Identify and Access
The policies in this stage provide different ways of identifying and authorizing the application, and provide the required access rights for the application. The policies included in this stage are:
Inbound Authentication - Message
Authorize User
Identify and Authorize Application
The Inbound authentication policies are used to authenticate the application by specifying user-based SPN or host-based SPN for a Kerberos token, using the basic credentials for the HTTP basic authentication or through various token assertions or through the XML security actions.
The Authorize User policy authorizes the application against a list of users and a list of groups registered in API Gateway.
The Identify and Authorize Application policy is used to identify the application, authenticate the request based on policy configured and authorizes it against all applications registered in API Gateway.
Note:
From API Gateway 10.3, the Identification and Authentication policies are merged into one and you would not be able to do identification alone for Basic Authentication. You must provide the right credentials for a successful invoke.