Custom spring-based rest API with Apache Knox gateway - spring

Question

I'm trying to do a POC in which I need to protect my cluster through Apache Knox, and my home-grown rest API will sit behind the Knox. How should user authentication work with Knox Ranger, and how will I protect my data access?

Answer 1

Let's start with the service.xml file. It should probably look like the much simpler version below. You would only need the more complex forms if you need to apply specific rules to specific parts of requests or responses. Note that ideally only one route would be required but the ** in Knox means one or more path levels (not zero or more). So without the first route Knox wouldn't send requests to the root /Test_Web_App path to the service.
<service role="TEST_WEB_APP" name="Test_Web_App" version="0.0.1">
<routes>
<route path="/Test_Web_App/?**">
<route path="/Test_Web_App/**?**">
</routes>
</service>
If you wanted to be very specific about it this would be the equivalent. Here the <rewrite apply=""> identifies a specific named rule in rewrite.xml and <rewrite to=""> identifies what part of the request and or response the rule should be applied to.
<service role="TEST_WEB_APP" name="Test_Web_App" version="0.0.1">
<routes>
<route path="/Test_Web_App/?**">
<rewrite apply="TEST_WEB_APP/Test_Web_App" to="request.url"/>
</route>
<route path="/Test_Web_App/**?**">
<rewrite apply="TEST_WEB_APP/Test_Web_App/query" to="request.url"/>
</route>
</routes>
</service>
Now for the rewrite.xml. Yours was pretty close. All I added was a name (i.e. path) resulting in {path=**} to both the pattern and template of the second rule. In the <rule pattern=""> this is used to give a name to the values that are extracted from the matched pattern. In <rewrite template=""> the name is used to populate part of the URL being created with named values extracted from the matched pattern.
<rules>
<rule dir="IN" name="TEST_WEB_APP/Test_Web_App" pattern="*://*:*/**/Test_Web_App/?{**}">
<rewrite template="{$serviceUrl[TEST_WEB_APP]}/?{**}"/>
</rule>
<rule dir="IN" name="TEST_WEB_APP/Test_Web_App/query" pattern="*://*:*/**/Test_Web_App/{path=**}?{**}">
<rewrite template="{$serviceUrl[TEST_WEB_APP]/{path=**}?{**}"/>
</rule>
</rules>

Answer 2

You will need to provide a service definition for your custom REST API to Apache Knox. This will allow Knox to:
Recognize the URLs of the APIs incoming requests to your spring based service and be able to route requests to it
Know how to rewrite specific content such as URLs or other sensitive content from the responses to redirect the client back through gateway when appropriate.
See: http://knox.apache.org/books/knox-0-7-0/dev-guide.html#Service+Definition+Files within the developers guide for how to provide a service definition.
Once a service definition is in place, you just need to add a <service> element within a Knox topology to indicate where the actual spring based service is running. It would be something like this:
<service>
<role>SERVICE</role>
<url>http://url.to.your.service/v1/...</url>
</service>
This is also described in the same section of the developers guide.
You may also find the users guide helpful for additional examples of service declarations within the topology.
You can look at those examples and compare them to the service definition files for those existing services to see how service roles map. This will help you do the same for your own service.
For authentication details, see http://knox.apache.org/books/knox-0-7-0/user-guide.html#Authentication within the users guide for instructions in setting up LDAP based authentication. There are other authentication and federation provider implementations that may be of interest to you as well. You can find them within the users guide too.
Feel free to engage the dev or user email lists for Apache Knox as well.

Answer 3

These are my 2 xml file please look in to it if i have mad any mistake or what else i need to do
**rewrite.xml
<rule dir="IN" name="TEST_WEB_APP/Test_Web_App" pattern="*://*:*/**/Test_Web_App/?{**}">
<rewrite template="{$serviceUrl[TEST_WEB_APP]}/?{**}"/>
</rule>
<rule dir="IN" name="TEST_WEB_APP/Test_Web_App/query" pattern="*://*:*/**/Test_Web_App/{**}?{**}">
<rewrite template="{$serviceUrl[TEST_WEB_APP]/{**}?{**}"/>
</rule>
</rules>
**service.xml
<service role="TEST_WEB_APP" name="Test_Web_App" version="0.0.1">
<routes>
<route path="/Test_Web_App/**">
<rewrite apply="TEST_WEB_APP/Test_Web_App/**" to="response.body" />
</route>
<route path="/Test_Web_App/**?**">
<rewrite apply="TEST_WEB_APP/Test_Web_App/**?**" to="response.body"/>
</routes>
</service>