Changes for page Endpoint Check

Summary

• Page properties (2 modified, 0 added, 0 removed)

Details

Page properties

Title

...	...	@@ -1,1 +1,1 @@
1		-Securing your SOAP Webservice
	1	+novice-file-based-connectivity-header-line

Content

...	...	@@ -1,111 +1,77 @@
1	1	{{container}}{{container layoutStyle="columns"}}(((
2		-When setting up a point at which your customers can talk to you eMagiz offers various methods of creating such a point. One of those options is by hosting a SOAP Webservice in eMagiz that handles XML messages asynchronously or synchronously. In this microlearning, we will zoom in on the part that security plays on a client level when hosting a SOAP web service.
	2	+In this microlearning, we will focus on using annotations to clarify your thought process. In the annotation, you either describe a best practice everyone should follow when they change that flow (i.e. within the asynchronous routing), describe how the (more complex) parts of the flow work or describe (parts of) of your message definitions (i.e. CDM, API Gateway Data model, system message, etc.). This will help yourself and others every time changes are needed.
3	3
4		-Should you have any questions, please contact academy@emagiz.com.
	4	+Should you have any questions, please contact [[academy@emagiz.com>>mailto:academy@emagiz.com]].
5	5
6		-* Last update: June 10th, 2021
7		-* Required reading time: 7 minutes
	6	+* Last update: May 9th, 2021
	7	+* Required reading time: 5 minutes
8	8
9	9	== 1. Prerequisites ==
	10	+
10	10	* Basic knowledge of the eMagiz platform
11	11
12	12	== 2. Key concepts ==
13		-This microlearning centers around configuring your SOAP web service.
14	14
15		-By configuring, we mean: Designing and determining the characteristics of the SOAP web service
	15	+This microlearning centers around using annotations.
	16	+With annotations, we mean: A piece of text to explain something to yourself and others
16	16
17		-Crucial parts in the configuration are:
18		-* Operation Name
19		-* SOAP Webservice Namespace
20		-* Validation
21		-* Authentication
	18	+Annotations can be used for:
22	22
23		-Of these four points, we will zoom in on the authentication part of our SOAP Webservice in this microlearning.
24		-
25		-== 3. Securing your SOAP Webservice ==
	20	+* Describing a best practice everyone should follow
	21	+* Describing (more complex) parts of the flow
	22	+* Describe (parts of) your message definitions
26	26
27		-When setting up a point at which your customers can talk to you eMagiz offers various methods of creating such a point. One of those options is by hosting a SOAP Webservice in eMagiz that handles XML messages asynchronously or synchronously. In this microlearning, we will zoom in on the part that security plays on a client level when hosting a SOAP web service.
	24	+== 3. Annotations ==
28	28
29		-Crucial parts in the configuration are:
30		-* Operation Name
31		-* SOAP Webservice Namespace
32		-* Validation
33		-* Authentication
	26	+In this microlearning, we will focus on using annotations on the flow level to clarify our thought process. In the annotation, you either describe a best practice everyone should follow when they change that flow (i.e. within the asynchronous routing) or describe how the (more complex) parts of the flow work. This will help yourself and others every time changes are needed within the flow.
34	34
35		-Of these four points, we will zoom in on the authentication part of our SOAP Webservice in this microlearning. When hosting your SOAP web service in the eMagiz Cloud the endpoint will be HTTPS secured on default. If you want to mimic the same result for an on-premise environment you should define the valid SSL settings (https://my.emagiz.com/p/question/172825635700357186).
	28	+Annotations can be used for:
36	36
37		-Apart from that aspect of security, we should also consider how clients that call the SOAP Web service will authenticate themselves upon entry. Within eMagiz, we advise a two-step approach. Each client that wants to call your SOAP Webservice should:
	30	+* Describing a best practice everyone should follow
	31	+* Describing (more complex) parts of the flow
	32	+* Describe (parts of) your message definitions
38	38
39		-* Send along a client certificate
40		-* Send along an API key in a SOAP Header that references to the word apiKey (i.e. apiKey)
	34	+To clarify the use cases let us take a look at how annotations can be added within the eMagiz platform. In our first example, we will take a look at asynchronous routing. In many eMagiz projects, a best practice is followed on how to add something to the asynchronous routing (or change something within the asynchronous routing). Because the best practice contains multiple steps it makes sense to use the annotation functionality of eMagiz to define all these steps and register them at the place you need them (i.e. the asynchronous routing). Having done so will result in something like this:
41	41
42		-To verify both parts some configuration is needed. The first aspect, checking for a valid client certificate is done on cloud level. For more information on how to exactly configure this please take a look at the microlearning [Securing a hosted web service with certificates in the eMagiz Cloud](intermediate-securing-your-data-traffic-securing-a-hosted-webservice-with-certificates-in-the-emagiz-cloud.md).
	36	+[[image:Main.Images.Microlearning.WebHome@novice-devops-perspectives-annotations--annotation-best-practice-async-routing.png]]
43	43
44		-In this microlearning, we will focus on the second part of the configuration.
	38	+The second example is about using annotations on the flow level to describe parts of the flow. In this example, we will use the annotation to describe that we use a filter to determine which messages are picked up from a local directory and how we filter. That way anyway opening the flow has to merely read the annotation to get the context. Having done so will result in something like this:
45	45
46		-=== 3.1 API Key verification ===
	40	+[[image:Main.Images.Microlearning.WebHome@novice-devops-perspectives-annotations--describe-parts-of-flow.png]]
47	47
48		-To verify whether the client has sent a valid API Key we need to change the configuration within the entry flow in the Create phase of eMagiz. The configuration consists of three steps:
	42	+The third example does not take place on the flow level but the message definition level. Therefore instead of going to Create, we go to Design. In Design when you navigate to the CDM, API Gateway Data model, Event Streaming Data model, message definitions, etc. you have the option to add annotations to the canvas. In this example, we want to make clear to all that make changes that a certain part of our CDM is used by a lot of integrations within eMagiz and therefore everyone should be careful and think twice before adjusting anything related to that part. Having done so will result in something like this:
49	49
50		-* Get value from SOAP Header
51		-* Check value against a list
52		-* Respond based on results
	44	+[[image:Main.Images.Microlearning.WebHome@novice-devops-perspectives-annotations--describe-crucial-part-of-cdm.png]]
53	53
54		-==== 3.1.1 Get value from SOAP Header ====
	46	+Now that we saw some examples let us turn our attention to the how. How can I add an annotation and how can I link it. Adding the annotation is simple. You drag the annotation icon from the left context menu onto the canvas. As a result, an empty annotation will be shown on the canvas. By double-clicking on it you can type whatever you want. Note that you need to be in "Start Editing" mode to change anything, including annotations.
55	55
56		-Let us move to the entry flow by going to the Create phase of eMagiz, opening the correct flow, and entering "Start Editing" mode. After you have done so we need to add a support object to the flow. The support we need is called 'Complex SOAP header mapper'. In this component, we need the bottom section.
	48	+[[image:Main.Images.Microlearning.WebHome@novice-devops-perspectives-annotations--annotation-icon-context-menu.png]]
57	57
58		-[[image:Main.Images.Microlearning.WebHome@novice-soap-webservice-connectivity-securing-your-soap-webservice--complex-soap-header-mapper.png]]
	50	+When you are satisfied with what you have written down you can press the Save button. After you have done so you can rescale the annotation to ensure that the complete text is visible. To link the annotation to a component (on flow level) or an entity (on message definition level) you hover over the annotation until your mouse indicator changes to a + icon, execute a right-click and drag from the annotation to the component in question.
59	59
60		-Here we define a new header by entering a name and a valid XPath expression.
	52	+Now you know what annotations are good for and how you can add them within the eMagiz platform.
61	61
62		-[[image:Main.Images.Microlearning.WebHome@novice-soap-webservice-connectivity-securing-your-soap-webservice--complex-soap-header-mapper-config.png]]
63		-
64		-When you are satisfied you can press Save twice to store the support object. After we have configured the support object we need to link it to our web service inbound gateway. To do so open the component, navigate to the advanced tab and select the Header mapper you have just created.
65		-
66		-[[image:Main.Images.Microlearning.WebHome@novice-soap-webservice-connectivity-securing-your-soap-webservice--link-complex-soap-header-mapper.png]]
67		-
68		-==== 3.1.2 Check value against list ====
69		-
70		-Now that we placed the value the client has entered in the apiKey SOAP header on our message we can check whether the value exists in a list of predefined valid values. To do add two headers to the standard header enricher component in your flow. The first one ensures that the apiKey is removed from the header (to prevent the API key from being publicly seen by others). The second one searches for the client name that corresponds with the apiKey and returns the name of the client in the header. This search action is done with the help of a SpEL expression, more on that later on. In this case the SpEL expression we use is set up as follows: headers['spwbsrv_apiKey'] != null and {${authentication.api-keys}}.contains(headers.spwbsrv_apiKey) ? {${authentication.tenant-ids}}[{${authentication.api-keys}}.indexOf(headers.spwbsrv_apiKey)] : null
71		-
72		-With this SpEL expression, we check whether there is an API key and whether that apiKey can be found in a predefined list. If so we search for the corresponding name based on the index of where a certain apiKey is within the list. If not the header is not created. Combining this logic in one component should look similar to the following.
73		-
74		-[[image:Main.Images.Microlearning.WebHome@novice-soap-webservice-connectivity-securing-your-soap-webservice--check-headers.png]]
75		-
76		-==== 3.1.3 Respond based on results ====
77		-
78		-After we have searched for the API key in the list and we have defined the client that is sending the information (or not) we can respond to the client whether or not the client is authorized to call our SOAP web service. To execute this check we first need a standard filter component. In this component, we will check whether the spwbsrv_client header we have just created is not null.
79		-
80		-[[image:Main.Images.Microlearning.WebHome@novice-soap-webservice-connectivity-securing-your-soap-webservice--standard-filter.png]]
81		-
82		-If it is indeed not null we can pass the empty message back to the client telling the client that the message was delivered successfully. If the header is null we need to tell the client that he/she is unauthorized to call the operation. To do so we need to add a component called 'custom error message activator'. In this component, we define the message we want to give back to the client in case of an error. In this case, we simply give back 'Unauthorized'.
83		-
84		-[[image:Main.Images.Microlearning.WebHome@novice-soap-webservice-connectivity-securing-your-soap-webservice--custom-error-message.png]]
85		-
86		-With all this done we have successfully secured our SOAP web service according to the best practices.
87		-
88	88	== 4. Assignment ==
89	89
90		-Secure a SOAP web service to confirm the outlined approach above. Focus on the apiKey part.
	56	+Add annotation on the flow level that describes how (a part of) a flow works.
91	91	This assignment can be completed with the help of the (Academy) project that you have created/used in the previous assignment.
92	92
93	93	== 5. Key takeaways ==
94	94
95		-* Crucial parts in the configuration are:
96		- ** Operation Name
97		- ** SOAP Webservice Namespace
98		- ** Validation
99		- ** Authentication
100		-* Hosting your SOAP web service in the eMagiz cloud results in standard HTTPS
101		-* Use a combination of client certificate + API key for authentication
	61	+* Annotations can be used for:
	62	+ * Describing a best practice everyone should follow
	63	+ * Describing (more complex) parts of the flow
	64	+ * Describe (parts of) your message definitions
	65	+* You can add annotations by dragging and dropping the annotation icon on the canvas.
102	102
103	103	== 6. Suggested Additional Readings ==
104	104
105		-If you are interested in this topic and want more information on it please read the help text provided by eMagiz.
	69	+There are no suggested additional readings on this topic
106	106
107	107	== 7. Silent demonstration video ==
108	108
109		-{{video attachment="novice-soap-webservice-connectivity-securing-your-soap-webservice.mp4" reference="Main.Videos.Microlearning.WebHome"/}}
	73	+This video demonstrates how you could have handled the assignment and gives you some context on what you have just learned.
110	110
	75	+{{video attachment="novice-devops-perspectives-annotations.mp4" reference="Main.Videos.Microlearning.WebHome"/}}
	76	+
111	111	)))((({{toc/}}))){{/container}}{{/container}}