PXP-11248 PXP-11258 using POST auth/mapping instead of GET to support client credentials authentication #254

grugna · 2024-02-07T18:03:32Z

Depends on uc-cdis/arborist#163

New Features

Breaking Changes

Bug Fixes

Improvements

Use POST instead of GET /auth/mapping endpoint to enable client_credentials authentication

Dependency updates

Deployment changes

src/server/auth/arboristClient.js

paulineribeyre · 2024-03-04T22:53:40Z

src/server/auth/arboristClient.js

      resourcesEndpoint,
      {
-        method: 'GET',
+        method: 'POST',


This is a breaking change since the POST endpoint in older Arborist versions does not accept a token. I think we should add a retry here to make it backwards compatible - if the POST request doesn't work, try a GET request.

And a comment explaining the situation - we can remove the retry in a little while, when it will likely not cause issues

…it doesn't support token auth

paulineribeyre · 2024-03-06T22:49:23Z

@grugna eslint is complaining:

npm run eslint
  shell: /usr/bin/bash -e {0}

> @gen[3](https://github.com/uc-cdis/guppy/actions/runs/8179860773/job/22366757155?pr=254#step:8:3)/[email protected] eslint
> ./node_modules/.bin/eslint --ext js --ext jsx --fix src


/home/runner/work/guppy/guppy/src/server/auth/arboristClient.js
Error:   25:29  error  Expected '===' and instead saw '=='                                    eqeqeq
Error:   35:19  error  'response' is already declared in the upper scope on line 2[4](https://github.com/uc-cdis/guppy/actions/runs/8179860773/job/22366757155?pr=254#step:8:5) column [8](https://github.com/uc-cdis/guppy/actions/runs/8179860773/job/22366757155?pr=254#step:8:9)  no-shadow

✖ 2 problems (2 errors, 0 warnings)

Error: Process completed with exit code 1.

paulineribeyre · 2024-03-06T22:58:19Z

Tested in QA - Arborist logs:

Old guppy + old arborist:

172.20.114.101 - - [06/Mar/2024:22:45:09 +0000] "GET /auth/mapping HTTP/1.0" 200

Old guppy + new arborist:

172.20.106.8 - - [06/Mar/2024:22:56:44 +0000] "GET /auth/mapping HTTP/1.1" 200

New guppy + old arborist:

2024/03/06 22:50:27 server.go:286: INFO: tried to handle auth mapping request but input was invalid: could not parse JSON: unexpected end of JSON input
2024/03/06 22:50:27 server.go:291: INFO: must specify exactly one of `username` or `clientID`
172.20.86.25 - - [06/Mar/2024:22:50:27 +0000] "POST /auth/mapping HTTP/1.1" 400
172.20.86.25 - - [06/Mar/2024:22:50:27 +0000] "GET /auth/mapping HTTP/1.1" 200

New guppy + new arborist:

2024/03/06 22:53:47 server.go:325: INFO: No jwt provided, checking request body
2024/03/06 22:53:47 server.go:330: ERROR: tried to handle auth mapping request but input was invalid: could not parse JSON: unexpected end of JSON input
172.20.86.25 - - [06/Mar/2024:22:53:47 +0000] "POST /auth/mapping HTTP/1.1" 400 85 "" "node-fetch/1.0 (+https://github.com/bitinn/node-fetch)"
172.20.86.25 - - [06/Mar/2024:22:53:47 +0000] "GET /auth/mapping HTTP/1.1" 200 3668 "" "node-fetch/1.0 (+https://github.com/bitinn/node-fetch)"

The last one doesn't sound right ^ @grugna
It should only call POST and arborist should see the jwt

grugna · 2024-03-07T15:27:06Z

@paulineribeyre I agree it should only call a POST ( #254 (comment) ). I can't recreate it on my side, which images are you using?

2024/03/07 15:24:50 server.go:542: INFO: handling auth request: arborist.AuthRequest{Username:"[email protected]", ClientID:"", Policies:[]string(nil), Resource:"/analysis", Service:"analysis", Method:"access", stmts:(*arborist.CachedStmts)(0xc00008d3e0)}
2024/03/07 15:24:50 server.go:555: DEBUG: user is authorized
172.32.7.137 - - [07/Mar/2024:15:24:50 +0000] "POST /auth/request HTTP/1.1" 200 13 "" "python-httpx/0.25.0"
172.32.7.171 - - [07/Mar/2024:15:25:20 +0000] "GET /health HTTP/1.1" 200 9 "" "kube-probe/1.22+"
172.32.7.171 - - [07/Mar/2024:15:25:20 +0000] "GET /health HTTP/1.1" 200 9 "" "kube-probe/1.22+"

paulineribeyre · 2024-03-07T16:23:30Z

@grugna Sorry for the confusion, the logs above are when the user is unauthenticated. No jwt, so it falls back on the request body.
The logs below are when the user is authenticated - it works fine:

New guppy + old arborist:

2024/03/07 16:04:59 server.go:286: INFO: tried to handle auth mapping request but input was invalid: could not parse JSON: unexpected end of JSON input
2024/03/07 16:04:59 server.go:291: INFO: must specify exactly one of `username` or `clientID`
172.20.65.253 - - [07/Mar/2024:16:04:59 +0000] "POST /auth/mapping HTTP/1.1" 400
2024/03/07 16:04:59 server.go:237: INFO: Attempting to get username from jwt...
2024/03/07 16:04:59 token.go:31: DEBUG: decoding token: <redacted>
2024/03/07 16:04:59 server.go:249: INFO: found username in jwt: [email protected]
172.20.65.253 - - [07/Mar/2024:16:04:59 +0000] "GET /auth/mapping HTTP/1.1" 200

New guppy + new arborist:

2024/03/07 16:08:17 server.go:293: INFO: Attempting to get username or client ID from jwt...
2024/03/07 16:08:17 token.go:31: DEBUG: decoding token: <redacted>
2024/03/07 16:08:17 server.go:312: INFO: found username in jwt: [email protected]
172.20.65.253 - - [07/Mar/2024:16:08:17 +0000] "POST /auth/mapping HTTP/1.1" 200

The concern I have is that when the user is unauthenticated, the endpoints have different behaviors:

GET /auth/mapping returns "anonymous" access
POST /auth/mapping returns an error

So with this code, for an unauthenticated user, we will always fall back to the GET endpoint and return "anonymous" access. If we ever remove the fallback to the GET endpoint from Guppy, the behavior will change to not supporting unauthenticated requests. I need to think about this a bit more, see if the Arborist logic can be refactored

grugna · 2024-03-07T16:55:11Z

Ah, I see what you are saying. @paulineribeyre I agree this would need to be an arborist change. Let me know if you want me to start another PR for that.

paulineribeyre · 2024-03-11T22:20:32Z

Hi @grugna, I pushed a fix for the above and wrote down the results of my tests here: uc-cdis/arborist#164

If the changes look good to you, I think we can go ahead and merge this one

using POST auth/mapping instead of GET

ecfd5f2

github-actions bot added the @requires-guppy label Feb 7, 2024

paulineribeyre requested changes Mar 1, 2024

View reviewed changes

src/server/auth/arboristClient.js Outdated Show resolved Hide resolved

requested changes

d9f8b44

paulineribeyre self-requested a review March 1, 2024 22:55

paulineribeyre reviewed Mar 4, 2024

View reviewed changes

src/server/auth/arboristClient.js Outdated Show resolved Hide resolved

paulineribeyre reviewed Mar 4, 2024

View reviewed changes

grugna added 3 commits March 6, 2024 09:05

remove comment

3af1972

call GET instead of POST /auth/mapping

9124967

use GET for older version of Arborist where post returns 400 because …

632b289

…it doesn't support token auth

paulineribeyre changed the title ~~using POST auth/mapping instead of GET to support client credentials authentication~~ PXP-11248 PXP-11258 using POST auth/mapping instead of GET to support client credentials authentication Mar 6, 2024

fix eslint

fd83fbc

paulineribeyre added the skip-quay-build label Mar 11, 2024

paulineribeyre mentioned this pull request Mar 11, 2024

PXP-11248 PXP-11258 "POST /auth/mapping" anonymous support uc-cdis/arborist#164

Merged

paulineribeyre approved these changes Mar 12, 2024

View reviewed changes

paulineribeyre merged commit c5e551b into uc-cdis:master Mar 12, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

PXP-11248 PXP-11258 using POST auth/mapping instead of GET to support client credentials authentication #254

PXP-11248 PXP-11258 using POST auth/mapping instead of GET to support client credentials authentication #254

Uh oh!

grugna commented Feb 7, 2024 •

edited by paulineribeyre

Loading

Uh oh!

Uh oh!

Uh oh!

paulineribeyre Mar 4, 2024

Uh oh!

paulineribeyre commented Mar 6, 2024

Uh oh!

paulineribeyre commented Mar 6, 2024

Uh oh!

grugna commented Mar 7, 2024 •

edited

Loading

Uh oh!

paulineribeyre commented Mar 7, 2024

Uh oh!

grugna commented Mar 7, 2024

Uh oh!

paulineribeyre commented Mar 11, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

PXP-11248 PXP-11258 using POST auth/mapping instead of GET to support client credentials authentication #254

PXP-11248 PXP-11258 using POST auth/mapping instead of GET to support client credentials authentication #254

Uh oh!

Conversation

grugna commented Feb 7, 2024 • edited by paulineribeyre Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

New Features

Breaking Changes

Bug Fixes

Improvements

Dependency updates

Deployment changes

Uh oh!

Uh oh!

Uh oh!

paulineribeyre Mar 4, 2024

Choose a reason for hiding this comment

Uh oh!

paulineribeyre commented Mar 6, 2024

Uh oh!

paulineribeyre commented Mar 6, 2024

Uh oh!

grugna commented Mar 7, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

paulineribeyre commented Mar 7, 2024

Uh oh!

grugna commented Mar 7, 2024

Uh oh!

paulineribeyre commented Mar 11, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

grugna commented Feb 7, 2024 •

edited by paulineribeyre

Loading

grugna commented Mar 7, 2024 •

edited

Loading