Lab 1.4 - Test Course-Grained Access

In this section, you will sample API requests to the new created api.acme.com virtual server to test functionality

Task 1 - Send a valid GET without JWT to retrieve user’s attributes 1

1. From the Jumpbox, open Postman

2. Expand the API Protection Collection
3. Select the request GET-Retrieve User Attributes-No JWT-Fail

4. Click Send

5. You receive a 403 Forbidden response status code since you do not have a valid JWT

Task 2 - Send a valid GET with JWT to retrieve user1’s attributes

1. Select the request GET-Retrieve User Attributes-JWT-Pass

2. Select the Authorization tab

3. Click Get New Access Token

4. Enter User1 for the Token Name and review the Postman Configuration. Nothing else should need to be modified
5. Click Request Token

6. Login using Username: user1, Password: user1

7. Scroll down to the token and click Use Token

8. Notice the Access Token field is now populated

9. Click Send
10. You receive a 200 OK response status code with attributes for user1 in the body of the response

Task 3 - Send a valid GET with JWT to set user1’s employeeNumber

1. Select the request GET-Set User Attributes-JWT-Pass

2. Select the Authorization tab
3. Select the previously created User1 token from the Available Tokens dropdown

4. The Token field is now populated

5. Click Send

Note

If you receive a 403 response status code, repeat steps 10-13 to request a new token. You can change the name of the token request prior to sending by setting the Token Name.

Note

You can delete expired tokens by clicking the Available Tokens dropdown, clicking Manage Tokens, and then clicking the trashcan next to the Token.

6. You receive a 200 OK response status code with a response body that contains user1’s employeeNumber 123456

Task 4 - Send a valid GET with JWT to create a user

1. Select the request GET-Create User-JWT-Pass

2. Select the Authorization tab
3. Select the previously created User1 token from the Available Tokens dropdown

4. Click Send

Note

If you receive a 403 response status code, repeat steps 10-13 to request a new token. You can change the name of the token request prior to sending by setting the Token Name.

Note

You can delete expired tokens by clicking the Available Tokens dropdown, clicking Manage Tokens, and then clicking the trashcan next to the Token.

5. You receive a 200 OK response status code with a response body that contains Bob Smith’s user attributes

Task 4 - Send invalid GET request with JWT to set a nonexistent user’s attributes

1. Select the request GET-Set Invalid Attributes-JWT-Fail

2. Select the Authorization tab
3. Select the previously created User1 token from the Available Tokens dropdown
4. The Token field is now populated
5. Click Send

Note

If you receive a 403 response status code, repeat steps 10-13 to request a new token. You can change the name of the token request prior to sending by setting the Token Name.

Note

you can delete expired tokens by clicking the Available Tokens dropdown, clicking Manage Tokens, and then clicking the trashcan next to the Token.

6. You receive a 400 Bad Request response status code. The request successfully passed through the API Gateway, but the server failed to process the request.

Task 6 - Send a POST request to a valid URI to set User1’s attributes

1. Select the request POST-Set User Attributes-JWT-Fail

2. Select the Authorization tab
3. Select the previously created User1 token from the Available Tokens dropdown
4. The Token field is now populated
5. Click Send
6. You receive a 403 Forbidden response status code. This is expected because the POST Method was not specified in the API Protection Profile for the path /aduser/get

Task 7 - Send a GET request to an invalid URI

1. Select the request GET-Invalid URI-JWT-Fail

2. Select the Authorization tab
3. Select the previously created User1 token from the Available Tokens dropdown
4. The Token field is now populated
5. Click Send
6. You receive a 403 Forbidden response status code. This is expected because the path //hacker//attack was not specified in the API Protection Profile