Authorization capabilities of the API Mediation Layer

[balhar-jakub]

Is your feature request related to a problem? Please describe.
As system administrator I want to limit the access to specific services to the specific users. I am used to the SAF tools and want to be able to use them to secure the Web APIs as well.

Describe the solution you'd like
I want every service to respect certain SAF privileges for specific users and reject the access as well as showing the service in the catalog directly based on these privileges.

Describe alternatives you've considered
The usage of Personal Access Tokens limit access to the services when PAT is used, but not in general, the user can still access the services using the other methods.

Additional context
Multiple users are asking for this functionality. There are already four linked issues in our repository:

• Prevent unauthorized access to API Catalog using IBM System Authorization Facility (SAF) #706
• Display ZLUX API catalog services according the SAF user profile #1660
• RBAC (or other way of segmentation) of access to APIML services #1977
• Hide the ZOSMF endpoint from API Catalog #2984
• Access control to APIML services #2952
• Allow Eureka Server Dashboard to be accessible only by system admin #2745
• Authenticating with the Eureka Server #3207

Asks

• Architecture support in how we should implement the SAF resources and how does it link to the service Ids of the specific service.
• UX in how the fact will be reflected in the Catalog and whether there should be some way to manage the resources directly from the Catalog.

[balhar-jakub]

@JirkaAichler You seem to have some opinion on how exactly should this look like, would you mind writing it down here, so we have it in one place?

And by this I mean general principles that needs to be followed in order for this to be effective and done correctly.