Multiple Gateways to handle production and sandbox requests separately

1
votes

I am to configure the gateway in separate environment(production and Sandbox) and I have a Doubt: https://docs.wso2.com/display/AM200/Maintaining+Separate+Production+and+Sandbox+Gateways#MaintainingSeparateProductionandSandboxGateways-MultipleGatewaystohandleproductionandsandboxrequestsseparately

In the store and publisher configuration I need to configure the <RevokeAPIURL>

In the document https://docs.wso2.com/display/CLUSTER44x/Clustering+API+Manager+2.0.0#ClusteringAPIManager2.0.0-ConfiguringtheAPIPublisher

<RevokeAPIURL>https://<IP of the Gateway>:8243/revoke</RevokeAPIURL>

How I have the Gateway Production and Sandbox separated what address gateway I have in this configuration?

Thanks a lot.

1
apiwso2wso2-am
Thanks a lot for the response. – Alex

1 Answers

0
votes

<RevokeAPIURL> is used by store node to call revoke and token APIs of gateway node, when you (re)generate tokens (by client credential grant type) from store UI.

But in this deployment pattern, there is a kind of limitation that is you have to pick one gateway node and configure that for <RevokeAPIURL> in store node's api-manager.xml.

Fo example, let's say you configured prod-gateway there. So, when you generate keys (either prod or sandbox) from store UI, it will call prod-gateway's revoke and token APIs. Since both gateways are pointing to the same keymanager (or km cluster), token generation should work without a problem.

The only downside is with caching. When you regenerate sandbox keys from store UI, it calls prod-gateway and clears the key cache of that gateway only. Therefore, the sandbox-gateway key cache won't be invalidated. So you will be able to call your sandbox-gateway's APIs with old revoked token for about 15 more minutes until the cache expires.

But, if you don't use Store UI to generate keys (i.e. client credentials grant type), which do not happen in a typical production environment where password grant type is usually used, (and calls gateway's token API for that directly), you won't experience this limitation.