Warsaw MuleSoft Meetup #7 - custom policy

Warsaw MuleSoft Meetup #7
25/06/2020
API Policies

All contents © MuleSoft Inc.
Agenda
3
• Community updates
• API Policies
• Custom API Policies
• Quiz
• What’s next & Close

Our Partners
5

Organizer
• Senior Integration Developer at PwC Poland
• MuleSoft Ambassador
• MuleSoft Meetup Leader for Warsaw, Poland
• Latest Salesforce Trailblazer
https://trailhead.salesforce.com/trailblazers/p
atryk-bandurski
• Integration Blog
https://ambassadorpatryk.com/blog
• Working with MuleSoft products for over 8
years now
Patryk Bandurski

Speaker
7
• Mulesoft Developer at Billennium
• 4+ years in Integration as Developer and
Analyst - Mule 3 & Mule 4
• Mulesoft Certified Developer – Level 1
(Mule 4)
• Mulesoft Certified Developer - Integration
and API Associate
• Mulesoft Certified Architect – Solution
Design Specialist
• Mule Meetup Leader for Cracow, Poland
• https://www.linkedin.com/in/wojciech-maciejczyk-
0888a8101/
Wojciech Maciejczyk

Speaker
8
• Mulesoft Developer at Roche
• 10+ years in Integration as Developer,
Analyst and Architect
• Mulesoft Certified Developer – Level 1
(Mule 4)
Jacek Chmielewski

Share
9
• Share the Meetup in your social media
• Use Hashtags
– #MuleSoftMeetup
– #WarsawMuleSoftMeetup
Thanks 

All contents © MuleSoft Inc. 10
Would you like to present some cool topic at the next Meetup?
To submit your idea, fill out this form:
https://tinyurl.com/become-speaker
Become a Speaker at the Meetup

Easy-to-understand
Learning Paths
Training-specific sub-
navigation
Simplified registration
process for courses
and exams
New MuleSoft Training Site
12

The new Mule 4
certification designs
are awesome!
New badges!
New Design!
13

One certification less
14
• MuleSoft Certified Developer – API
Design Associate (RAML 1.0)
• Retiered since 1st of June 2020
• Free Quiz in its place

Did you know?
15
MuleSoft certificates that are about to expire are exteded till 31st of
July 2020

Mule Migration Assistant
Evaluate migration complexity
Generate an initial assessment of the manual
work required for migrating individual Mule
apps
Reduce manual effort
Avoid rewriting from scratch by converting
the project structure and common
connectors (HTTP, DB, etc) into Mule 4
compatible components
Customize with extensibility
Users can develop plugins on the open
source framework for repetitive migration
tasks such as custom connectors and
complex MEL
Jumpstart Mule 3 to Mule 4 migrations
Open
Source

Self-paced courses
FREE!
Up to date!
Videos, Presentation & DIY
Where to start?
17

Warsaw MuleSoft Meetup Group
18
• https://tinyurl.com/warsaw-group
• On MuleSoft Help center
• Why?
– Suggest topics
– Discuss event’s topics
– Discuss anything you like
– Ask questions
– See updates regarding our
group!
Register today 

Kahoot!
19
• Interactive quizes/surveys
• From the web browser
• Visit the page
kahoot.it
and provide
• PIN number
• Your nick

Agenda
20
1. API Manager Policies
1. Policy types
2. Policy categories
3. Policy level
2. Managing default policies
3. Guidelines for using policies

API Manager Policies
21
Policies enable you to enforce regulations to help manage security,
control traffic and improve adaptability of your APIs.
What is quite important you can implement policies with no
modification to the code implementation.
Mulesoft provides ready-to-use default policies that are shipped with
the product. Policies differ based on several different factors, such as
category, purpose, version, and configuration options.

API Manager Policies
22

Policy types
23
Main types of policies:
• Default Policies - ready-to-use policies provided by MuleSoft
• Automated Policies – applied on all APIs automaticly
• Custom Policies – policies you need to implement
– Online Custom Policies
– Offline Custom Policies

Policy categories
24
The following table lists default policies by its category and the
function it performs:
• Security
• Compliance
• Transformation
• Troubleshooting
• Quality of Service

Policy categories - Security
25
• Basic Authentication - authenticates the LDAP credentials or single user
password.
• IP Blacklist - blocks a range of IP addresses.
• IP Whitelist - allows access from only a preapproved range of IP addresses.
• JSON Threat Protection - protects against a malicious JSON structure in API
requests.
• XML Threat Protection - protects against malicious XML elements in API
requests.

Policy categories - Security
26
• JWT - validates a JWT token.
• OAuth 2.0 access token - enforces token access using the MuleSoft OAuth
Provider policy.
• OpenAM Access Token Enforcement - restricts access to a protected resource
using an Open AM authentication server.
• PingFederate Access Token Enforcement - restricts access to a protected
resource using the PingFederate authentication server.
• Tokenization - transforms sensitive data into nonsensitive equivalent tokens.
• Detokenization - transforms a tokenized value back to the original data.

Policy categories – Compliance and
Transformation
27
Compliance
• Client ID Enforcement - allows access to client applications with a valid client
credentials.
• CORS - enables calls executed in a web page to interact with resources from
different domains.
Transformation
• Header Injection - adds headers to the request or response message of a
policy.
• Header Removal - removes headers from the request or response message of a
policy.

Policy categories - Quality of Service and
Troubleshooting
28
QoS
• HTTP Caching - stores HTTP responses from an API implementation.
• Rate Limiting - enables imposing a limit on the number of requests that an API
can accept within a specified time.
• Rate Limiting, SLA-Based - enables imposing an API request limit based on
SLA tiers.
• Spike Control - controls API traffic.
Troubleshooting
• Message Logging - logs a custom message when an API is invoked.

Policy level
29
Policies are by default applied to the entire API.
Policies which implement an additional level of policy granularity are
called resource-level policies.
At the resource level of granularity, policies are applied to only those
requests that match the criteria. All policies, except the Cross-Origin
Resource Sharing (CORS) policy can be used are resource-level.

Managing default policies
30
• Applying policy in API Manager
• Ordering of policies
– CORS exception
• Disabling policies

Guidelines for using policies
31
• When designing System API you may consider using:
– IP whitelisting – IP address range of implementation of Process APIs
– SLA based Rate Limiting – rejects requests when troughput has been reached
– Spike Control – to protect backend systems
• When designing Process API you may consider using:
– IP whitelisting – IP address range of implementation of Process and
Experience APIs
– Client ID enforcement – identity of API clients is always known
– SLA based Rate Limiting - rejects requests when troughput has been reached
– Spike Control – to protect backend systems

32
• When designing Experience API you may consider using:
– IP whitelisting – IP address of the Aggregator to complement TLS mutual
authentication
– JSON/XML Threat Protection – secure your API
– SLA based Rate Limiting - rejects requests when troughput has been reached
– Avoid using Spike Control – use queuing instead

33
• Use API Manager Alerts to detect policy violations.
• Keep correct order of policies, CORS, Certificate Validation, JSON
Threat Protection should be executed first.
• Use resource-level policies when:
– Securing a subset of an API is required
– Setting different limits on resources is needed
• Use Visualizer to monitor policies

Custom Policies
Development and Deployment

Agenda
35
1. Develop from the scratch?
– Policy source code by Mulesoft
– Customize policy provided by Mulesoft
– Tests
2. Custom policy development and deployment
– Required configuration
– Custom Policy Archetype
– “Hello world” policy deployment
– Custom development and deployment
– Tests

Policy source code - how to download it?
36
1. Go to your Anypoint Studio installation directory
2. <AnypointStudio_home>/plugins/org.tooling.server<your.server.version>/mule/policies
3. Source jars are in policy-templates

Policy source code - yaml
37
https://docs.mulesoft.com/api-manager/2.x/custom-policy-4-reference#yaml-configuration-file

Policy customization
38

39

40

41
DEMO

42
DEMO

43
DEMO

44

Custom development
45
https://docs.mulesoft.com/api-manager/2.x/policies-custom-landing-page

Custom development - archetype-repository
46

Custom development - generate project
47

48
DEMO Hello World demo plan:
1. Generate the policy from maven archetype
2. Discuss the generated content
a. yaml
b. template.xml
c. pom.xml
3. Deployment
4. Tests
a. GET /api/resource1 without policy applied
b. GET /api/resource1 with policy applied

49
DEMO

Custom development - yaml and template
50
DEMO

Custom development - packaging
51
DEMO

Custom development - deploy configuration
52
DEMO

Custom development - deploy
53
DEMO

Custom development - uploaded to Exchange
54
DEMO

Custom development - policy unapplied
55
DEMO
implementation of
/api/resource1
no Payload manipulation

Custom development - available in API Manager
56
DEMO

Custom development - working policy
57
DEMO

Custom development - HMAC Data Integrity
58
DEMO HMAC Signature Validation demo plan:
1. Generate the policy from maven archetype
2. Development (yaml, template.xml from code snippet)
3. Deployment
4. Policy configuration in API Manager (signature source, secretKey,
errorStatusCode)
5. Tests
a. POST /api/resource2 without policy applied
b. POST /api/resource2 with policy applied

59
DEMO1. Generate the template from maven archetype
2. Develop your policy:

60
DEMO 1. Check it in Exchange:
2. Check it in API Manager:

61
DEMO

62
DEMO

Summary
63
• Working with policies don’t require a lot of secret knowledge, because the
provided documentation answers most of the questions
• Sometimes the power of Dataweave 2.0 is enough to reuse the out-of-the-
box provided policy in customized way
• Custom policies makes the Anypoint Platform more adjusted to your
organization needs
• Personally, I like this concept and see the huge value from maintenance
perspective, especially in combine with Automated Policy appliance

Voucher for online
training & exam
Wireless mouse
Mi Band 4
Bag
MuleSoft & PWC
lanyard
Prizes
Requirement: the contestant/winner must
have Polish address

Let’s get familiar with
the Kahoot by a quick
4 questions warm up
Kahoot warmup!
Requirement: Players with polish address
add PL to the nick name
Example: Cool Guy PL

Who are the three
lucky winners? Is it
you?
Trivia quiz
Requirement: Players with polish address
add PL to the nick name
Example: Cool Guy PL
Requirement: the contestant/winner must
have Polish address

What’s next
69
• Feedback:
– Contact your organizer Patryk Bandurski via patryk.bandurski@gmail.com or
LinkedIn profile to suggest topics
– Contact MuleSoft at meetup@mulesoft.com for ways to improve the program
• Our next meetup:
– Date: August 2020
– Topic: not known yet. Volunteer … I volunteer as Speaker 

What’s next
70
Invite your network to join
– https://meetups.mulesoft.com/warsaw/

Warsaw MuleSoft Meetup #7 - custom policy

Recomendados

Recomendados

Más contenido relacionado

La actualidad más candente

La actualidad más candente (20)

Similar a Warsaw MuleSoft Meetup #7 - custom policy

Similar a Warsaw MuleSoft Meetup #7 - custom policy (20)

Más de Patryk Bandurski

Más de Patryk Bandurski (9)

Último

Último (20)

Warsaw MuleSoft Meetup #7 - custom policy