Authorization for API gateways
Securely scale API-driven development within your teams and grow with confidence, driven by the power of Orchestrated Authorization.
See how we do itAPI gateways provide you with the ability to realize the benefits of microservice architectures and scale to the individual services that make up the modern day application.
While some organizations may choose to integrate their authorization decision directly into the microservice as a sidecar, depending on their adoption, they may choose to deploy the authorization policy as part of the API Gateway.
When organizations build policies using Axiomatics and leverage the API Gateways as an enforcement point, they accelerate their ability to scale and attribute-based access control (ABAC) model across their applications.
In turn, this architecture serves the Zero Trust goals of continuous policy enforcement against critical attributes such as risk, time, location, classification, role, etc.
Axiomatics has integrated across leading API gateway solutions, such as Mulesoft, Apigee, or Kong, and helped customers around the world securely share data to improve the customer experience.
By using industry standards, no custom coding or SDKs are needed to achieve interoperability between Axiomatics and API Gateways.
Organizations only need to configure gateway settings to add enhanced Attribute-based access control (ABAC) capabilities to their API security implementation.
The Axiomatics integration with an API Gateway,
follows the same, externalized referenced architecture
to enforce run-time authorization policies
In this model, the API Gateway is the Policy Enforcement Point (PEP), while Axiomatics continues to provide the Policy Decision Point (PDP) and integration with attributes (PIPs):
- A subject (user or machine) calls out to the API gateway
- The gateway first determines if the subject is allowed to call the gateway
- The Axiomatics PDP performs a policy evaluation of the request being made by the subject against attributes (Policy Information Points)
- If the subject is allowed to make the request, Axiomatics returns a permit decision
- The API Gateway forwards the decision to the application/resource
- The application/resource returns a response back to the subject
- Call out to API Service X
- Can the client call API Service X’s method Y?
- Evaluate Authorization policies and Optionally look up additional attributes
- Yes, Permit
- Forward the API call
- API response
Let's show you a demo and take the next leap in your authorization journey
Meet with us and see how our award-winning solution can help you meet today's access control and Zero Trust needs.
Request a demo