How AAA action works

AAA,Authenticaion Authorization and Audit.This is the one of the most important security feature provided by DataPower. Every time if we want to secure a web service and we want to let the authorized user to access that service we use AAA mechanism.
There is a step wise process

AAA working flow
Extract the Identity credentials from the input message or request
Authenticate the credentials extracted from payload
Maps the credentials with the authorization server credentials
Extract the resource from the input message or request
Map the resource with the authorization server which the credentials are assigned it to
Authorize the credentials from the first 3 steps with the resource in 4th and 5th one.
Post Processing of the request

Digital Signature and Implementation in DataPower

First one should understand what is Digital Signature and why enterprise level applications use this.

Digital Signature is an electronic signature which used to authenticate the sender of the message and ensure the message content is unchanged.We can ensure the original signed message because the sender cannot easily repudiate it later.

These are widely used in most secured transactional applications like credit card,bank loan,other financial and health applications where confidentiality is strictly maintained.It doesnt mean that other industries may not use them.Every application which need the high security level will use digital signatures.
Concept of Digital Signatures:
There are few simple steps to explain how Digital Signature works.
Step 1:

Ram sends email with stamping his digital signature by using his private key to Sita

Step 2:

Up on receving email Sita verifies the digital signature in the email with the Ram public Key.

So once both keys matched and verified Sita able to read the message and she can confirm that message was unchanged.

DataPower Implementation:
We can validate the digital signature or sign the digital signatiure on document with the processing actions and public and private self signed certs.
Once we created the private and public key for the digital signature from the crypto tools in DP.We are almost ready to implement the Digital Signature in our Processing Policies.
Example any web services which involved in transmission of highly confidential data.We create a multi-protocal gateway or WSP based on the requirements and after that
To Verify:
1. Go to Processing Policy

2. drag and drop the "verify" Action 

3. Create the vliadation credentials and insert the public key for the verification

To Sign
1. Go to Processing Policy

2.Drag and Drop "Sign" Action 

3.Create the Key and Certificate with the private key and public cert.

4.Share the public cert with the receiver so that he can verify

Missing Input on ACTION-"Error"

Error Message:

Missing Input on Action

Cause:

The action that you configured in you policy rule doesn't accept the empty message.

Solution:

There are few troubleshoot techniques are involved in this error.

1. Go to object->MPG->Process Message whose body is empty and turn it On.
2. Go to Processing policy and configure new transform action before the error resulted action and make context as INPUT and output as NULL.

This may solve the issue,for additional troubleshooting you may enable the probe and monitor the requests and responses.Try to find out where you are getting the empty result.

Creating Web Service Proxy(WSP)

Web Service Proxy is a powerful service in DataPower which provides abstraction and security to the backend web services.It provide access to variety of web services.

WSP has many important characteristics like

• URI abstraction
• Schema Validation
• Building operation level rules.

All the information will be available in WSDL document which is used by Datapower

Steps to create WSP:

1. Go to Services->Web-Service proxy->New
2. Give the Name of the proxy
3. Upload the wsdl of that particular proxy
4. Create an Http front side handler and mention Binding SOAP 1.1 or 1.2
5. Give Remote host,port,URI in the Remote End point URL
6. You can mention load balancer group also in that remote end point
7. Policy is automatically created after uploading wsdl,you can implement you actions in this
8. You can turn on and turn of the schema validation  at the wsdl level in that policy

10.Apply the changes and save
This is the breif decription of creating WSP.

Creating MultiProtocal Gateway

Multiprotocal Gateway(MPG) is the versatile service.As the name itself suggests us that MultiProtocal Gateway will process the requests between various protocols.

Steps to process request:

1. Receives Request
2. Process request with processing policy
3. Forward to remote server or back end

This flow is same for the response too.

MPG will use front side handlers to manage client connections.Note that a single MPG can have multiple front side handlers.

The basic difference between Web service proxy(WSP) and MPG is WSP will not process REST requests and MPG will not use WSDL to determine the configuration

Steps to Create a Multiprotocal Gateway:

• Log in to the device
• Go to Services->Multiprotocal Gateway->New-Multiprotocal-Gateway
• Give name of the MPG under Multi-Protocol Gateway Name 
• Create an XML Manager by clicking + sign and fill all the required options
• Inside XML Manager create User Agent and fill all the required options
• Create the processing policy by clicking + after the Multi-Protocol Gateway Policy
• Create a request,response and error rules in the policy by selecting type in the rule 
•  Create a front side handler for your MPG with the required protocol
• Select Type of back end whether it static or dynamic.If it is static give the Back end url in the backend URL  option
• select SSL client crypto profile 
• sepcify Request and Response Type
• You can leave other options as a default

.














This is just an overview to create  a MPG.
More details on specific options in this will be in another post