Validating policies and data in API authorization system
Some embodiments provide a method for distributing a set of parameters associated with policies for authorizing Application Programming Interface (API) calls to an application. For a previously stored hierarchical first document that comprises a first set of elements in a first hierarchical structure, the method receives a hierarchical update second document that comprises a second set of elements in a second hierarchical structure corresponding to the first hierarchical structure, wherein at least a subset of elements in the first and the second documents correspond to the set of parameters for evaluating API calls. The method receives a first set of hash values for elements of the first document that are not specified in the second document, and generates a second set of hash values for a set of elements specified in the second document. The method generates an overall hash for the second document by using the received first set of hash values and the generated second set of hash values. The method uses the overall hash to validate a signature from an entity that is authorized to specify the set of parameters.
1. A method of distributing policies for authorizing Application Programming Interface (API) calls to an application executing on a machine operating on a host computer, the machine associated with an entity, the method comprising:
at a server operating outside of the host computer:
receiving, from the entity, a set of one or more API-authorizing policies signed with a signature associated with the entity;
storing the signed set of API-authorizing policies;
distributing the signed set of API-authorizing policies to the host computer for a local agent to enforce on API calls to the application, wherein before using the API-authorizing policies, the local agent authenticates that the set of API-authorizing policies was signed by the entity.
2. The method of claim 1 , wherein the local agent authenticates the distributed set of API-authorization policies in order to ensure that the set of policies was not modified after the policy set was received from the entity.
3. The method of claim 1 , wherein receiving the set of policies comprises receiving contextual data needed to evaluate the set of policies.
4. The method of claim 3 , wherein the contextual data is received in a document that is signed by the signature associated with the entity, and the local agent authenticates that the document is signed by the entity in order to ensure that the contextual data was not modified after being received at the server.
5. The method of claim 4 , wherein the document is a structured document.
6. The method of claim 5 , wherein the structured document is a JSON (Javascript Object Notation) document.
7. The method of claim 3 further comprising filtering out the contextual data that is not relevant for the set of policies and distributing, to the host computer, the contextual data that remains after the filtering.
8. The method of claim 7 , wherein the contextual data is received in a document that is signed by the signature associated with the entity, and the contextual data is distributed to the host computer with a signature produced by signing the document along with a signature associated with each filtered out contextual data, wherein the local agent authenticates that the distributed contextual data is from the entity by generating the signature of the distributed contextual data, combining the generated signature with the distributed signature of the filtered out contextual data and comparing to the signature of the document.
9. The method of claim 8 , wherein the signatures comprise hash values that are produced for the document, the distributed contextual data and the filtered out contextual data.
10. A non-transitory machine readable medium storing a server program which when executed by at least one processing unit of a first host computer distributes policies for authorizing Application Programming Interface (API) calls to an application executing on a machine operating on a second host computer, the machine associated with an entity, the program comprising sets of instructions for:
receiving, from the entity, a set of one or more API-authorizing policies signed with a signature associated with the entity;
storing the signed set of API-authorizing policies;
distributing the signed set of API-authorizing policies to the second host computer for a local agent to enforce on API calls to the application, wherein before using the API-authorizing policies, the local agent authenticates that the set of API-authorizing policies was signed by the entity.
11. The non-transitory machine readable medium of claim 10 , wherein the local agent authenticates the distributed set of API-authorization policies in order to ensure that the set of policies was not modified after the policy set was received from the entity.
12. The non-transitory machine readable medium of claim 10 , wherein the set of instructions for receiving the set of policies comprises a set of instructions for receiving contextual data needed to evaluate the set of policies.
13. The non-transitory machine readable medium of claim 12 , wherein the contextual data is received in a document that is signed by the signature associated with the entity, and the local agent authenticates that the document is signed by the entity in order to ensure that the contextual data was not modified after being received at the server.
14. The non-transitory machine readable medium of claim 13 , wherein the document is a structured document.
15. The non-transitory machine readable medium of claim 14 , wherein the structured document is a JSON (Javascript Object Notation) document.
16. The non-transitory machine readable medium of claim 12 , the program further comprising sets of instructions for filtering out the contextual data that is not relevant for the set of policies, and distributing, to the second host computer, the contextual data that remains after the filtering.
17. The non-transitory machine readable medium of claim 16 , wherein the contextual data is received in a document that is signed by the signature associated with the entity, and the contextual data is distributed to the second host computer with a signature produced by signing the document along with a signature associated with each filtered out contextual data, wherein the local agent authenticates that the distributed contextual data is from the entity by generating the signature of the distributed contextual data, combining the generated signature with the distributed signature of the filtered out contextual data and comparing to the signature of the document.
18. The non-transitory machine readable medium of claim 17 , wherein the signatures comprise hash values that are produced for the document, the distributed contextual data and the filtered out contextual data.