Set authorization

Set authorization policy applies authentication to outgoing requests. It sets credentials directly or uses credentials from the incoming request.

The policy prepares authorization details for the target endpoint by selecting the authentication scheme and defining the required parameters. It supports Basic Authentication, OAuth2 tokens, NTLM negotiation, JWT forwarding, Kerberos authentication, and anonymous access. Each spec component controls how the policy interprets credentials, manages protocol-specific behavior, and attaches authorization information to the request.

In IBM API Studio, this policy is identified by the kind SetAuthorization.

Example of a SetAuthorization policy:

apiVersion: api.ibm.com/v1
kind: SetAuthorization
metadata:
  name: basic-custom
  namespace: lwgw
spec:
  basic:
    static:
      username: "aaa"
      password: "bbb" #secret
    valueType: "plain"  # plain | jsonata
  message: "request"
---
apiVersion: api.ibm.com/v1
kind: SetAuthorization
metadata:
  name: basic-incoming
  namespace: lwgw
spec:
  basic:
    useIncoming : {}
  message: "request"
---
apiVersion: api.ibm.com/v1
kind: SetAuthorization
metadata:
  name: oauth2-custom
  namespace: lwgw
spec:
  oAuth2:
    token : "atfqI-QW3HXqF1hkot1e6hJDIj4qHnwTEUXiGJFf09k.SRHhlx6wlDz5GZncAr99HfM7FUbDQlUg73MapL0TJ2I"
  message: "request"
---
apiVersion: api.ibm.com/v1
kind: SetAuthorization
metadata:
  name: oauth2-incoming
  namespace: lwgw
spec:
  oAuth2:
    useIncoming: {}
  message: "request"
---
apiVersion: api.ibm.com/v1
kind: SetAuthorization
metadata:
  name: ntlm-incoming
  namespace: ntlm
  version: 1.0
spec:
  ntlm:
    useIncoming: {}
  message: "request"
---
apiVersion: api.ibm.com/v1
kind: SetAuthorization
metadata:
  name: ntlm-transparent
  namespace: ntlm
  version: 1.0
spec:
  ntlm:
    transparent: {}
  message: "request"
---
apiVersion: api.ibm.com/v1
kind: SetAuthorization
metadata:
  name: ntlm-transparent
  namespace: ntlm
  version: 1.0
spec:
  ntlm:
    static:
      username: ''
      password: ''
  message: "request"
---
apiVersion: api.ibm.com/v1
kind: SetAuthorization
metadata:
  name: jwt-incoming
  namespace: ntlm
  version: 1.0
spec:
  jwt:
    useIncoming: {}
  message: "request"
---
apiVersion: api.ibm.com/v1
kind: SetAuthorization
metadata:
  name: kerberos-2
  namespace: kerberos
  version: 1.0
spec:
  kerberos:
    useIncoming: {}
  message: "request"
---
apiVersion: api.ibm.com/v1
kind: SetAuthorization
metadata:
  name: kerberos-3
  namespace: kerberos
  version: 1.0
spec:
  kerberos:
    delegateIncomingCredentials:
      clientPassword: ''
      clientPrincipal: ''
      servicePrincipal: ''
      servicePrincipalNameform: 'Username' # Username|Hostbased
  message: "request"
---
apiVersion: api.ibm.com/v1
kind: SetAuthorization
metadata:
  name: kerberos-4
  namespace: kerberos
  version: 1.0
spec:
  kerberos:
    incomingHTTPBasicAuthCred:
      servicePrincipal: ''
      servicePrincipalNameform: 'Username' # Username|Hostbased
  message: "request"
---
apiVersion: api.ibm.com/v1
kind: SetAuthorization
metadata:
  name: kerberos-5
  namespace: kerberos
  version: 1.0
spec:
  kerberos:
    useCustomCredentials:
      clientPassword: ''
      clientPrincipal: ''
      servicePrincipal: ''
      servicePrincipalNameform: 'Username' # Username|Hostbased
  message: "request"
---
apiVersion: api.ibm.com/v1
kind: SetAuthorization
metadata:
  name: anonymous
  namespace: kerberos
  version: 1.0
spec:
  anonymous: {}
---

To use the Set authorization policy, you can specify the following configurations: