Proxy-based identity and access management for web applications
Techniques described herein are directed to proxies configured to handle identity and access management for a web application. For instance, a second proxy receives requests to the application from a browser. The second proxy redirects the browser to an identity endpoint, which prompts the user to enter authentication credentials for the application. Upon successful authentication, the endpoint provides an access token for accessing web APIs to the second proxy. The second proxy provides the token to a first proxy, which stores the token. The first proxy receives anonymous API calls from the web application to the web APIs. When receiving an anonymous API call, the first proxy obtains the token and inserts it into an outgoing request to the API. Responsive to the API returning a message indicating that the token is invalid, the first proxy communicates with the second proxy to obtain a new token from the endpoint.
1. A system, comprising:
a processor circuit;
a memory that stores program code executable by the processor circuit, the program code comprising:
a first network proxy communicatively coupled with a web application and an application programming interface (API), wherein the first network proxy:
receives, from a second network proxy, a first access token associated with a user of the web application, the second network proxy communicatively coupled with a browser application utilized by the user, the web application, and the first network proxy;
stores the first access token in a data structure that maps the first access token to the associated user;
receives an anonymous API call from the web application;
obtains the first access token;
generates a first request for data based on the anonymous API call, the first request including the first access token; and
sends the first request to the API.
2. The system of claim 1 , wherein the first network proxy further:
receives, from the API, a claims challenge response indicating that the first access token is invalid;
obtains a second access token associated with the user;
generates a second request for the data based on the anonymous API call, the second request including the second access token; and
sends the second request to the API.
3. The system of claim 2 , wherein the claims challenge response comprises a uniform resource identifier of an identity endpoint, and wherein the first network proxy further:
sends, to the second network proxy, a claims request comprising the uniform resource identifier, the claims request being configured to cause the second network proxy to redirect the browser application to the identity endpoint; and
receives, from the second network proxy, a response that comprises the second access token, the second access token indicative of authentication of the user.
4. The system of claim 2 , wherein the first network proxy further:
determines that a refresh token associated with the first access token is valid;
sends a third request to an identity endpoint, the third request comprising the refresh token; and
receives, from the identity endpoint, a response that comprises the second access token.
5. The system of claim 1 , wherein the first network proxy further:
retrieves the first access token from the data structure based on an identifier of the user; and
stores the first access token into the header of the first request.
6. The system of claim 1 , wherein the first network proxy further:
receives, from the API, a response indicating that the web application does not have permission to access the data;
obtains a second access token associated with the user that authorizes the web application to access the data;
generates a second request for the data based on the anonymous API call, the second request including the second access token; and
sends the second request to the API.
7. The system of claim 6 , wherein the first network proxy further:
sends, to the second network proxy, a third request that specifies a permission for which consent from the user is required, the third request being configured to cause the second network proxy to redirect the browser application to an identity endpoint; and
receives, from the second network proxy, a response that comprises a second access token, the second access token indicative of authorization of the web application to access the data.
8. A method performed by a first network proxy communicatively coupled with a web application and an application programming interface (API), comprising:
receiving, from a second network proxy, a first access token associated with a user of the web application, the second network proxy communicatively coupled with a browser application utilized by the user, the web application, and the first network proxy;
storing the first access token in a data structure that maps the first access token to the associated user;
receiving an anonymous API call from the web application;
obtaining the first access token;
generating a first request for data based on the anonymous API call, the first request including the first access token; and
sending the first request to the API.
9. The method of claim 8 , further comprising:
receiving, from the API, a claims challenge response indicating that the first access token is invalid;
obtaining a second access token associated with the user;
generating a second request for the data based on the anonymous API call, the second request including the second access token; and
sending the second request to the API.
10. The method of claim 9 , wherein the claims challenge response comprises a uniform resource identifier of an identity endpoint, and wherein said obtaining the second access token comprises:
sending, to the second network proxy, a claims request comprising the uniform resource identifier, the claims request being configured to cause the second network proxy to redirect the browser application to the identity endpoint; and
receiving, from the second network proxy, a response that comprises the second access token, the second access token indicative of authentication of the user.
11. The method of claim 9 , wherein said obtaining comprises:
determining that a refresh token associated with the first access token is valid;
in response to said determining, sending a third request to an identity endpoint, the third request comprising the refresh token; and
receiving, from the identity endpoint, a response that comprises the second access token.
12. The method of claim 8 , wherein:
said obtaining comprises retrieving the first access token from the data structure based on an identifier of the user; and
said generating comprises storing the first access token into the header of the first request.
13. The method of claim 8 , further comprising:
storing the first access token in a digital envelope signed by a secure environment associated with the first network proxy and the web application, wherein the request includes the signed envelope.
14. The method of claim 13 , wherein the first network proxy and the web application execute on a computing device, and wherein the first access token is bound to the computing device.
15. The method of claim 8 , further comprising:
receiving, from the API, a response indicating that the web application does not have permission to access the data;
obtaining a second access token associated with the user that authorizes the web application to access the data;
generating a second request for the data based on the anonymous API call, the second request including the second access token; and
sending the second request to the API.
16. The method of claim 15 , wherein said obtaining comprises:
sending, to the second network proxy, a third request that specifies a permission for which consent from the user is required, the third request being configured to cause the second network proxy to redirect the browser application to an identity endpoint; and
receiving, from the second network proxy, a response that comprises a second access token, the second access token indicative of authorization of the web application to access the data.
17. A computer-readable storage medium having program instructions recorded thereon that, when executed by a processor of a computing device, perform a method implemented by a first network proxy communicatively coupled with a web application and an application programming interface (API), the method comprising:
receiving, from a second network proxy, a first access token associated with a user of the web application, the second network proxy communicatively coupled with a browser application utilized by the user, the web application, and the first network proxy;
storing the first access token in a data structure that maps the first access token to the associated user;
receiving an anonymous API call from the web application;
obtaining the first access token;
generating a first request for data based on the anonymous API call, the first request including the first access token; and
sending the first request to the API.
18. The computer-readable storage medium of claim 17 , the method further comprising:
receiving, from the API, a claims challenge response indicating that the first access token is invalid;
obtaining a second access token associated with the user;
generating a second request for the data based on the anonymous API call, the second request including the second access token; and
sending the second request to the API.
19. The computer-readable storage medium of claim 17 , wherein the claims challenge response comprises a uniform resource identifier of an identity endpoint, and wherein said obtaining the second access token comprises:
sending, to the second network proxy, a claims request that comprises the uniform resource identifier, the claims request being configured to cause the second network proxy to redirect the browser application to the identity endpoint; and
receiving, from the second network proxy, a response that comprises the second access token, the second access token indicative of authentication of the user.
20. The computer-readable storage medium of claim 17 , wherein said obtaining comprises:
determining that a refresh token associated with the first access token is valid;
in response to said determining, sending a third request to an identity endpoint configured to authenticate the user, the third request comprising the refresh token; and
receiving, from the identity endpoint, a response that comprises the second access token.