Skip to main content

Proxy Mode Deployment

In Proxy Mode, the Corsha Gatekeeper operates at layer 7 to provide authentication and identity management for API traffic. The Gatekeeper supports two operational modes: Authenticator-based MFA and Adaptive IAM.

Technical Artifact Names

The Gatekeeper's Helm chart is named corsha/proxy and the Docker image is corsha-docker.jfrog.io/proxy for backward compatibility. All references to "proxy" in commands and configuration refer to the Corsha Gatekeeper.

Operational Modes​

Authenticator-Based MFA​

In this mode, Corsha Authenticators deployed with API clients generate dynamic, one-time MFA credentials continuously without manual intervention. Authenticators run alongside your application and inject credentials at the protocol level. The Gatekeeper validates these credentials before forwarding traffic to protected services.

See Corsha Authenticator for detailed information on how Authenticators work, beat generation, credential injection, and deployment methods.

Use case: Adding MFA protection to APIs without modifying client applications.

Adaptive IAM​

In this mode, the Corsha Gatekeeper identifies and authenticates traffic based on existing credentials already present in API requests with no Authenticators required.

Supported credential types:

  • JWT Bearer Tokens: Validates and extracts identity from JSON Web Tokens in the Authorization header
  • Basic Authentication: Identifies machines based on username/password credentials in the Authorization header
  • Custom Headers: Extracts identity from application-specific credential headers
  • API Keys: Recognizes and validates API keys embedded in requests

How it works:

  1. Credential Extraction: The Corsha Gatekeeper inspects incoming requests for known credential patterns
  2. Identity Mapping: Credentials are mapped to machine identities in the Corsha mIDP
  3. Access Control: The Corsha Gatekeeper enforces policies based on the identified machine's group membership and attributes
  4. Request Forwarding: Authenticated requests are forwarded to protected services

Use case: Gaining visibility and control over existing API traffic without deploying Authenticators or modifying credentials.

Performance Characteristics​

  • Latency Impact: Milliseconds (connection handling and credential validation)
  • Protocol Support: HTTP/HTTPS, TCP, OPC UA TCP, Modbus TCP
  • Integration: Standalone or embedded in API gateways

Protocol Support​

Authenticator-Based MFA Mode​

The Corsha Gatekeeper supports multiple protocols for MFA credential injection and validation:

  • HTTP/HTTPS: RESTful APIs and web services
  • TCP: Generic TCP-based protocols
  • OPC UA TCP: Industrial automation communications
  • Modbus TCP: SCADA and industrial control systems

Protocol-specific implementation guides are available in the Protocol Support section of the documentation.

Adaptive IAM Mode​

Adaptive IAM mode primarily supports HTTP/HTTPS protocols, identifying and authenticating machines based on existing credentials embedded in API requests.

When to Use Proxy Mode​

Authenticator-Based MFA Mode​

  • HTTP/HTTPS APIs: Adding MFA protection to RESTful APIs and web services
  • Industrial TCP Protocols: Adding authentication to OPC UA TCP and Modbus TCP communications
  • Continuous Authentication: Implementing dynamic credential validation for any API traffic
  • MFA Without Client Changes: Protecting APIs that lack native authentication without modifying client applications

Adaptive IAM Mode​

  • Existing HTTP/HTTPS Credentials: Enforcing policies on APIs already using JWT tokens, basic auth, or API keys
  • API Traffic Visibility: Gaining insight into existing API traffic patterns without deploying Authenticators
  • API Gateway Integration: Adding identity-based policies to Kong, F5, or other API gateways
  • Identity Mapping: Leveraging existing authentication mechanisms for machine identity and access control

Deployment Options​

Proxy mode Gatekeepers can be deployed in Kubernetes environments using Helm charts or as standalone Docker containers. Choose the deployment method that best fits your infrastructure.

Next Steps​