Flex Gateway SLA-based Rate Limiting Incorrectly Throttles OIDC Client Due to Missing Client ID Header

CAUSE

Flex Gateway's SLA-based Rate Limiting policy relies on a specific client identifier header (e.g., `client_id` or `x-agw-client-id`) to determine the appropriate SLA tier. When using OIDC (OpenID Connect) tokens, the client identifier (often `cid` or `client_id`) is typically embedded within the JWT payload of the `Authorization: Bearer <token>` header, not as a separate, direct header. If the Flex Gateway policy cannot find the expected client identifier header, it defaults to a lower-tier or standard rate limit, leading to premature throttling.

SOLUTION

To ensure Flex Gateway correctly applies SLA-based rate limits for OIDC clients, you must extract the client ID from the OIDC token and inject it as a header that the policy can recognize.

1.  **Configure the Flex Gateway SLA Policy:**
    Ensure your SLA-based Rate Limiting policy on Flex Gateway is configured to read the client ID from the appropriate header. For example, if you intend to extract the `client_id` from the OIDC token and pass it as a header named `client_id`, then the policy should be configured to use `client_id` as the identifier.

2.  **Apply a DataWeave Headers Transformation Policy:**
    Add a Headers Transformation policy to your API instance in Anypoint Platform (or directly in your Flex Gateway configuration if managing policies locally). This policy will extract the client ID from the OIDC token and inject it as a new header.

    *   **Policy Configuration:**
        *   Policy Type: Headers Transformation
        *   Target: Request
        *   Header Transformation: DataWeave

    *   **DataWeave Script:**
        Use the following DataWeave script. This script extracts the Bearer token, decodes its payload, and then extracts the `cid` (client ID) claim, adding it as a new `client_id` header.

        ```dw
        %dw 2.0
        output application/java
        import fromBase64 from dw::core::Binaries
        import toString from dw::util::Coercions
        import substringAfter, substringBefore from dw::core::Strings

        // Extract the Bearer token from the Authorization header
        var rawToken = substringAfter(attributes.headers.authorization default "", "Bearer ")

        // Get the payload part of the JWT (second segment)
        var payloadB64 = (rawToken splitBy ".")[1] default ""

        // Decode the base64 payload
        var payloadStr = toString(fromBase64(payloadB64), "UTF-8")

        // Extract the client ID (assuming it's named "cid" in the JWT payload)
        // Adjust "cid" if your OIDC provider uses a different claim name (e.g., "client_id")
        var clientId = substringBefore(substringAfter(payloadStr, "\"cid\":\""), "\"")

        // Add the extracted client ID as a new header named "client_id"
        // Ensure this header name matches what your SLA policy is configured to read.
        ---
        attributes.headers ++ {
            "client_id": clientId
        }
        ```

    *   **Important Notes:**
        *   If your OIDC token uses a different claim name for the client ID (e.g., `client_id` instead of `cid`), adjust the `substringAfter(payloadStr, "\"cid\":\"")` part of the DataWeave script accordingly.
        *   Ensure the header name `client_id` in the output of the DataWeave script matches the header name configured in your Flex Gateway SLA policy.

APPLIES TO

MuleSoft Flex Gateway
SLA-based Rate Limiting Policy
APIs secured with OIDC tokens