API Gateway:Parameter-based access control plug-in

---
#
# This example assumes the API request path is `/{userId}/...`
# The API uses JWT authentication, and the token contains `userId` and `userType` claims.
# The plug-in validates requests based on the following conditions:
# - If userType is 'admin', all paths are allowed.
# - If userType is 'user', only requests where the path `userId` matches the token's `userId` are allowed.
parameters:
  userId: "Token:userId"
  userType: "Token:userType"
  pathUserId: "path:userId"
#
# The plug-in processes rules sequentially. For each rule, it evaluates the condition.
# If the condition returns `true`, the plug-in executes the `ifTrue` action. If `false`, it executes the `ifFalse` action.
# `ALLOW` immediately grants the request. `DENY` immediately rejects the request and returns an error to the client.
# If neither `ALLOW` nor `DENY` is triggered, the plug-in proceeds to the next rule.
rules:
  - name: admin
    condition: "$userType = 'admin'"
    ifTrue: "ALLOW"
  - name: user
    condition: "$userId = $pathUserId"
    ifFalse: "DENY"
    statusCode: 403
    errorMessage: "Path not match ${userId} vs /${pathUserId}"
    responseHeaders:
      Content-Type: application/xml
    responseBody: 
      <Reason>Path not match ${userId} vs /${pathUserId}</Reason>

3. Plug-in datasets

For a detailed description and configuration instructions, see parameter-based access control plug-in.

3.1. Create a plug-in dataset

Log on to the API Gateway console. In the left navigation pane, choose Manage APIs > Plug-ins. Go to the Plug-in Datasets tab, click Create Dataset, and select PARAMETER_ACCESS as the dataset type.

You can then click a dataset ID to view its data entries. Click Create Data Entry to add a new data entry. The Data Value corresponds to the parameter value used for access control. You can also set an expiration time for each data entry. A data entry becomes invalid after its expiration time.

In the Create Data Entry dialog box, for the Expiration Time, you can select Short-term (select a specific date) or Long-term (no expiration). You can also enter a Description.

3.2. Configure a plug-in dataset

To use a plug-in dataset, add the assertParameterName and assertInDataset fields to a rule in the rules section of your parameter-based access control plug-in configuration.

• assertParameterName: The name of the parameter to validate against the dataset. This parameter must be defined in the parameters section.

• assertInDataset: The ID of the plug-in dataset. The plug-in checks whether the value of the parameter specified by assertParameterName exists in this dataset.

The assertParameterName and assertInDataset fields must be used together. Otherwise, the plug-in creation fails.

These fields are compatible with the condition field. Within each rule, you can configure both the (assertParameterName, assertInDataset) pair and a condition, or just one of them. If both are configured, the plug-in triggers the rule's action if either the dataset check passes or the conditional expression evaluates to true.

---
#
# This example assumes the API request path is `/{userId}/...`
# The API uses JWT authentication, and the token contains `userId` and `userType` claims.
# The plug-in validates requests based on the following conditions:
# - If userType is 'admin', all paths are allowed.
# - If userType is 'user', only requests where the path `userId` matches the token's `userId` are allowed.
parameters:
  userId: "Token:userId"
  userType: "Token:userType"
  pathUserId: "path:userId"
#
# The plug-in processes rules sequentially. For each rule, it evaluates the condition.
# If the condition returns `true`, the plug-in executes the `ifTrue` action. If `false`, it executes the `ifFalse` action.
# `ALLOW` immediately grants the request. `DENY` immediately rejects the request and returns an error to the client.
# If neither `ALLOW` nor `DENY` is triggered, the plug-in proceeds to the next rule.
rules:
  - name: byDataset
    assertParameterName: userId
    assertInDataset: 87b65008e92541938537b1a4a236eda5
    ifTrue: "ALLOW"
  - name: admin
    condition: "$userType = 'admin'"
    ifTrue: "ALLOW"
  - name: user
    condition: "$userId = $pathUserId"
    ifFalse: "DENY"
    statusCode: 403
    errorMessage: "Path not match ${userId} vs /${pathUserId}"
    responseHeaders:
      Content-Type: application/xml
    responseBody: 
      <Reason>Path not match ${userId} vs /${pathUserId}</Reason>