Encapsulate external OAuth

[juanarias]

Hi all,

I want to encapsulate OAuth 2.0 authentication inside apigee. That means, the client will send only an API key (taken from developer app) and, inside the flow, I want to make the OAuth authentication.

This is my current working configuration:

    <PreFlow name="PreFlow">
        <Request>
            <Step>
                <Name>Verify-API-Key</Name>
            </Step>
            <Step>
                <Name>OAuth-Service-Callout</Name>
            </Step>
            <Step>
                <Name>Extract-OAuth-Token</Name>
            </Step>
            <Step>
                <Name>Assign-OAuth-Token</Name>
            </Step>
            <Step>
                <Name>SaveAccessToken-OAuth-v20</Name>
            </Step>
        </Request>
        <Response/>
    </PreFlow>

The OAuth-Service-Callout invokes the external OAuth server and gets the token. That works fine.

The Extract-OAuth-Token takes the token from the response and assign it to a local variable called external_token. Pretty simple.

The Assign-OAuth-Token looks like this:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<AssignMessage async="false" continueOnError="false" enabled="true" name="Assign-OAuth-Token">
    <DisplayName>Assign OAuth Token</DisplayName>
    <Set>
        <Headers>
            <Header name="Authorization">Bearer {external_token}</Header>
        </Headers>
        <FormParams>
            <FormParam name="client_id">{apigee.client_id}</FormParam>
            <FormParam name="grant_type">client_credentials</FormParam>
        </FormParams>
    </Set>
    <AssignVariable>
        <Name>oauth_external_authorization_status</Name>
        <Value>true</Value>
    </AssignVariable>
    <IgnoreUnresolvedVariables>true</IgnoreUnresolvedVariables>
    <AssignTo createNew="false" transport="http" type="request"/>
</AssignMessage>

And the SaveAccessToken-OAuth-v20 looks like this:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<OAuthV2 async="false" continueOnError="false" enabled="true" name="SaveAccessToken-OAuth-v20">
    <DisplayName>SaveAccessToken OAuth v2.0</DisplayName>
    <Operation>GenerateAccessToken</Operation>
    <ExternalAuthorization>true</ExternalAuthorization>
    <ExternalAccessToken>external_token</ExternalAccessToken>
    <StoreToken>true</StoreToken>
    <GenerateResponse enabled="false"/>
    <Tokens/>
</OAuthV2>

This is working, and if I call the proxy with the propper API key, I get a success response, with data from target endpoint. In the trace I can see the call to OAuth server, the generated token and so on.

That works fine, but it needs some optimizations.

I would like to only perform the service callout the first time. After I get the token, I want to store it in Apigee to be used in the following calls. At least, while the token is valid.

And only call again the OAuth server, the server callout, once the token is expired.

I'm trying to add a this at the beginning of the flow, but it's NOT working. It throws a 401 HTTP error, but I can't see any messages or descriptions about what failed.

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<OAuthV2 async="false" continueOnError="false" enabled="true" name="ValidateTokenOAuth-v20">
    <DisplayName>ValidateTokenOAuth v2.0</DisplayName>
    <Operation>VerifyAccessToken</Operation>
    <ExternalAuthorization>true</ExternalAuthorization>
    <GenerateResponse enabled="true"/>
    <Tokens/>
</OAuthV2>

What do you think about the approach? What am I missing?

Thanks in advance!

Juan