PingIntelligence

MuleSoft sideband integration

This guide describes the deployment of PingIntelligence for APIs in a sideband configuration with MuleSoft API Gateway.

A PingIntelligence policy is installed in the MuleSoft API Gateway and it passes API metadata to PingIntelligence for detailed API activity reporting and attack detection with optional client blocking.

The PingIntelligence policy works with APIs that are configured with basic endpoint and also with APIs that are configured with proxy endpoint. The policy is simpler to deploy when applied to APIs that are configured with the endpoint with proxy option since more API metadata is already accessible by the policy.

Traffic flow for MuleSoft integration without user information

A diagram of the PingIntelligence and MuleSoft integration traffic flow.

The following is the traffic flow through the MuleSoft and PingIntelligence for APIs components:

  1. The client sends an incoming request to MuleSoft.

  2. The PingIntelligence policy running in MuleSoft collects API metadata and token attributes.

  3. MuleSoft makes an API call to send the request information to ASE. ASE checks the request against a registered set of APIs and checks the origin IP, cookie, or OAuth2 token against the AI-generated deny list. If all checks pass, ASE returns a 200-OK response to the MuleSoft. If not, a different response code is sent to MuleSoft. The request information is also logged by ASE and sent to the AI engine for processing.

  4. If MuleSoft receives a 200-OK response from ASE, then it forwards the request to the backend server. Otherwise, the Gateway optionally blocks the client.

  5. The response from the backend server is received by MuleSoft. MuleSoft sends the response received from the backend server to the client.

  6. MuleSoft makes a second API call to pass the response information to ASE, which sends the information to the AI engine for processing. ASE receives the response information and sends a 200-OK to MuleSoft.

  7. MuleSoft sends the response to the client.

Traffic flow for MuleSoft integration with user information

The following is the traffic flow through the MuleSoft and PingIntelligence for APIs components. PingFederate is used as the OAuth server to gather the user information.

A diagram of the PingIntelligence and MuleSoft component traffic flow.

  1. The client requests and receives an access token from PingFederate.

  2. The client sends a request with the access token received from PingFederate.

  3. MuleSoft verifies the authenticity of the access token with PingFederate.

  4. If the token is invalid, MuleSoft returns a 401-unauthorized message to the client.

  5. If the token is valid, the PingIntelligence policy running in MuleSoft collects API metadata and token attributes.

  6. MuleSoft makes an API call to send the request information to ASE. ASE checks the request against a registered set of APIs and checks the origin IP, cookie, or OAuth2 token against the artificial intelligence (AI)-generated deny list. If all checks pass, ASE returns a 200-OK response to the MuleSoft. If not, a different response code is sent to MuleSoft. The request information is also logged by ASE and sent to the AI engine for processing.

  7. If MuleSoft receives a 200-OK response from ASE, then it forwards the request to the backend server. Otherwise, the Gateway optionally blocks the client.

  8. The response from the backend server is received by MuleSoft. MuleSoft sends the response received from the backend server to the client.

  9. MuleSoft makes a second API call to pass the response information to ASE, which sends the information to the AI engine for processing. ASE receives the response information and sends a 200-OK to MuleSoft.

  10. MuleSoft sends the response to the client.