1. Authorising MuleSoft APIs using AWS Cognito Client Credentials and Mule JWT Validation Policy. 2. MuleSoft AnyPoint Platform Identity Management using AWS Cognito Authorisation code. 3. MuleSoft as OAuth provider. 4. Dedicated Load Balancer v/s Shared Load Balancer. Dedicated Load Balancer Mapping Rules.

1. AWS Cognito and Mule JWT
Validation Policy

2. All contents © MuleSoft Inc.
What is AWS Cognito?
2
Amazon Cognito is a simple user identity and data synchronization service that helps you securely
manage and synchronize app data for your users across their mobile devices. You can create unique
identities for your users through a number of public login providers (Amazon, Facebook, and Google)
and also support unauthenticated guests. You can save app data locally on users’ devices allowing your
applications to work even when the devices are offline. With Amazon Cognito, you can save any kind of
data in AWS Cloud, such as app preferences or game state, without writing any backend code or
managing any infrastructure. This means you can focus on creating great app experiences instead of
having to worry about building and managing a backend solution to handle identity management,
network state, storage, and sync.
Amazon Cognito User Pools is a standards-based Identity Provider and supports identity and access
management standards, such as OAuth 2.0, SAML 2.0, and OpenID Connect.
In addition to using the Amazon Cognito-specific user APIs to authenticate users, Amazon Cognito user
pools also support the OAuth 2.0 authorization framework for authenticating users.

3. All contents © MuleSoft Inc.
AWS Cognito Uses
3

4. All contents © MuleSoft Inc.
Integrating AWS Cognito Authorization Code With MuleSoft
API Manager
4
Authorization Code Grant
The authorization code grant is the preferred method for authorizing end users. Instead of directly
providing user pool tokens to an end-user upon authentication, an authorization code is provided. This
code is then sent to a custom application that can exchange it for the desired tokens. Because the
tokens are never exposed directly to an end-user, they are less likely to become compromised.

5. All contents © MuleSoft Inc.
Integrating AWS Cognito Authorization Code With MuleSoft
API Manager
5

6. All contents © MuleSoft Inc.
Integrating AWS Cognito Client Credentials With MuleSoft
API Manager
6
Client Credentials Grant
The client credentials grant is much more straightforward. While the previous grants are intended to
obtain tokens for end users, the client credentials grant is typically intended to provide credentials to an
application in order to authorize machine-to-machine requests. Note that, to use the client credentials
grant, the corresponding user pool app client must have an associated app client secret.

7. All contents © MuleSoft Inc.
Integrating AWS Cognito Client Credentials With MuleSoft
API Manager
7

8. All contents © MuleSoft Inc.
JWT Validation Token
8
JSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between
the two parties. The claims in a JWT are encoded as a JSON object that is used as the payload of a JSON
Web Signature (JWS) structure or as the plaintext of a JSON Web Encryption (JWE) structure, enabling the
claims to be digitally signed or integrity protected with a Message Authentication Code(MAC) and/or
encrypted.
● JWTs are stateless, making tokens easier to manage.
● JWTs can be used to transfer claims securely between parties.
● JWTs are scalable.
○ The payload of a token can be expanded to increase new claims easily.
● JWTs are decoupled in nature allowing authentication to happen on a different server.
● The tokens are compact. JSON format makes the token less verbose than XML. The smaller size
allows easier transmission over HTTP.
● JWTs are JSON-based and can be easily parsed by multiple receiving systems, especially mobiles.
This enables an industry-wide adoption.

9. All contents © MuleSoft Inc.
JWT Validation Token
9

10. All contents © MuleSoft Inc.
JWT Validation Token
10

11. All contents © MuleSoft Inc.
JWT Validation Token
11

12. All contents © MuleSoft Inc.
JWT Token Algorithm
12
● Symmetric algorithms – HMAC using SHA-256, SHA-384, and SHA-512.
● Asymmetric algorithms – RSA using SHA-256, SHA-384, and SHA-512.
● None – no signature validation.

13. Live Demonstration - AWS
Cognito & Mule JWT
Validation Policy

14. MuleSoft As OAuth Provider

15. All contents © MuleSoft Inc.
MuleSoft as OAuth Provider
15
The OAuth2 Provider module allows a Mule runtime engine (Mule) app to be configured as an
Authentication Manager in an OAuth2 dance. With this role, the application will be able to authenticate
previously registered clients, grant tokens, validate tokens, or register and delete clients, all during the
execution of a flow.
MuleSoft supports various third party OAuth 2.0 providers as listed below
● Okta
● OpenID Connect
● Open AM
● PingFederate
MuleSoft can be also used as an OAuth provider for securing the applications.

16. All contents © MuleSoft Inc.
MuleSoft as OAuth Provider
16

17. All contents © MuleSoft Inc.
MuleSoft as OAuth Provider
17

18. Live Demonstration -
MuleSoft As OAuth Provider

19. MuleSoft Dedicated Load
Balancer and Mapping Rules

20. All contents © MuleSoft Inc.
MuleSoft Dedicated Load Balancer
20
The OAuth2 Provider module allows a Mule runtime engine (Mule) app to be configured as an
Authentication Manager in an OAuth2 dance. With this role, the application will be able to authenticate
previously registered clients, grant tokens, validate tokens, or register and delete clients, all during the
execution of a flow.
MuleSoft supports various third party OAuth 2.0 providers as listed below
● Okta
● OpenID Connect
● Open AM
● PingFederate
MuleSoft can be also used as an OAuth provider for securing the applications.

21. All contents © MuleSoft Inc.
MuleSoft Dedicated Load Balancer
21
Mapping rules are used on dedicated load balancers to translate input URI to call applications deployed
on CloudHub. A pattern is a string that defines a template for matching an input text. Whatever value is
placed within curly brackets ({ }) is treated as a variable. Variable names can contain only lowercase
letters (a-z) and no other characters, including slashes.
Let's consider that we have 2 DNS (i.e. api-dev.example.com and api-test.example.com) setup on a
dedicated load balancer.
api-dev.example.com is for the Dev environment whereas api-test.example.com is for the Test
environment.

22. All contents © MuleSoft Inc.
MuleSoft Dedicated Load Balancer - Use Case 1
22
Use Case 1
We are receiving requests on the DLB https://api-dev.example.com/ecommerce/v1.0/invoice and
need to redirect them to http://org-ecommerce-api.cloudhub.io/v1.0/invoice (the CloudHub
application name will be org-ecommerce-api)
We can use this mapping rule to achieve this.
This above rule will be applied when requests come on DLB and route to the CloudHub application in
the VPC.

23. All contents © MuleSoft Inc.
MuleSoft Dedicated Load Balancer - Use Case 1
23
https://api-dev.example.com/ecommerce/v1.0/invoice ==> http://org-ecommerce-
api.cloudhub.io/v1.0/invoice

24. All contents © MuleSoft Inc.
MuleSoft Dedicated Load Balancer - Use Case 1
24
But here we have some problems that on our DLB, we have set up 2 DNSs, one for Dev and another for
Test. Now, how will the DLB know this is a request that needs to route to either the Dev or Test
application because the same rule will be applied for both?
To avoid this, we will be using a subdomain in the next use case.

25. All contents © MuleSoft Inc.
MuleSoft Dedicated Load Balancer - Use Case 2
25
In this case, we will be using a subdomain for routing the request to the correct environment from DLB.
Our application name format must be org-app-subdomain (e.g. org-ecommerce-api-dev for dev
environment and org-ecommerce-api-test for test environment) when deploying to CloudHub workers
in VPC .
So, our mapping rule will look like this.

26. All contents © MuleSoft Inc.
MuleSoft Dedicated Load Balancer - Use Case 2
26
subdomain is variable to map any subdomain.
● https://api-dev.example.com/ecommerce/v1.0/invoice (DLB) ==> http://org-ecommerce-api-dev.cloudhub.io/v1.0/invoice (CloudHub
Dev Environment)
● https://api-test.example.com/ecommerce/v1.0/invoice (DLB) ==> http://org-ecommerce-api-test.cloudhub.io/v1.0/invoice (CloudHub
Test Environment)
subdomain is variable to map any subdomain.
● https://api-dev.example.com/ecommerce/v1.0/invoice (DLB) ==> http://org-ecommerce-
api-dev.cloudhub.io/v1.0/invoice (CloudHub Dev Environment)
● https://api-test.example.com/ecommerce/v1.0/invoice (DLB) ==> http://org-ecommerce-
api-test.cloudhub.io/v1.0/invoice (CloudHub Test Environment)

27. All contents © MuleSoft Inc.
MuleSoft Dedicated Load Balancer - Use Case 2
27
subdomain is variable to map any subdomain.
● https://api-dev.example.com/ecommerce/v1.0/invoice (DLB) ==> http://org-ecommerce-api-dev.cloudhub.io/v1.0/invoice (CloudHub
Dev Environment)
● https://api-test.example.com/ecommerce/v1.0/invoice (DLB) ==> http://org-ecommerce-api-test.cloudhub.io/v1.0/invoice (CloudHub
Test Environment)
subdomain is variable to map any subdomain.
● https://api-dev.example.com/ecommerce/v1.0/invoice (DLB) ==> http://org-ecommerce-
api-dev.cloudhub.io/v1.0/invoice (CloudHub Dev Environment)
● https://api-test.example.com/ecommerce/v1.0/invoice (DLB) ==> http://org-ecommerce-
api-test.cloudhub.io/v1.0/invoice (CloudHub Test Environment)

28. All contents © MuleSoft Inc.
MuleSoft Dedicated Load Balancer - Use Case 2
28

29. All contents © MuleSoft Inc.
MuleSoft Dedicated Load Balancer - Use Case 2
29
In this use case, we solve the issue of routing the request from DLB to the correct environment.
Let's consider another scenario where you want to route the request to CloudHub on the basis of the
application version. We will see this in the next use case.

30. All contents © MuleSoft Inc.
MuleSoft Dedicated Load Balancer - Use Case 3
30
In this case, when we will deploy an application to CloudHub, and it will be in format org-app-subdomain-
version (e.g. org-ecommerce-api-dev-v1-0 for Dev environment and org-ecommerce-api-test-v1-0 for Test
environment).
Whenever we will get request on DLB, then the version in the URL will be v1.0 and v2.0 but when you deploy
application on CloudHub it doesn't allow to use "." in the application name. That is the reason we are using "-
" in the version of the application deploying to CloudHub.
So, our mapping rule will look like this.

31. All contents © MuleSoft Inc.
MuleSoft Dedicated Load Balancer - Use Case 3
31
● https://api-dev.example.com/ecommerce/v1.0/invoice (DLB) ==> http://org-ecommerce-api-dev-
v1-0.cloudhub.io/v1.0/invoice (CloudHub Dev Environment)
● https://api-test.example.com/ecommerce/v1.0/invoice (DLB) ==> http://org-ecommerce-api-test-
v1-0.cloudhub.io/v1.0/invoice (CloudHub Test Environment)

32. All contents © MuleSoft Inc.
MuleSoft Dedicated Load Balancer - Use Case 3
32

33. All contents © MuleSoft Inc.
MuleSoft Dedicated Load Balancer Rule Priority
33
DLB will apply the first matching rule regardless of more exact matching rules available. A rule defined
first, at index 0 has higher priority against other rules defined after it. The higher the index assigned, the
less priority the mapping rule has.

34. All contents © MuleSoft Inc.
References - Articles
34
Implementing Mapping Rules With MuleSoft Dedicated Load Balancer
https://dzone.com/articles/implementing-mapping-rules-with-mulesoft-dedicated
Authorizing the MuleSoft API Using AWS Cognito User Pool and Mule JWT
Validation Policy
https://dzone.com/articles/authorizing-the-mulesoft-api-using-aws-cognito-use
Implementing MuleSoft AnyPoint Platform Identity Management Using
AWS Cognito Authorization Code
https://dzone.com/articles/implementing-mulesoft-anypoint-platform-identity-m

35. All contents © MuleSoft Inc.
References - Articles
35
Implementing MuleSoft as OAuth Provider for securing Mule Application
https://dzone.com/articles/implementing-mulesoft-as-oauth-provider-for-securi

36. All contents © MuleSoft Inc.
References - Videos
36
Implementing MuleSoft as OAuth Provider For Securing the MuleSoft
Application
https://youtu.be/IYKaps1ndxI
Implementing MuleSoft AnyPoint Platform Identity Management Using
AWS Cognito Authorization Code
https://youtu.be/PGkORD1CPh8
Authorizing the MuleSoft API Using AWS Cognito User Pool and Mule JWT
Validation Policy
https://youtu.be/X4KXwzi5yoU