Book Image

Digital Transformation and Modernization with IBM API Connect

By : Bryon Kataoka, James Brennan, Ashish Aggarwal
Book Image

Digital Transformation and Modernization with IBM API Connect

By: Bryon Kataoka, James Brennan, Ashish Aggarwal

Overview of this book

IBM API Connect enables organizations to drive digital innovation using its scalable and robust API management capabilities across multi-cloud and hybrid environments. With API Connect's security, flexibility, and high performance, you'll be able to meet the needs of your enterprise and clients by extending your API footprint. This book provides a complete roadmap to create, manage, govern, and publish your APIs. You'll start by learning about API Connect components, such as API managers, developer portals, gateways, and analytics subsystems, as well as the management capabilities provided by CLI commands. You’ll then develop APIs using OpenAPI and discover how you can enhance them with logic policies. The book shows you how to modernize SOAP and FHIR REST services as secure APIs with authentication, OAuth2/OpenID, and JWT, and demonstrates how API Connect provides safeguards for GraphQL APIs as well as published APIs that are easy to discover and well documented. As you advance, the book guides you in generating unit tests that supplement DevOps pipelines using Git and Jenkins for improved agility, and concludes with best practices for implementing API governance and customizing API Connect components. By the end of this book, you'll have learned how to transform your business by speeding up the time-to-market of your products and increase the ROI for your enterprise.
Table of Contents (21 chapters)
1
Section 1: Digital Transformation and API Connect
5
Section 2: Agility in Development
15
Section 3: DevOps Pipelines and What's Next

Out-of-the-box security capabilities of APIC

When securing APIs with APIC, you are provided with three out-of-the-box security capabilities that can be applied. These are as follows:

  • API key: This method involves configuring Client ID and Client Secret security definitions as part of defining an API. Once defined in the API's Security definition, a consumer may pass values for these API keys as part of a request's query (X-IBM-Client-Id, X-IBM-Client-Secret) or header (client_id, client_secret).
  • Basic authentication: This option allows you to perform API authentication by validating the supplied credentials against an Authentication URL or an LDAP-based user registry.
  • OAuth: The OAuth option allows us to secure APIs utilizing the standards set forth for OAuth2 (and OIDC).

These three capabilities should generally solve most of your API security concerns. When choosing between these security capabilities, you utilize a two-step process within an API...