Home
MATRIXX Security
Network Security
Network zones are stacked with increasing proximity to the open internet or DMZ. Each zone is traversed by ingress and egress points through an application or server, with appropriate authentication and authorization for connecting system traffic.
RS Gateway Security
RS Gateway uses Spring Security to authenticate clients using login ID and password credentials.
URL Authorization
Out-of-the-box, RS Gateway supports Create, Read, Update, and Delete authentication (CRUD-based authorization) using CRUD-based permissions on the RS Gateway APIs.

Welcome
MATRIXX Release Notes
MATRIXX Architecture
MATRIXX Installation and Upgrade
MATRIXX Configuration
MATRIXX Security
- About MATRIXX Security
- Introduction to MATRIXX Cloud Native Security
  The information in MATRIXX Security is best-practice information and identifies MATRIXX-specific security considerations and implementations. For container-specific and Kubernetes security information, see the third-party documentation.
- Cloud Native Security
  The information here addresses cloud native security and includes recommendations for securing your cloud native implementation.
- Managing Certificates
  MATRIXX uses certificates signed by a trusted certificate authority, or validated by other means, to establish secure communications with another party with the corresponding private key.
- Enabling Transport Layer Security
  Transport Layer Security (TLS) provides secure internet connections by encrypting data sent between a browser, a website, and the website server to ensure that data is transmitted privately.
- Network Security
  Network zones are stacked with increasing proximity to the open internet or DMZ. Each zone is traversed by ingress and egress points through an application or server, with appropriate authentication and authorization for connecting system traffic.
  - MATRIXX Gateway Proxy
    MATRIXX includes Gateway Proxy that acts as a secure entry point for all network traffic that is not the result of subscriber usage. It sits between external applications and the Traffic Routing Agent (TRA).
  - RS Gateway Security
    RS Gateway uses Spring Security to authenticate clients using login ID and password credentials.
    - RS Gateway Basic Authentication
      When RS Gateway is configured not to accept anonymous requests, clients must send a login request with a username and password.
    - OAuth 2.0 Authentication
      RS Gateway can authenticate clients (such as customer relationship management (CRM) software) with single sign-on using OAuth 2.0. The information here describes a generic implementation. For information about OAuth 2.0 and third-party identity and access management applications, see the discussion about OAuth 2.0 identity and access management.
    - URL Authorization
      Out-of-the-box, RS Gateway supports Create, Read, Update, and Delete authentication (CRUD-based authorization) using CRUD-based permissions on the RS Gateway APIs.
      - Enable Authorization of Named Services
        Perform these steps to restrict access to named REST services. Permissions apply to all URLs that implement the named services.
      - Enable URL Authorization for REST Handlers
        Edit the rsgateway_permissions.yaml file to customize access to OpenAPI3, JSON, or named REST services.
    - Add RS Gateway Users
      Unless anonymous access is enabled, all RS Gateway clients must be defined in rsgateway_users.yaml.
    - Configure Token Authentication
      You can configure customer-specific API keys to authenticate third-party applications with RS Gateway.
    - Configure RS Gateway for LDAP Authentication
      This example demonstrates a simple LDAP authentication for RS Gateway.
    - Use Kubernetes Secrets for RS Gateway TLS Certificates
      A TLS certificate can be retrieved from a Kubernetes secret and the certificate is automatically extracted, a keystore is generated, and the contents are added to the /sync/certs directory.
    - RS Gateway application.yaml Properties
      RS Gateway configuration is provided in YAML files.
    - RS Gateway Connection Properties
      You must configure RS Gateway to connect to the Gateway Proxy. Define these properties in a properties file (for example, rsgateway-site.yaml).
    - User Authentication and Password Management
      Use the /service/user service APIs to set, verify, and modify a user password.
  - Business API Gateway Security
    The Business API Gateway is a development framework that includes the Business API SDK, Rest Services Gateway (RS Gateway), Gateway Proxy, and application tier. It allows custom mobile applications, Web clients, and other custom implementations to integrate with MATRIXX.
  - SBA Gateway Security
    SBA Gateway supports TLS Mutual Authentication.
  - TMF Gateway Security
    TMF Gateway supports HTTP authentication through a configurable authorization URL.
  - TRA Security
    This section describes the general security configuration requirements for Traffic Routing Agent (TRA). These security requirements apply when virtual servers are defined and specified as secured.
  - Self-Signed Certificate Detection and Handling
    While self-signed certificates can be used in controlled environments such as internal testing, because they are not verified by a trusted certificate authority (CA) they must not be used in production environments. If the use of a self-signed certificate is intentional, such as for testing purposes, the MDC Gateway and Traffic Routing Agent (TRA) components include ways to override default handling.
  - Network Security Checklist
    The following is a list of best practices for network design and configuration.
- Application Security
  Application security includes configuring web applications and gateways.
- Database Security
  Depending on your MATRIXX environment, you can use multiple external databases.
- OAuth 2.0 Identity and Access Management
  MATRIXX supports third-party identity and access management application integration.
MATRIXX Integration
MATRIXX Diameter Integration
MATRIXX Call Control Framework Integration
MATRIXX TM Forum Integration
MATRIXX 5G Integration
MATRIXX 5G Event Streaming
MATRIXX Event Streaming
MATRIXX Administration
MATRIXX Web App Administration
MATRIXX Monitoring and Logging
MATRIXX Policy
MATRIXX Kafka CDR Consumer
MATRIXX Pricing and Rating
MATRIXX Pay Now
MATRIXX Subscriber Management
MATRIXX Subscriber Management API
MATRIXX Business API SDK
My MATRIXX Help
MATRIXX Backoffice Customer Tool Help
MATRIXX Third-Party Licenses
Glossary

URL Authorization

Out-of-the-box, RS Gateway supports Create, Read, Update, and Delete authentication (CRUD-based authorization) using CRUD-based permissions on the RS Gateway APIs.

For example, to call any of the POST APIs (Create) you must have the permission MTX_ROLE_RSG_CREATE. With this role, you can call any POST API.

URL authorization requires an authenticated identity. The authentication credential determines whether a user is allowed to access restricted resources. RS Gateway attempts to match users to a role based on the credential, and either maps the user to permitted roles or returns a not authorized value that prevents the user from being mapped to any role.

There are two files in which you can set URL permissions and each file sets unique permissions. The rsgateway_extensions.yaml file operates on named REST services, such as device_purchase_offer, and applies to all URLs (XML, JSON, OpenAPI) that implement those named services. For example, the device_purchase_offer service has POST bindings for three URLs. Any roles that you specify must be present to use any of these calls:

/rsgateway/data/v3/device/{oid}/offer
/rsgateway/data/json/device/{oid}/offer
/rsgateway/data/openapi/{oid}/offer

The rsgateway_permissions.yaml file operates on MATRIXX REST handlers, such as the REST handler to get the OpenAPI3 specification and the pricing cache REST services. This permissions file impacts individual URLs, so permissions can be different for OpenAPI3, JSON, or named REST services.

Important: URL authorization defined in rsgateway_permissions.yaml supersedes named service authorization defined in rsgateway_permissions.yaml. For example, it is possible to enable a custom role or existing role to call the subscriber creation services and then specifically disable the JSON-specific version of that call using URL authorization.

Before proceeding, you should decide the scope of the permissions that you want to define.