a.
b.
OpenID Connect
The client uses userLoginName/password to call an authorization API to
obtain authorization Token.
OpenID Connect & AlibabaCloudAPP
The client uses your Appkey siuser name/password to call an
authorization API to obtain authorization Token.
After receiving the request, the API gateway authenticates your Appkey first(Be
effect on OpenID Connect & AlibabaCloudAPP, and OpenID Connect not). If the
authentication succeeds, the API gateway calls the account system of the backend
service to authenticate your user name/password.
After the authentication by the backend service succeeds, you can use the
returned Token to call a service API.
The client calls a service API
The client uses the Token obtained by the authorization API and the signed
Appkey to call the service API.
The API gateway authenticates and resolves the Token and sends the user
information contained in the Token to the backend.
During this phase, the API provider must follow these steps in advance:
Opens the account system, allows the API gateway to authenticate the
user name/password in the request, and issues the Token based on the
gateway-provided encryption mode. For more information, see How to
implement the AS module as follows.
Defines the API in the API gateway. For more information, see
Configure an API in the API gateway as follows.
NOTE: The user name/password is extremely sensitive information,
which is risky when being transmitted in plaintext. We recommend that
you encrypt the user name/password and use the HTTPS protocol for
transmission.
Solution
The solution includes two important parts:
API Gateway
User Guide for Providers
15
