forked from docs/doc-exports
Chen, Junjie
710480502f
Reviewed-by: Pruthi, Vineet <vineet.pruthi@t-systems.com> Co-authored-by: Chen, Junjie <chenjunjie@huawei.com> Co-committed-by: Chen, Junjie <chenjunjie@huawei.com>
96 lines
17 KiB
HTML
96 lines
17 KiB
HTML
<a name="apig-api-190529268"></a><a name="apig-api-190529268"></a>
|
|
|
|
<h1 class="topictitle1">Authentication</h1>
|
|
<div id="body1559097641872"><p id="apig-api-190529268__p26613555143846">Requests for calling an API can be authenticated using either of the following methods:</p>
|
|
<ul id="apig-api-190529268__ul38195410143846"><li id="apig-api-190529268__li8214375143846">Token-based authentication: Requests are authenticated using a token.<p id="apig-api-190529268__p97292269311"><a name="apig-api-190529268__li8214375143846"></a><a name="li8214375143846"></a></p>
|
|
</li><li id="apig-api-190529268__li61384639143846">AK/SK-based authentication: Requests are authenticated by encrypting the request body using an AK/SK pair. AK/SK-based authentication is recommended because it provides higher security than token-based authentication. </li></ul>
|
|
<div class="section" id="apig-api-190529268__section2417768214391"><h4 class="sectiontitle">Token-based Authentication</h4><div class="note" id="apig-api-190529268__note133321911123"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><p id="apig-api-190529268__p1862383415420">The validity period of a token is 24 hours. When using a token for authentication, cache it to prevent frequently calling the IAM API used to obtain a user token.</p>
|
|
</div></div>
|
|
<p id="apig-api-190529268__p18703477214">A token specifies temporary permissions in a computer system. During API authentication using a token, the token is added to requests to get permissions for calling the API.</p>
|
|
<p id="apig-api-190529268__p9691122114266"><a href="apig-en-api-180713011.html">Making an API Request</a> describes the process of calling the API used to create an API group (dedicated gateways). After a token is obtained, the <strong id="apig-api-190529268__b1989511293228">X-Auth-Token</strong> header field must be added to requests to specify the token when calling other APIs. For example, if the token is <strong id="apig-api-190529268__b557119459221">ABCDEFJ....</strong>, <strong id="apig-api-190529268__b15689948152216">X-Auth-Token: ABCDEFJ....</strong> can be added to a request as follows:</p>
|
|
<pre class="screen" id="apig-api-190529268__screen11189101154015">
|
|
POST https://{apig_endpoint}/v2/{project_id}/apigw/instances/{instance_id}/api-groups
|
|
Content-Type: application/json
|
|
<strong id="apig-api-190529268__b172853338430">X-Auth-Token: ABCDEFJ....</strong></pre>
|
|
</div>
|
|
<div class="section" id="apig-api-190529268__en-us_topic_0121671869_section0390282152"><a name="apig-api-190529268__en-us_topic_0121671869_section0390282152"></a><a name="en-us_topic_0121671869_section0390282152"></a><h4 class="sectiontitle">AK/SK-based Authentication</h4><p id="apig-api-190529268__en-us_topic_0121671869_p5607113161512">An AK/SK is used to verify the identity of a request sender. In AK/SK-based authentication, a signature needs to be obtained and then added to requests.</p>
|
|
<div class="note" id="apig-api-190529268__en-us_topic_0121671869_n9dcbfe6b240a43cfa48bb67f6e4b0126"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><p id="apig-api-190529268__en-us_topic_0121671869_a9057158d9de6408fb6d7843353d9b3aa">AK: access key ID, which is a unique identifier used in conjunction with a secret access key to sign requests cryptographically.</p>
|
|
<p id="apig-api-190529268__en-us_topic_0121671869_a6b8f717e84924432b9b93893ca4141c1">SK: secret access key used in conjunction with an AK to sign requests cryptographically. It identifies a request sender and prevents the request from being modified.</p>
|
|
</div></div>
|
|
<p id="apig-api-190529268__p15997957182616">The following uses a demo project to show how to sign a request and use an HTTP client to send an HTTPS request.</p>
|
|
<p id="apig-api-190529268__p11261977377">Download the demo project at <a href="https://github.com/api-gate-way/SdkDemo" target="_blank" rel="noopener noreferrer">https://github.com/api-gate-way/SdkDemo</a>.</p>
|
|
<p id="apig-api-190529268__p19468322103716">If you do not need the demo, obtain the APIG signing SDK from technical support personnel.</p>
|
|
<p id="apig-api-190529268__en-us_topic_0121671869_p1656604461617">AK: access key ID, which is a unique identifier used in conjunction with a secret access key to sign requests cryptographically.</p>
|
|
<div class="fignone" id="apig-api-190529268__en-us_topic_0121671869_fig919329144115"><span class="figcap"><b>Figure 1 </b>Adding the APIG signing SDK</span><br><span><img id="apig-api-190529268__en-us_topic_0121671869_image174116208156" src="en-us_image_0173593322.png" title="Click to enlarge" class="imgResize"></span></div>
|
|
<ol id="apig-api-190529268__en-us_topic_0121671869_ol18692431181510"><li id="apig-api-190529268__en-us_topic_0121671869_li039995792416"><span>Generate an AK/SK. (If an AK/SK file has already been obtained, skip this step and locate the downloaded AK/SK file. Generally, the file name will be <strong id="apig-api-190529268__b208892054103419">credentials.csv</strong>.)</span><p><ol type="a" id="apig-api-190529268__en-us_topic_0121671869_ol1041165715248"><li id="apig-api-190529268__en-us_topic_0121671869_li641635711249">Register an account and log in to the management console.</li><li id="apig-api-190529268__en-us_topic_0121671869_li15426115710241">Hover over the username and choose <strong id="apig-api-190529268__b1331310311386">My Credentials</strong> from the drop-down list.</li></ol><ol type="a" start="3" id="apig-api-190529268__en-us_topic_0121671869_ol4435175711246"><li id="apig-api-190529268__en-us_topic_0121671869_li94401457192414">Click the <strong id="apig-api-190529268__b1813147131112">Access Keys</strong> tab.</li><li id="apig-api-190529268__en-us_topic_0121671869_li4446115712243">Click <strong id="apig-api-190529268__b1766935216311">Create Access Key</strong>.</li><li id="apig-api-190529268__en-us_topic_0121671869_li1645475712241">Enter the login password.</li><li id="apig-api-190529268__en-us_topic_0121671869_li546365716247">Enter the verification code received by email or SMS message.<div class="note" id="apig-api-190529268__en-us_topic_0121671869_note12481175762411"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><p class="text" id="apig-api-190529268__en-us_topic_0121671869_p249925712416">For users created in IAM that have not bound any email address or mobile number, only the login password needs to be entered.</p>
|
|
</div></div>
|
|
</li><li id="apig-api-190529268__en-us_topic_0121671869_li20543057142412">Click <strong id="apig-api-190529268__b114935414311">OK</strong> to download the access key.<div class="note" id="apig-api-190529268__en-us_topic_0121671869_note35511957122417"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><p class="text" id="apig-api-190529268__en-us_topic_0121671869_p3570155782420">Keep the access key secure.</p>
|
|
</div></div>
|
|
</li></ol>
|
|
</p></li><li id="apig-api-190529268__en-us_topic_0121671869_li1115311720450"><span>Download and decompress the demo project.</span></li><li id="apig-api-190529268__en-us_topic_0121671869_li19564155663214"><a name="apig-api-190529268__en-us_topic_0121671869_li19564155663214"></a><a name="en-us_topic_0121671869_li19564155663214"></a><span>Import the demo project to Eclipse.</span><p><div class="fignone" id="apig-api-190529268__en-us_topic_0121671869_fig16546145205014"><span class="figcap"><b>Figure 2 </b>Selecting Existing Projects into Workspace</span><br><span><img id="apig-api-190529268__en-us_topic_0121671869_image1474131114720" src="en-us_image_0173593323.png" title="Click to enlarge" class="imgResize"></span></div>
|
|
<div class="fignone" id="apig-api-190529268__en-us_topic_0121671869_fig767232218519"><span class="figcap"><b>Figure 3 </b>Selecting the demo project</span><br><span><img id="apig-api-190529268__en-us_topic_0121671869_image13419842205018" src="en-us_image_0173593324.png" title="Click to enlarge" class="imgResize"></span></div>
|
|
<div class="fignone" id="apig-api-190529268__en-us_topic_0121671869_fig159778103242"><span class="figcap"><b>Figure 4 </b>Structure of the demo project</span><br><span><img id="apig-api-190529268__en-us_topic_0121671869_image128044312389" src="en-us_image_0173593326.png"></span></div>
|
|
</p></li><li id="apig-api-190529268__en-us_topic_0121671869_li878093111517"><span>Sign the request.</span><p><p id="apig-api-190529268__en-us_topic_0121671869_p10940124322710">The request signing method is integrated in the JAR files imported in <a href="#apig-api-190529268__en-us_topic_0121671869_li19564155663214">3</a>. The request needs to be signed before it is sent. The signature will then be added as part of the HTTP header to the request.</p>
|
|
<p id="apig-api-190529268__en-us_topic_0121671869_p979243115158">The demo code is classified into the following classes to demonstrate signing and sending the HTTP request:</p>
|
|
<ul id="apig-api-190529268__en-us_topic_0121671869_ul46077243144336"><li id="apig-api-190529268__en-us_topic_0121671869_li373103144336"><strong id="apig-api-190529268__b5982134510418">AccessService</strong>: An abstract class that merges the GET, POST, PUT, and DELETE methods into the access method.</li><li id="apig-api-190529268__en-us_topic_0121671869_li15119103144339"><strong id="apig-api-190529268__b199517574414">Demo</strong>: Execution entry used to simulate the sending of GET, POST, PUT, and DELETE requests.</li><li id="apig-api-190529268__en-us_topic_0121671869_li54381430144341"><strong id="apig-api-190529268__b739815754210">AccessServiceImpl</strong>: Implements the access method, which contains the code required for communication with APIG.</li></ul>
|
|
<ol type="a" id="apig-api-190529268__en-us_topic_0121671869_ol1515318170459"><li id="apig-api-190529268__en-us_topic_0121671869_li1985133317503">Edit the main() method in the <strong id="apig-api-190529268__b1644717515392">Demo.java</strong> file, and replace the bold text with actual values.<p id="apig-api-190529268__en-us_topic_0121671869_p2061535616161">As shown in the following code, if you use other methods such as POST, PUT, and DELETE, see the corresponding comment.</p>
|
|
<p id="apig-api-190529268__en-us_topic_0121671869_p129401344175213">Specify <strong id="apig-api-190529268__b2642123633911">region</strong>, <strong id="apig-api-190529268__b7960183753910">serviceName</strong>, <strong id="apig-api-190529268__b7975103917398">ak/sk</strong>, and <strong id="apig-api-190529268__b12744542143916">url</strong> as the actual values. In this demo, the URLs for accessing VPC resources are used.</p>
|
|
<p id="apig-api-190529268__en-us_topic_0121671869_p27531945173720">To obtain the project ID in the URLs, see <a href="apig-api-180713009.html">Obtaining a Project ID</a>.</p>
|
|
<p id="apig-api-190529268__en-us_topic_0121671869_p3481954133711">Obtain the endpoint from the enterprise administrator.</p>
|
|
<pre class="screen" id="apig-api-190529268__en-us_topic_0121671869_screen89816540225">//<strong id="apig-api-190529268__en-us_topic_0121671869_b6201155152216">TODO</strong>: Replace region with the name of the region in which the service to be accessed is located.
|
|
<strong id="apig-api-190529268__en-us_topic_0121671869_b17211255162214">private</strong> <strong id="apig-api-190529268__en-us_topic_0121671869_b152115532218">static</strong> <strong id="apig-api-190529268__en-us_topic_0121671869_b1121105522215">final</strong> String <strong id="apig-api-190529268__en-us_topic_0121671869_b5213558226"><em id="apig-api-190529268__en-us_topic_0121671869_i2211455112218">region</em></strong> = "";
|
|
|
|
//<strong id="apig-api-190529268__en-us_topic_0121671869_b321175517226">TODO</strong>: Replace <strong id="apig-api-190529268__en-us_topic_0121671869_b519712478445">vpc</strong> with the name of the service you want to access. For example, ecs, vpc, iam, and elb.
|
|
<strong id="apig-api-190529268__en-us_topic_0121671869_b142205552215">private</strong> <strong id="apig-api-190529268__en-us_topic_0121671869_b1822195522211">static</strong> <strong id="apig-api-190529268__en-us_topic_0121671869_b172219558226">final</strong> String <strong id="apig-api-190529268__en-us_topic_0121671869_b12213556225"><em id="apig-api-190529268__en-us_topic_0121671869_i1922195592214">serviceName</em></strong> = "";
|
|
|
|
<strong id="apig-api-190529268__en-us_topic_0121671869_b13221655192219">public</strong> <strong id="apig-api-190529268__en-us_topic_0121671869_b1022455162217">static</strong> <strong id="apig-api-190529268__en-us_topic_0121671869_b112335516220">void</strong> main(String[] args) <strong id="apig-api-190529268__en-us_topic_0121671869_b1123185542217">throws</strong> UnsupportedEncodingException
|
|
{
|
|
//<strong id="apig-api-190529268__en-us_topic_0121671869_b623165516223">TODO</strong>: Replace the AK and SK with those obtained on the <strong id="apig-api-190529268__en-us_topic_0121671869_b0678145420449">My Credential</strong> page.
|
|
String ak = "<strong id="apig-api-190529268__en-us_topic_0121671869_b22325514225">ZIRRKMTWP******1WKNKB</strong>";
|
|
String sk = "<strong id="apig-api-190529268__en-us_topic_0121671869_b5235557223">Us0mdMNHk******YrRCnW0ecfzl</strong>";
|
|
|
|
//<strong id="apig-api-190529268__en-us_topic_0121671869_b102345552219">TODO</strong>: To specify a project ID (multi-project scenarios), add the X-Project-Id header.
|
|
//<strong id="apig-api-190529268__en-us_topic_0121671869_b1052355510575">TODO</strong>: To access a global service, such as IAM, DNS, CDN, and TMS, add the X-Domain-Id header to specify an account ID.
|
|
//<strong id="apig-api-190529268__en-us_topic_0121671869_b62445532216">TODO</strong>: To add a header, find "Add special headers" in the <strong id="apig-api-190529268__en-us_topic_0121671869_b17115141154512">AccessServiceImple.java</strong> file.
|
|
|
|
//<strong id="apig-api-190529268__en-us_topic_0121671869_b205398223109">TODO</strong>: Test the API
|
|
String url = "<strong id="apig-api-190529268__en-us_topic_0121671869_b1325555122212">https://{Endpoint}/v1/{project_id}/vpcs</strong>";
|
|
<em id="apig-api-190529268__en-us_topic_0121671869_i325175511223">get</em>(ak, sk, url);
|
|
|
|
//<strong id="apig-api-190529268__en-us_topic_0121671869_b2257555228">TODO</strong>: When creating a VPC, replace <em id="apig-api-190529268__en-us_topic_0121671869_i9635324164517">{project_id}</em> in postUrl with the actual value.
|
|
//String postUrl = "https://serviceEndpoint/v1/{project_id}/cloudservers";
|
|
//String postbody ="{\"<u id="apig-api-190529268__en-us_topic_0121671869_u925135510229">vpc</u>\": {\"name\": \"vpc\",\"cidr\": \"192.168.0.0/16\"}}";
|
|
//post(ak, sk, postUrl, postbody);
|
|
|
|
//<strong id="apig-api-190529268__en-us_topic_0121671869_b1526105511226">TODO</strong>: When querying a VPC, replace <em id="apig-api-190529268__en-us_topic_0121671869_i3475153315457">{project_id}</em> in url with the actual value.
|
|
//String url = "https://serviceEndpoint/v1/{project_id}/vpcs/{vpc_id}";
|
|
//get(ak, sk, url);
|
|
|
|
//<strong id="apig-api-190529268__en-us_topic_0121671869_b026175572211">TODO</strong>: When updating a VPC, replace <em id="apig-api-190529268__en-us_topic_0121671869_i7451847174511">{project_id}</em> and <em id="apig-api-190529268__en-us_topic_0121671869_i87635254516">{vpc_id}</em> in putUrl with the actual values.
|
|
//String putUrl = "https://serviceEndpoint/v1/{project_id}/vpcs/{vpc_id}";
|
|
//String putbody ="{\"vpc\":{\"name\": \"vpc1\",\"cidr\": \"192.168.0.0/16\"}}";
|
|
//put(ak, sk, putUrl, putbody);
|
|
|
|
//<strong id="apig-api-190529268__en-us_topic_0121671869_b1927855152214">TODO</strong>: When deleting a VPC, replace <em id="apig-api-190529268__en-us_topic_0121671869_i592820515463">{project_id} </em>and <em id="apig-api-190529268__en-us_topic_0121671869_i11991897460">{vpc_id} </em>in deleteUrl with the actual values.
|
|
//String deleteUrl = "https://serviceEndpoint/v1/{project_id}/vpcs/{vpc_id}";
|
|
//delete(ak, sk, deleteUrl);
|
|
}</pre>
|
|
</li><li id="apig-api-190529268__en-us_topic_0121671869_li18412306320">Compile the code and call the API.<p id="apig-api-190529268__en-us_topic_0121671869_p188281527115415"><a name="apig-api-190529268__en-us_topic_0121671869_li18412306320"></a><a name="en-us_topic_0121671869_li18412306320"></a>In the <strong id="apig-api-190529268__b4634030164010">Package Explorer</strong> area on the left, right-click <strong id="apig-api-190529268__b1672603304014">Demo.java</strong>, choose <strong id="apig-api-190529268__b131107369409">Run AS</strong> > <strong id="apig-api-190529268__b192189397404">Java Application</strong> from the shortcut menu to run the demo code.</p>
|
|
<p id="apig-api-190529268__en-us_topic_0121671869_p20946560369">You can view the API call logs on the console.</p>
|
|
</li></ol>
|
|
</p></li></ol>
|
|
</div>
|
|
</div>
|
|
<div>
|
|
<div class="familylinks">
|
|
<div class="parentlink"><strong>Parent topic:</strong> <a href="apig-en-api-180713003.html">Calling APIs</a></div>
|
|
</div>
|
|
</div>
|
|
|
|
|
|
<script language="JavaScript">
|
|
<!--
|
|
image_size('.imgResize');
|
|
var msg_imageMax = "view original image";
|
|
var msg_imageClose = "close";
|
|
//--></script> |