Forum Sentry Quick Start Guide | 18
V.
Deploying a REST API – Building a REST Policy
A REST policy in Sentry is a set of rules that provide a policy for processing of RESTful Web Service requests
and responses flowing through the system.
Unlike a SOAP API, there is no WSDL to import into Sentry. Building a REST policy in Sentry is very similar to
building an XML, JSON, or HTML policy. The steps are essentially the same for all of them.
The steps below provide an outline for building a Sentry REST Policy. For more information and detailed
instructions please review the
XML
Policies Guide
available through the Help menu in the WebAdmin interface.
1. Creating the REST Policy
1. Under the Gateway >> Content Policies menu, click on REST Policies. Click new to start the wizard
to build the REST policy. Provide a Name, Description (optional), and Label (optional) for the REST
policy, click
Next
.
•
Select or build the Listener policy - The listener policy is the IP and Port that Sentry will
listen on for incoming traffic for this REST policy.
•
The “Use Device IP” option selects the WAN IP address (the device IP / host OS machine IP
address) as the listening IP address.
•
The Virtual Directory Path is the path for this REST policy (for the listener URI, this is
everything after the port number).
•
The remote policy is the actual endpoint for the service. This is where Sentry will send the
processed request - after receiving the incoming request and performing the Access
Control, IDP scan, schema validation, and any task processing defined in Sentry.
•
The “Send to remote server” option should be enabled if you want to use this policy in proxy
mode (send the processed request to a back-end service). Disable this option if you want to
use this policy in service mode (the processed request is sent immediately back to the client
– nothing is sent to a back-end service).
2. After entering the appropriate values, click
Next
to create the REST policy.
2. Reviewing the REST Policy and Building Additional Virtual Directories
1. When the REST Policy has been successfully created, the status, the Virtual URI, and the Physical
URI are listed on the screen. You can add multiple virtual directories to the same REST policy and
many use cases will require this.
For instance, many SSO use cases will have a “service mode” /
login
virtual directory that simply
consumes user credentials then sets a cookie and redirects the client to the
/service_path
virtual
directory - which requires cookie authentication. In this case the
/login
directory never proxies to a
remote server.
When a request comes into Sentry, if it does not match a defined virtual directory it will be rejected
(404 virtual directory not found). Using a root virtual directory (
/
) will catch all traffic.
