be useful to send API credentials for web services the REST service authority is encapsulating. The config parameters can be sent either in the POST body or as HTTP header parameters
  8. Use the Runtime Parameters area to add and configure the parameters that are used in the execution of the authority, e.g. email address or user ID. The values of these parameters will be supplied by the end user at runtime. For each runtime parameter, specify the following:
    • Type the name of the parameter in the Name box. The parameter name gets paired with the value provided at runtime and sent to the custom REST authority.
    • Type the label of the box displayed to the end user in the Display Name box.
    • If the parameter will contain a sensitive value, such as personally identifiable information, select the Obfuscate check box. This instructs Resilient Access to substitute an opaque token for the value as it transits the network, ensuring that the value is opaque to other authorities that may be part of the policy workflow.
    • If the user will provide the value in the initial request form, select the Initial Request check box. NOTE: Resilient recommends leaving the Initial Request check box blank if the value is sensitive or contains personally identifiable information.
    • Select the Mask Input checkbox to mask the values with bullet characters as the user types them in. This protects against shoulder surfing.
  9. Type the fully qualified URL for the base address of the REST service in the Custom REST Service URL box including scheme and port (if applicable). The /token and /evaluate end-points must be implemented off this base address as per the Custom REST Authority API specifications.
  10. Once you have finished configuring the custom authority, click Create or Save.

Retrieving API Credentials

From the Authorities list retrieve the API credentials for the JWT Bearer Token OAuth authentication that is required for the Custom REST service API. This includes:

  • Client ID
  • Client Secret
  • Public Key of an RSA Key Pair in PEM format (the Private Key is stored in Resilient Access)
  • Key ID

 


-- Download Custom REST Authentication as PDF --