Skip to main content
Feedback

Design and Implementation

Sequence Diagram

Sequence diagram

Implementation Details

  • If the policy is used as an Authenticator, the Allowlist IP Range and Allowlist IP list are retrieved either from service key or package key EAVs.

  • If the policy is used as a Processor, Allowlist IP Range and Allowlist IP list are retrieved from pre-inputs.

  • The requesting IP and retrieved Allowlist IP List/Range are passed to the IP Allowlist Service to check whether the requesting IP exists in the allowlisted IP list/Range.

  • If the requesting IP exists in the list/range, a request is sent to the backend.

  • If the requesting IP is not authenticated, then a Not Authorized error is sent back to the user client.

When to use Policy as an Authenticator vs. Processor

The Policy can be used as an Authenticator to augment API key with IP Allowlisting. The Policy can also be used as a processor. A natural question comes into mind when to use this Policy as an Authenticator vs Processor. Here are few tips about business cases that might benefit from this Policy.

Use as an Authenticator

  • When you need to bind IP allowlisting policy to a specific Package key or API key.

  • API Management allows you to configure Package key level EAV (Custom Attribute Value) that binds to a particular package key. Refer to Using the Policy as an Authenticator for more information.

Use as a Processor

  • When you need to apply IP allowlisting policy to all traffic that goes through service endpoint. Refer to Using the Policy as a Processor for more information.
On this Page