Solved: Best practices for common backend authentification - Page 2

remi_roy · 06-22-2022 01:20 AM

Hello, I'm looking for best practice information for my use case:

- I have a backend that exposes APIs with basic authentication: it's a service token, it only changes depending on the environment

- I have secure proxy APIs in oauth2 which calls these services

What are the best practices to make my basic authentication generic and configurable by environment ? Should i do a Shared Flow ? Where can i stock my token by environnement ? (example: if I have to change the token, I have to do it only once)

Thanks !

Arnaduga

Hello

On my side, I also have a backend that requires a Basic AuthN (and IP Whitelisting as well). To make it configurable by env, I use Target Server object and KVM.

The Target Server is holding protocol and URL information. The KVM is holding the creds. And then, in the Target Endpoint Preflow, there is a KVM Operation policies, to retrieve values, and an Assign Message policy, to set the basic authN.

In some cases, my KVM store the encoded base 64, sometimes the username and paswword, but in that case I also added a Python policy to encode into base64.

Arnaud

View solution in original post