Details

Category: General

Published: 09 January 2025

Hits: 676

Steps

• Create a restricted permission custom role
• Create a user to login and assign role
• Obtain access token

Why bother?

The Information Brewery doesn't want the usernames and passwords to your data. The Apigee management APIs allow the use of access tokens - which are used instead of passwords, they have no sensitive data in. We use these tokens instead to run the Apigee convertors.

You also need to be careful which access tokens you give us. If you use us an access token for an Admin user, then we might be able to sneak in. By creating a custom role, with a dedicated user, you will know that we can't use that token for anything else. 

Create a restricted permission custom role

First create a custom role to limit the account to just the stats reporting APIs. Unfortunately the Apigee Edge UI doesn't allow this level or permission configuration and you need to use the management APIs.

A tool such as Postman can be used for this (although there isn't a maintained collection). The online Edge documentation allows you to use the APIs - but this is not ideal as it requires you to share your username and password with their website, which access tokens avoid.

Use a POST request to create a custom role - give it a short clear name such as StatsReportingOnly. 

• Call User Role API - userroles endpoint

Add permissions using POST userroles permissions endpoint , you will need to do it twice to add two paths used:

{
    "path": "/environments/*/stats",
    "permissions" : ["get"]
}

Second one:

{
    "path": "/environments/*/stats/*",
    "permissions" : ["get"]
}

Create a user to login and assign role

Standard login

If you login to the Apigee Edge console using the built in login, you just need to add a user in the Edge admin console.  

Do this by:

• Navigate to Admin -> Users menu
• Click on the button "+ User" 
• Enter the email you want to use
• Select the StatsReporting role (or which ever name was used)

The email must have a working mailbox, the password can't be reset without the email and it's associated link. 

SAML Single Sign-On

This is more complex and you need to:

• Create a dedicated stats reporting user in your SAML directory
• Create a user in Apigee Edge, with a matching email address
  • You select the StatsReporting role (or which ever name was used) as part of the user creation

Machine User

If you have SAML enabled, then you must create a machine user. This requires use of the Apigee CLI and you need to have a Zone Admin account. It has a number of steps:

• Create the machine user in the Zone you use - see: System Admin - Automating Tasks - Machine User
• Create the user in the Edge Organisation, in the same way as a standard login

Obtain access token

Standard user or SAML user

You need to copy and paste the access token from the Apigee cookies:

• Login into the Apigee Edge UI
• Open your browser developer tools - in Windows this is normally CTRL+SHIFT+I
• Open the storage tab on the developer tools
• Find the cookies for apigee.com
• Copy the value from the "access_token" cookie
• Paste into the Access Token box on the Information Brewery

Machine user

There are a number of ways to do this:

• Edge OAuth2 Service - Edge OAuth2 service to get tokens 
• Linux users can use either the Apigee curl (acurl) or get_token

If you want to use the Edge OAuth2 Service you will need to use an HTTP tool to call this, such as:

• curl
• Postman

Postman has a built in Authorization tool for a Collection. Apigee publicly publishes the base64 encoded value that needs to go into  the Basic Auth header. For Postman you need to decode it and enter the username and password:

• Encoded = ZWRnZWNsaTplZGdlY2xpc2VjcmV0
• Decoded  = edgecli:edgeclisecret