Blog | G5 Cyber Security

API Gateway & Active Directory Access Control

G5 Cyber Security

TL;DR

This guide shows you how to secure your API using an API Gateway and authenticate users against Active Directory (AD). We’ll cover setting up the gateway, configuring AD integration, and implementing a basic authorization flow.

1. Choose Your API Gateway

Several options exist, including AWS API Gateway, Azure API Management, Kong, Tyk, and others. The steps below are generally applicable but will vary slightly depending on your chosen gateway. We’ll assume a general approach that can be adapted.

2. Configure Active Directory Integration

  1. Create an Application Account: In AD Users and Computers, create a dedicated service account for the API Gateway to use. This account needs read permissions on user objects. Avoid using privileged accounts.
  2. Gateway Configuration: Within your API Gateway’s settings, find the section for authentication providers or identity sources. Configure a new provider of type ‘Active Directory’. You’ll need:
    • Server address (e.g., ad.example.com)
    • Port number (usually 389 or 636 for SSL/TLS)
    • Base DN (e.g., OU=Users,DC=example,DC=com – this defines where to search for users)
    • Username and password of the application account created in step 1.

3. Implement Authentication

The API Gateway needs a way to verify user credentials before passing requests to your backend API.

  1. Authentication Scheme: Configure the gateway to use a suitable authentication scheme, such as Basic Authentication or OAuth 2.0 with Active Directory as the identity provider. OAuth is generally preferred for security and flexibility.
  2. Request Header: Decide which HTTP header will carry the user’s credentials (e.g., Authorization).

4. Authorization Flow

This describes how a request gets authorized.

  1. User Request: The client sends an API request with the appropriate authentication header containing their credentials. For Basic Auth, this might be Authorization: Basic <base64 encoded username:password>
  2. Gateway Interception: The API Gateway intercepts the request and extracts the credentials from the header.
  3. AD Validation: The gateway connects to Active Directory using the configured application account and validates the user’s credentials against AD.
  4. Token Generation (Optional): If using OAuth, the gateway might issue a short-lived access token after successful authentication.
  5. Request Forwarding: If authentication is successful:
    • The gateway forwards the request to your backend API.
    • Optionally include user information in headers (e.g., X-User-ID, X-User-Roles).
  6. Rejection: If authentication fails, the gateway returns an appropriate error response (e.g., HTTP 401 Unauthorized).

5. Backend API Integration

Your backend API needs to trust the information provided by the gateway.

  1. Header Validation: The API should validate any user-related headers passed by the gateway (e.g., check for expected values in X-User-ID and X-User-Roles).
  2. Authorization Logic: Implement your API’s authorization logic based on the validated user information. For example, restrict access to certain endpoints based on roles.

6. Example Code (Conceptual)

This is a simplified illustration of how you might validate headers in a Python Flask API.

from flask import Flask, request, jsonify

app = Flask(__name__)

@app.route('/protected')
def protected_endpoint():
    user_id = request.headers.get('X-User-ID')
    if user_id == 'admin':
        return jsonify({'message': 'Access granted to admin'}) 
    else:
        return jsonify({'error': 'Unauthorized'}), 401

if __name__ == '__main__':
    app.run(debug=True)

7. Security Considerations

Exit mobile version