API gateway for the public sector, in your own data center
Public institutions connect services for citizens with other institutions, and keep the data in their own data center. G8 runs there in full, with roles mapped to your directory and request records in your own data stores.
What public institutions need from an API gateway
Integrations between institutions grow one at a time, each with its own partner and its own rules.
Integrations with other institutions
Each integration has its own partner, credentials and limits.
With G8Each integration is a Route with its own identity rules and limits.
Data that stays in the data center
Request records and configuration can’t go to a service outside.
With G8Every part of G8, including its console, runs in your infrastructure. Records stay in your own Elasticsearch or OpenSearch.
Staff from the directory
Access has to follow the directory, not a separate list of users.
With G8Map Microsoft Active Directory groups to roles in each Environment.
The areas of G8 a public institution uses
A typical institution uses API Gateway for integrations and request records, and API Security for identity, roles and the audit log.
Identity and limits for each integration
Verify each institution with OpenID Connect, LDAP, SAML or client certificates, and give each integration its own rate limit.
- More than one methodAccept more than one authentication method on the same Route.
Roles mapped to your directory
Map Microsoft Active Directory groups to built-in or custom roles, per Environment. A role granted for Staging gives no access to Production.
- RecordedChanges to users, roles and Environments are saved together with their audit record.
Request records in your own data stores
Traffic Explorer reads request records from your Elasticsearch or OpenSearch, and Analytics reads request counts from your Prometheus. Sensitive fields are masked before a record is stored.
- Kept as long as you decideYou set how long request records are kept.
How a public institution puts G8 to work
A typical setup, drawn to show how the parts fit together. It doesn’t describe a specific customer.
A public institution runs services for citizens and integrations with other institutions, in its own data center.
Each integration is a Route with its own identity rules and limits.
Development, Staging and Production run from one console, installed on OpenShift or virtual machines.
Request records stay in its own Elasticsearch or OpenSearch, with sensitive fields masked.