Client Certificate authentication for API calls

[gregorw]

In a previous blog post Divya Mary, details the process of Client Cert authentication for API calls between the Provider and the back-end system

https://blogs.sap.com/2018/01/19/sap-cloud-platform-api-management-client-certificate-authentication...

A question was asked in that post, calling an API Proxy from an external application with client cert authentication.

Is there a blog post detailing this, as I am trying to test using a client cert instead of using OAuth or SAML.

Thank you,

Raj

[gregorw]

Hi Raj,

could you describe for the sake of clarification if your end goal is to authenticate end users with X.509 client certificates or a service user that is calling the API with the certificate? Perhaps a drawing of your intended architecture will help also.

CU
Gregor

[Rutuja]

Were you able to find an answer for this? I have a similar requirement where I want to authenticate the the third party application calling the API proxy using certificate authentication. Do you know what config needs to be done in the BTP?

[Ivan-Mirisola]

Hi Raj,

Have you tried to use Postman to perform such tests. It is an application that you can install on most common OS'es.

It will allow you to control the HTTP method (PUT, POST, GET, etc) with several authentication options. Using the client certificates is very straight forward. All you need to do is add the certificate to Postman for your API end-point and it will be used every time you issue a request.

You could also make a Java application to call the API with client certificate authentication. I find it easier to build it with Spring Boot. Check the Mutual Authentication [session 4] of the this blog

Best regards,
Ivan