---
type: "article"
title: "Securing Oracle Integration Cloud APIs with Traefik on OKE"
summary: "Introduction\n\nOrganizations using Oracle Integration Cloud (OIC) often need to expose their integrations to external consumers while maintaining robust security. In this post, we'll explore how to deploy Traefik Hub as an API Gateway on Oracle Kubernetes Engine (OKE) to provide enterprise-grade security for OIC APIs.\n\nThis architecture enables:\n\n * JWT validation for external client authentication via Oracle Identity Domains (IDCS)\n * OAuth2.0 flow for secure backend communication with OIC\n * Pa"
newsletter: "VillaBytes"
newsletter_handle: "villabytes"
newsletter_url: "https://usecommune.com/n/villabytes"
author: "Carlos Villanua Fernandez (@carlosvillanua)"
published: "2026-03-13T12:44:26.000Z"
canonical_url: "https://usecommune.com/n/villabytes/a/securing-oracle-integration-cloud-apis-with-traefik-on-oke"
markdown_url: "https://usecommune.com/n/villabytes/a/securing-oracle-integration-cloud-apis-with-traefik-on-oke.md"
chat_url: "https://usecommune.com/n/villabytes/a/securing-oracle-integration-cloud-apis-with-traefik-on-oke/chat"
source_url: "https://carlosvillanua.com/securing-oracle-integration-cloud-apis-with-traefik-on-oke/"
body_source: "imported"
likes: 2
replies: 0
body_words: 878
---

# Securing Oracle Integration Cloud APIs with Traefik on OKE

## Introduction

Organizations using Oracle Integration Cloud (OIC) often need to expose their integrations to external consumers while maintaining robust security. In this post, we'll explore how to deploy **Traefik Hub** as an API Gateway on **Oracle Kubernetes Engine (OKE)** to provide enterprise-grade security for OIC APIs.

This architecture enables:

- **JWT validation** for external client authentication via Oracle Identity Domains (IDCS)
- **OAuth2.0 flow** for secure backend communication with OIC
- **Path rewriting** to create clean, developer-friendly virtual endpoints
- **Multi-layer security** with flexible authentication options

***

## Architecture Overview

![](https://carlosvillanua.com/content/images/2026/03/image.png)

### How It Works

1. **External clients** send requests with a JWT token obtained from Oracle Identity Domains
2. **Traefik Hub** validates the JWT using the JWKS endpoint
3. **OAuth2.0 Plugin** obtains a fresh access token for OIC
4. **Request is forwarded** to OIC with the new backend token
5. **Path rewriting** transforms clean API paths to OIC integration URLs

***

## Why This Architecture?

### The Challenge

Oracle Integration Cloud requires OAuth2.0 authentication for API access. Customers typically have their own identity providers and tokens. Or they don't want to share externally the OIC credentials. The challenge is bridging these two authentication realms securely.

### The Solution

Traefik Hub acts as a security gateway that:

1. **Validates external JWT tokens** - Ensures only authenticated clients can access your APIs
2. **Handles token exchange** - Obtains OIC-specific tokens using stored credentials
3. **Abstracts complexity** - External clients don't need to know about OIC authentication
4. **Provides observability** - Full visibility into API traffic through Traefik Hub dashboard

***

## Implementation Guide

### Prerequisites

- Oracle Kubernetes Engine (OKE) cluster
- Traefik Hub license - [get in contact with Traefik](https://traefik.io/pricing)
- Oracle Integration Cloud instance
- Oracle Identity Domains (IDCS) configuration

### Step 1: Deploy Traefik Hub on OKE

Deploy Traefik Hub using the [OCI Marketplace Stack](https://doc.traefik.io/traefik-hub/operations/oracle-oci/oci-apim-marketplace):

1. Navigate to **OCI Console** → **Marketplace** → Search for **"Traefik API Management"**
2. Launch the stack with your OKE cluster
3. Configure the Helm values:

```yaml
ingressRoute:
  dashboard:
    enabled: true
providers:
  kubernetesCRD:
    allowCrossNamespace: true
    allowExternalNameServices: true
```

### Step 2: Create ExternalName Service for OIC

Define a Kubernetes service that points to your OIC instance:

```yaml
apiVersion: v1
kind: Service
metadata:
  name: oic-backend
  namespace: apps
spec:
  type: ExternalName
  externalName: your-oic-instance.integration.oraclecloud.com
  ports:
    - port: 443
```

### Step 3: Configure JWT Validation Middleware

Create a middleware to validate incoming JWT tokens against Oracle Identity Domains:

```yaml
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: jwt-external-client-validation
  namespace: apps
spec:
  plugin:
    jwt:
      jwksUrl: https://idcs-<your-domain>.identity.oraclecloud.com:443/admin/v1/SigningCert/jwk
```

This middleware:

- Fetches the JWKS (JSON Web Key Set) from Oracle Identity Domains
- Validates the signature of incoming JWT tokens
- Rejects requests with invalid or expired tokens

### Step 4: Configure OAuth2.0 Client Credentials Middleware

Create a middleware for backend authentication with OIC:

```yaml
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: oauth2-backend
  namespace: apps
spec:
  plugin:
    oAuthClientCredentials:
      url: https://idcs-<your-domain>.identity.oraclecloud.com/oauth2/v1/token
      clientID: urn:k8s:secret:oauth2-client-creds:clientID
      clientSecret: urn:k8s:secret:oauth2-client-creds:clientSecret
      scopes:
        - urn:k8s:secret:oauth2-client-creds:scope
```

**Important:** Store credentials securely in Kubernetes Secrets:

```yaml
apiVersion: v1
kind: Secret
type: Opaque
metadata:
  name: oauth2-client-creds
  namespace: apps
stringData:
  clientID: <your-client-id>
  clientSecret: <your-client-secret>
  scope: <your-oic-scope>
```

> **Security Note:** The `urn:k8s:secret:` prefix tells Traefik Hub to read values from Kubernetes Secrets rather than embedding them in the middleware configuration.

### Step 5: Create Virtual Endpoint with Path Rewriting

Transform clean API paths to OIC integration URLs:

```yaml
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: virtualendpoint-oic
  namespace: apps
spec:
  replacePathRegex:
    regex: "^/echo(/.*)?$"
    replacement: "/ic/api/integration/v2/flows/rest/project/YOUR_PROJECT/YOUR_INTEGRATION/1.0$1"
```

This allows external clients to call `/echo` instead of the lengthy OIC integration path.

### Step 6: Create the IngressRoute

Tie everything together with an IngressRoute:

```yaml
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: oic-api-route
  namespace: apps
spec:
  entryPoints:
    - websecure
  tls:
    certResolver: le
    domains:
      - main: "api.yourdomain.com"
  routes:
    - kind: Rule
      match: Host(`api.yourdomain.com`) && PathPrefix(`/echo`)
      services:
        - name: oic-backend
          port: 443
          passHostHeader: false
      middlewares:
        - name: virtualendpoint-oic
        - name: jwt-external-client-validation
        - name: oauth2-backend
```

***

## Testing Your Setup

### Obtain a Client Token

First, get a JWT token from Oracle Identity Domains:

```bash
curl -X POST \
  "https://idcs-<your-domain>.identity.oraclecloud.com/oauth2/v1/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=<your-external-client-id>" \
  -d "client_secret=<your-external-client-secret>" \
  -d "scope=<your-scope>"
```

### Call Your API

Use the obtained token to call your API:

```bash
curl "https://api.yourdomain.com/echo" \
  -H "Authorization: Bearer <your-jwt-token>"
```

### Expected Flow

1. Traefik Hub receives the request
2. JWT middleware validates the token against JWKS
3. OAuth2.0 middleware obtains a backend token
4. Path is rewritten to the OIC integration URL
5. Request is forwarded to OIC with the backend token
6. Response is returned to the client

***

## Conclusion

Deploying Traefik Hub as an API Gateway for Oracle Integration Cloud provides a powerful, secure, and flexible solution for enterprise API management. The combination of JWT validation for external clients and OAuth2.0 Client Credentials for backend authentication creates a robust security boundary while maintaining ease of use for API consumers.

Key benefits:

- **Decoupled authentication** - External clients don't need OIC credentials
- **Centralized security** - All authentication handled at the gateway
- **Developer experience** - Clean, simple API endpoints
- **Enterprise ready** - Production-grade security and observability

***

*This blog post demonstrates a proof of concept for securing OIC APIs with Traefik Hub. Always review security configurations with your security team before deploying to production.*

***

## Discussion

No replies yet.