Evaluate XPath Expression

Note: This action does not support JSON-based REST APIs.

If you have an API which includes consumer authentication using XPath, you can use the Evaluate XPath Expression action to extract the custom identification credentials from the request. You can then verify the consumer's identity using this information.

The Evaluate XPath Expression action extracts the custom authentication credentials that is supplied in the request which is represented using an XPath expression. The custom authorization can be in the form of tokens, or a username and password token combination. For example, when you configure this action for an API, the PEP extracts the custom identification from the request using an XPath expression at runtime and searches its list of consumers for the XPath defined in the global or registered consumers list.

Mediator rejects requests that do not include the XPath consumer identification defined in the global or registered consumers list.

If Mediator cannot identify the consumer, Mediator fails the request and generates a Policy Violation event.

Input Parameters

Identify Consumer	(String). The list of consumers against which the XPath expression should be validated for identifying requests from a particular client.
	Value	Description
	Do Not Identify	Mediator forwards the request to the native API, without attempting to verify client's XPath expression in incoming request.
	Global Consumers	(Default). Mediator tries to verify the client's XPath expression against a list of all global consumers available in the Mediator.
	Registered Consumers	Mediator tries to verify the client's XPath expression against the list of consumer applications who are registered as consumers for the specified API.
Namespace	(String). (Optional). The namespace of the XPath expression to be validated.
XPath Expression	(String). An argument to evaluate the XPath expression contained in the request. See the sample below.

Let's take a look at an example. For the following SOAP message:

<?xml version="1.0" encoding="UTF-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Header>
</soap:Header>
<soap:Body>
<catalog xmlns="http://www.store.com">
<name>My Book</name>
<author>ABC</author>
<price>100</price>
</catalog>
</soap:Body>
</soap:Envelope>

The XPath expression is as follows:

/soap:Envelope/soap:Body/catalog/author

To select the element or token without the namespace, use the following:

//*[local-name()='Envelope']/*[local-name()='Body']/*[local-name()='catalog'
]/*[local-name()='author'][1]/text()

The result: SoftwareAG