Processing API calls by authenticating and authorizing API calls
Some embodiments of the invention provide a system for defining, distributing and enforcing policies for authorizing API (Application Programming Interface) calls to applications executing on one or more sets of associated machines (e.g., virtual machines, containers, computers, etc.) in one or more datacenters. This system has a set of one or more servers that acts as a logically centralized resource for defining and storing policies and parameters for evaluating these policies. The server set in some embodiments also enforces these API-authorizing policies. Conjunctively, or alternatively, the server set in some embodiments distributes the defined policies and parameters to policy-enforcing local agents that execute near the applications that process the API calls. From an associated application, a local agent receives API-authorization requests to determine whether API calls received by the application are authorized. In response to such a request, the local agent uses one or more parameters associated with the API call to identify a policy stored in its local policy storage to evaluate whether the API call should be authorized. To evaluate this policy, the agent might also retrieve one or more parameters from the local policy storage.
1. A method for authorizing API (Application Programming Interface) calls to an application executing on a machine that is one of a plurality of machines operating on a host computer, the method comprising:
on the machine, of the plurality of machines that execute on the host computer, on which the application executes:
receiving an API call to the application executing on the machine;
using a first agent to perform an authentication operation to evaluate a set of credentials associated with the API call to determine whether the API call is from an entity that is allowed to make such an API call to the application;
when the set of credentials is authenticated to determine that the entity is allowed to make the API call to the application, using a second agent to perform an authorization operation to evaluate a set of API-authorization policies to determine whether the API call should be authorized for processing by the application; and
directing the application to process the API call when the authorization operation determines that the API call should be processed by the application.
2. The method of claim 1 , wherein the first and second agents execute on the host computer.
3. The method of claim 2 , wherein the API call is received by an API handler executing within the application, wherein the API handler uses the first and second agents, also executing within the application, to perform the authentication and authorization operations.
4. The method of claim 1 , wherein the second agent executes on the machine but not within the application while the first agent executes within the application.
5. The method of claim 1 , wherein the first agent executes on the computer while the second agent executes on another computer.
6. The method of claim 1 , wherein when the API call is part of a communication session that was previously authenticated, the method foregoes using the first agent to perform the authentication operation.
7. The method of claim 1 , wherein when the set of credentials is not authenticated, the API call is rejected and the authorization operation is not performed.
8. The method of claim 7 , wherein when the API call is rejected the application sends a rejection to a source of the API call.
9. The method of claim 1 , wherein when the set of credentials is not authenticated, the second agent performs the authorization operation by using the failure to authenticate as a parameter to evaluate the set of API-authorization policies.
10. A non-transitory machine readable medium storing a program for execution by at least one processing unit of a host computer on which a plurality of machines operate, the sets of instructions for authorizing API (Application Programming Interface) calls to an application executing on a machine of the plurality of machines, the program executing on the machine and comprising sets of instructions for:
receiving an API call to the application executing on the machine that is one of the plurality of machines executing on the host computer;
using a first agent to perform an authentication operation to evaluate a set of credentials associated with the API call to determine whether the API call is from an entity that is allowed to make such an API call to the application;
when the set of credentials is authenticated to determine that the entity is allowed to make the API call to the application, using a second agent to perform an authorization operation to evaluate a set of API-authorization policies to determine whether the API call should be authorized for processing by the application; and
directing the application to process the API call when the authorization operation determines that the API call should be processed by the application.
11. The non-transitory machine readable medium of claim 10 , wherein the first and second agents are also executed by the at least one processing unit of the host computer.
12. The non-transitory machine readable medium of claim 11 , wherein the program is an API handler that executes within the application, wherein the API handler uses the first and second agents, also executing within the application, to perform the authentication and authorization operations.
13. The non-transitory machine readable medium of claim 11 , wherein the second agent executes on the machine but not within the application while the first agent executes within the application.
14. The non-transitory machine readable medium of claim 10 , wherein the first agent executes on the computer while the second agent executes on another computer.
15. The non-transitory machine readable medium of claim 10 , wherein the program further comprises a set of instructions for determining that the API call is part of a communication session that was previously authenticated, wherein the program foregoes using the first agent to perform the authentication operation when the API call is part of a communication session that was previously authenticated.
16. The non-transitory machine readable medium of claim 10 , wherein the program further comprises a set of instructions for rejecting the API call when the set of credentials is not authenticated.
17. The non-transitory machine readable medium of claim 16 , wherein the set of instructions for rejecting the API call comprises a set of instructions for sending a rejection to a source of the API call.
18. The non-transitory machine readable medium of claim 10 , wherein the second agent performs the authorization operation by using the failure to authenticate as a parameter to evaluate the set of API-authorization policies when the set of credentials is not authenticated.
19. The method of claim 3 , wherein a plurality of applications execute on the machine, each respective application of the plurality of applications having a respective API handler to receive respective API calls and to use respective authentication and authorization agents executing within the respective application to perform authentication and authorization operations for the respective API calls.
20. The method of claim 19 , wherein the plurality of applications are micro-service applications.