Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

New IA - Dashboard Configuration #5915

Merged
merged 12 commits into from
Feb 4, 2025
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ aliases:
---

## Dashboard SSO API
The Dashboard exposes a special API to implement custom authentications for the Dashboard and Portal. See the [Dashboard Admin API]({{< ref "tyk-apis/tyk-dashboard-admin-api/sso" >}}) for more details.
The Dashboard exposes a special API to implement custom authentications for the Dashboard and Portal. See the [Dashboard Admin API]({{< ref "api-management/dashboard-configuration#single-sign-on-api-1" >}}) for more details.

You can use the `sso_permission_defaults` dashboard configuration option to configure the permissions of users created via SSO API. See the SSO API docs above.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -127,7 +127,7 @@ TIB ships with a default `profiles.json` file which contains many example config
The key attributes for LDAP profile are:

* `ID`: The ID by which we will activate the profile by calling the appropriate TIB endpoint
* `OrgId`: The organization id which the profile is connected to - make sure this is the correct id for your organization (see the [Dashboard Admin API documentation]({{< ref "dashboard-admin-api/organisations" >}}) for details on how to retrieve this)
* `OrgId`: The organization id which the profile is connected to - make sure this is the correct id for your organization (see the [Dashboard Admin API documentation]({{< ref "api-management/dashboard-configuration#organizations-api" >}}) for details on how to retrieve this)
* `IdentityHandlerConfig.DashboardCredential`: The Dashboard API Access credential which is used as authorization header
* `ProviderConfig.FailureRedirect`: The URL which TIB will redirect to if the authentication fails
* `ProviderConfig.LDAPPort`: The port through which TIB can communicate with your LDAP server
Expand Down
4 changes: 2 additions & 2 deletions tyk-docs/content/advanced-configuration/integrate/sso.md
Original file line number Diff line number Diff line change
Expand Up @@ -122,8 +122,8 @@ Our Tyk Identity Broker (TIB) internally also uses these APIs.

The Dashboard exposes two APIs:

- `/admin/sso` - See [Dashboard Admin API SSO]({{< ref "tyk-apis/tyk-dashboard-admin-api/sso" >}}) for more details.
- `/api/sso` - See [Dashboard API SSO]({{< ref "tyk-apis/tyk-dashboard-api/sso" >}}) for more details.
- `/admin/sso` - See [Dashboard Admin API SSO]({{< ref "api-management/dashboard-configuration#single-sign-on-api-1" >}}) for more details.
- `/api/sso` - See [Dashboard API SSO]({{< ref "api-management/dashboard-configuration#single-sign-on-api" >}}) for more details.

which allow you to generate a temporary authentication token, valid for 60 seconds. They make same thing you can select one of them and use it.
However, the admin API requires `admin-auth` header which should be same with `admin-secret` parameter in `tyk_analytics.conf`, the regular API requires `authorization` header which should be same with the user authentication token.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -15,4 +15,4 @@ However, it is possible to temporarily allow access to existing keys in a new en

In order to use a legacy key in a new environment, simply extract the key from the old environment using the Tyk REST APIs and then create them in the new environment using the custom key creation API.

To create a key with a custom identifier, ie Token, simply use the [Gateway (OSS)]({{< ref "tyk-gateway-api" >}}) or [Dashboard (Pro)]({{< ref "tyk-apis/tyk-dashboard-api/api-keys#create-a-custom-key" >}}) REST APIs to import a custom key.
To create a key with a custom identifier, ie Token, simply use the [Gateway (OSS)]({{< ref "tyk-gateway-api" >}}) or [Dashboard (Pro)]({{< ref "api-management/dashboard-configuration#create-a-custom-key" >}}) REST APIs to import a custom key.
Original file line number Diff line number Diff line change
Expand Up @@ -80,7 +80,7 @@ When working with Tyk OAS APIs, the request validation covers both headers and b

### Track Endpoint

If you do not want to include all endpoints in your [Activity by Endpoint]({{< ref "product-stack/tyk-dashboard/advanced-configurations/analytics/activity-by-endpoint" >}}) statistics in Tyk Dashboard, you can enable this middleware for the endpoints to be included.
If you do not want to include all endpoints in your [Activity by Endpoint]({{< ref "api-management/dashboard-configuration#activity-by-endpoint" >}}) statistics in Tyk Dashboard, you can enable this middleware for the endpoints to be included.

### URL Rewrite

Expand Down

This file was deleted.

6 changes: 3 additions & 3 deletions tyk-docs/content/api-management/automations/operator.md
Original file line number Diff line number Diff line change
Expand Up @@ -191,7 +191,7 @@ These would be the default credentials Tyk Operator uses to connect to Tyk.

### Multi-tenancy in Tyk

Tyk Dashboard is multi-tenant capable, which means you can use a single Tyk Dashboard instance to host separate [organizations]({{< ref "basic-config-and-security/security/dashboard/organisations">}}) for each team or department. Each organization is a completely isolated unit with its own:
Tyk Dashboard is multi-tenant capable, which means you can use a single Tyk Dashboard instance to host separate [organizations]({{< ref "api-management/dashboard-configuration#organizations">}}) for each team or department. Each organization is a completely isolated unit with its own:

- API Definitions
- API Keys
Expand Down Expand Up @@ -3649,7 +3649,7 @@ In this example, the API with ID `12345` will be updated according to the provid


### API Categories
[API categories]({{< ref "product-stack/tyk-dashboard/advanced-configurations/api-categories">}}) are configured differently for Tyk OAS APIs and Tyk Classic APIs. Please see below for examples.
[API categories]({{< ref "api-management/dashboard-configuration#governance-using-api-categories">}}) are configured differently for Tyk OAS APIs and Tyk Classic APIs. Please see below for examples.

#### Tyk OAS API

Expand Down Expand Up @@ -3680,7 +3680,7 @@ As of Tyk Operator v1.1, API categories is not supported in `TykStreamsApiDefini

#### Tyk Classic API

For a Tyk Classic API, you can specify the category name using the `name` field with a `#` qualifier. This will categorize the API in the Tyk Dashboard. See [How API categories work]({{<ref "product-stack/tyk-dashboard/advanced-configurations/api-categories#tyk-classic-apis">}}) to learn about limitations on API names.
For a Tyk Classic API, you can specify the category name using the `name` field with a `#` qualifier. This will categorize the API in the Tyk Dashboard. See [How API categories work]({{<ref "api-management/dashboard-configuration#tyk-classic-apis">}}) to learn about limitations on API names.

Example

Expand Down
20 changes: 10 additions & 10 deletions tyk-docs/content/api-management/client-authentication.md
Original file line number Diff line number Diff line change
Expand Up @@ -249,10 +249,10 @@ The Tyk Dashboard API contains several endpoints that are provided to manage *cl

| Action | Endpoint | Reference |
| --- | --- | --- |
| Register a new client app | `POST /api/apis/oauth/{{api-id}}` | [link]({{< ref "tyk-apis/tyk-dashboard-api/oauth-key-management#create-a-new-oauth20-client" >}}) |
| Get a list of registered client apps | `GET /api/apis/oauth/{{api-id}}` | [link]({{< ref "tyk-apis/tyk-dashboard-api/oauth-key-management#list-oauth-clients" >}}) |
| Get the details of a client app | `GET /api/apis/oauth/{{api-id}}/{{client_id}}` | [link]({{< ref "tyk-apis/tyk-dashboard-api/oauth-key-management#get-an-oauth20-client" >}}) |
| Delete a client app | `DELETE /api/apis/oauth/{{api-id}}/{{client_id}}` | [link]({{< ref "tyk-apis/tyk-dashboard-api/oauth-key-management#delete-oauth-client" >}}) |
| Register a new client app | `POST /api/apis/oauth/{{api-id}}` | [link]({{< ref "api-management/dashboard-configuration#create-a-new-oauth20-client" >}}) |
| Get a list of registered client apps | `GET /api/apis/oauth/{{api-id}}` | [link]({{< ref "api-management/dashboard-configuration#list-oauth-clients" >}}) |
| Get the details of a client app | `GET /api/apis/oauth/{{api-id}}/{{client_id}}` | [link]({{< ref "api-management/dashboard-configuration#get-an-oauth20-client" >}}) |
| Delete a client app | `DELETE /api/apis/oauth/{{api-id}}/{{client_id}}` | [link]({{< ref "api-management/dashboard-configuration#delete-oauth-client" >}}) |


### Using the Authorization Code Grant
Expand Down Expand Up @@ -281,7 +281,7 @@ When using Tyk as the Authorization Server with the Authorization Code grant, th

Whilst Tyk can provide the *authorization server* functionality, issuing and managing access and authorization tokens, the *identity server* functions (authenticating users (resource owners) and allowing them to authorize client access) must be performed by a separate Identity Provider (IdP).

The identity server will need access to the Tyk Dashboard API to [obtain an Authorization Code]({{< ref "tyk-apis/tyk-dashboard-api/oauth-key-management#oauth20-authorization-code" >}}).
The identity server will need access to the Tyk Dashboard API to [obtain an Authorization Code]({{< ref "api-management/dashboard-configuration#oauth20-authorization-code" >}}).

#### Authorization Request

Expand Down Expand Up @@ -309,7 +309,7 @@ If the *client Id* (`my-client-id`) is valid, the response will be `HTTP 307 Tem

#### Authorization Code Request

The *Identity Server* requests an *Authorization Code* from the *Authentication Server*. Tyk's *authorization code* endpoint is hosted in the [Tyk Dashboard API]({{< ref "tyk-apis/tyk-dashboard-api/oauth-key-management#oauth20-authorization-code" >}}), accessible from `POST /api/apis/{api_id}/authorize-client`. The same `redirect_uri` as provided in the original request must be provided alongside the `client_id` as a security feature to verify the client identity.
The *Identity Server* requests an *Authorization Code* from the *Authentication Server*. Tyk's *authorization code* endpoint is hosted in the [Tyk Dashboard API]({{< ref "api-management/dashboard-configuration#oauth20-authorization-code" >}}), accessible from `POST /api/apis/{api_id}/authorize-client`. The same `redirect_uri` as provided in the original request must be provided alongside the `client_id` as a security feature to verify the client identity.

This endpoint is protected using the Dashboard API secret assigned to the *Identity Server*, which must be provided in the `Authorization` header.

Expand Down Expand Up @@ -677,9 +677,9 @@ OAuth access tokens have built in expiry, but if you need to [revoke](https://to

Using the **Tyk Dashboard API** you can revoke specific tokens (both access and refresh) or all tokens issued for a specific *client app* as follows:

- [retrieve a list of all tokens for a client app]({{< ref "tyk-apis/tyk-dashboard-api/oauth-key-management#retrieve-all-current-tokens-for-specified-oauth20-client" >}})
- [revoke a single token]({{< ref "tyk-apis/tyk-dashboard-api/oauth-key-management#revoke-a-single-oauth-client-token" >}})
- [revoke all tokens for a client app]({{< ref "tyk-apis/tyk-dashboard-api/oauth-key-management#revoke-all-oauth-client-tokens" >}})
- [retrieve a list of all tokens for a client app]({{< ref "api-management/dashboard-configuration#retrieve-all-current-tokens-for-specified-oauth20-client" >}})
- [revoke a single token]({{< ref "api-management/dashboard-configuration#revoke-a-single-oauth-client-token" >}})
- [revoke all tokens for a client app]({{< ref "api-management/dashboard-configuration#revoke-all-oauth-client-tokens" >}})

These endpoints are protected using the Dashboard API secret assigned to the user managing the tokens, which must be provided in the `Authorization` header.

Expand Down Expand Up @@ -1487,7 +1487,7 @@ curl -X POST -H "Authorization: 907aed9f88514f175f1dccf8a921f741"
}' http://{your-tyk-dashboard-host}:{port}/api/apis/keys/basic/testuser2 | python -mjson.tool
```

[See Basic Authentication via the Dashboard API]({{< ref "tyk-apis/tyk-dashboard-api/basic-authentication" >}})
[See Basic Authentication via the Dashboard API]({{< ref "api-management/dashboard-configuration#basic-authentication-api" >}})

{{< note success >}}
**Note**
Expand Down
Loading
Loading