Guide 5. Configure resource server

As a data service provider you need to implement an authorisation server and a resource server. This guide explains how you configure a resource server.

The resource server is being used by the Data service provider to communicate with Clients from data service consumers. On the resource server the data services are implemented. The resource server is responsible for Policy Based Access to the data services and the data within these services. The functions and interfaces of the resource server are defined within the Component diagram.

Step 1. Develop a RESTful API

Developing a Resource Server involves creating a backend that protects resources (APIs) and only allows access to clients with valid and authorized tokens. Here's a high-level process:

1. Set Up API Endpoints: Define your protected APIs for your data services, according to the DSGO generic API requirements

2. Validate Access Tokens:

   • Use JWT validation for tokens with embedded claims (validate signature and claims like aud, exp, etc.).

   • Use token introspection for opaque tokens by calling the Authorization Server's introspection endpoint.

3. Implement Access Control:

   • Check scopes or roles from the token to enforce permissions.

   • Apply middleware, filters, or decorators to secure endpoints.

4. Use Secure Protocols: Always use HTTPS to protect data in transit.

5. Test with Tokens: Test your Resource Server by generating tokens using an Authorization Server and calling protected endpoints.

Step 2. Offer the /capabilities endpoint

Every data service producer needs to implement the capabilities endpoint as described in the DSGO rulebook. This endpoint allows for discovery of data services within the DSGO.

Step 3: Deploy TLS layer with QWAC certificate

Every server needs to adhere to the TLS requirements and QWAC certificate requirements of the DSGO. More information can be found in the DSGO rulebook.

---

Further reading

Source	Description	Author	Language
generic requirements	DSGO generic API requirements	digiGO	English
/capabilities	DSGO specification of the /capabilities endpoint.	digiGO	English
iSHARE /service	iSHARE specification of a generic /service endpoint.	iSHARE	English
iSHARE Code snippets	Github repository with code snippets for implementing iSHARE functionality.	iSHARE	English
iSHARE Postman collections	A set of Postman collections to test your implementation.	iSHARE	English
iSHARE Service Provider	Reference implementation of a data service producer.	iSHARE	English
iSHARE token validation	PDF document specifying a decision tree for validation a token request.	iSHARE	English