Apisecure, 14 & 15 March 2023 - Yoshiyuki Tabata, Software Engineer at Hitachi Ltd.
summary
Proposes an API Gateway aggregator that lets clients call many backend gateways while moving policy enforcement to one layer, reducing per-gateway policy ops from N to 1. Implements OAuth 2.0 validation, token revocation and signature checks, and uses Keycloak and nginx as the authorization server and gateway. Uses RFC 8693 token exchange and "token translation" so the aggregator swaps external tokens for gateway-specific tokens, supports FAPI profiles and mutual TLS, and demonstrates the exchange working end to end.
AI-written summary · about
chapters (10)
- 0:00API Gateway aggregation intro
- 3:16Security for API Gateway aggregation
- 9:52API Gateway aggregation solution
- 11:18API authorization requirements
- 13:56Minimizing policy impact
- 17:12Token exchange approach
- 20:52Advanced API aggregation use cases
- 24:34Zero trust network integration
- 28:07Live token exchange demo
- 33:22Summary
related talks
28mAPI Gateway: critical component of your digital architecture
14mArchitecting Secure and Scalable Integration Platforms for FinTech
19mMastering Multi-API Gateways: Strategies for Scale, Security & Success.
36mAdvanced Authentication patterns at the Edge
25mThe AI Triple Security Gap: Why Your Gateway Strategy is Already Obsolete.
16mAPI Security Challenges and How to Address Them
19mCreating a Solid Foundation for API Security
46mAPI Gateway Recipes: Solutions for Operation, Integration & Security