You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@kie.apache.org by "gabriel-farache (via GitHub)" <gi...@apache.org> on 2023/11/20 15:56:57 UTC
[I] Error when configuring auth policy with DataIndex [incubator-kie-kogito-apps]
gabriel-farache opened a new issue, #1922:
URL: https://github.com/apache/incubator-kie-kogito-apps/issues/1922
### Describe the bug
With the following properties are added to in the `application.properties` of the data index instance (running on local minikube) to only allow some users to access the graphql endpoint:
```
quarkus.http.auth.policy.role-policy1.roles-allowed=user
quarkus.http.auth.permission.roles1.paths=/graphql/*
quarkus.http.auth.permission.roles1.policy=role-policy1
```
But I get the following error:
```
Caused by: java.lang.RuntimeException: Unable to find HTTP security policy role-policy1
at io.quarkus.vertx.http.runtime.security.PathMatchingHttpSecurityPolicy.init(PathMatchingHttpSecurityPolicy.java:96)
at io.quarkus.vertx.http.runtime.security.HttpSecurityRecorder$4.created(HttpSecurityRecorder.java:217)
at io.quarkus.arc.runtime.ArcRecorder.initBeanContainer(ArcRecorder.java:73)
at io.quarkus.deployment.steps.ArcProcessor$generateResources844392269.deploy_0(Unknown Source)
at io.quarkus.deployment.steps.ArcProcessor$generateResources844392269.deploy(Unknown Source)
```
It's like the 1st property is ignored...
When setting those properties in a brand new quarkus project (https://quarkus.io/guides/security-oidc-bearer-token-authentication-tutorial) or inside a workflow project, there is no such error
### Expected behavior
No Error should be thrown and only user associated with the role `user` shall be able to access `/graphql` endpoint
### Actual behavior
An error is thrown so the DataIndex is not starting
### How to Reproduce?
Steps to reproduce:
1. Add the following props to the application.properties file:
```
quarkus.http.auth.policy.role-policy1.roles-allowed=user
quarkus.http.auth.permission.roles1.paths=/graphql/*
quarkus.http.auth.permission.roles1.policy=role-policy1
```
2. Start the application or restart the pod
### Output of `uname -a` or `ver`
_No response_
### Output of `java -version`
_No response_
### GraalVM version (if different from Java)
_No response_
### Kogito version or git rev (or at least Quarkus version if you are using Kogito via Quarkus platform BOM)
_No response_
### Build tool (ie. output of `mvnw --version` or `gradlew --version`)
_No response_
### Additional information
Here is the manifest I use to deploy the DataIndex service in minikue:
```
kind: Deployment
apiVersion: apps/v1
metadata:
name: data-index
spec:
replicas: 1
selector:
matchLabels:
app: data-index
template:
metadata:
labels:
app: data-index
spec:
containers:
- name: data-index
image: quay.io/kiegroup/kogito-data-index-postgresql:1.44.1
resources:
requests:
memory: "256Mi"
cpu: "500m"
limits:
memory: "512Mi"
cpu: "1000m"
ports:
- containerPort: 8080
env:
- name: QUARKUS_PROFILE
value: http-events-support
- name: KOGITO_DATA_INDEX_QUARKUS_PROFILE
value: http-events-support
- name: QUARKUS_HTTP_AUTH_POLICY__ROLE_POLICY12__ROLES_ALLOWED
value: user
- name: QUARKUS_HTTP_AUTH_PERMISSION__PERMISSIONS12__POLICY
value: ROLE_POLICY12
- name: QUARKUS_HTTP_AUTH_PERMISSION__PERMISSIONS12__PATH
value: /graphql/*
- name: QUARKUS_DATASOURCE_USERNAME
valueFrom:
secretKeyRef:
name: postgres-secrets
key: POSTGRES_USER
- name: QUARKUS_DATASOURCE_PASSWORD
valueFrom:
secretKeyRef:
name: postgres-secrets
key: POSTGRES_PASSWORD
volumeMounts:
- name: application-config
mountPath: "/home/kogito/config"
livenessProbe:
failureThreshold: 3
httpGet:
path: /q/health/live
port: 8080
scheme: HTTP
initialDelaySeconds: 0
periodSeconds: 30
successThreshold: 1
timeoutSeconds: 10
readinessProbe:
failureThreshold: 3
httpGet:
path: /q/health/ready
port: 8080
scheme: HTTP
initialDelaySeconds: 0
periodSeconds: 30
successThreshold: 1
timeoutSeconds: 10
volumes:
- name: application-config
configMap:
name: data-index-properties
initContainers:
- name: init-postgres
image: busybox:1.36
imagePullPolicy: IfNotPresent
command: ['sh', '-c', 'until nc -vz postgres-db-service.postgres.svc.cluster.local 5432; do echo "Waiting for postgres server"; sleep 3; done;']
---
kind: Service
apiVersion: v1
metadata:
name: data-index-service
labels:
app: data-index
spec:
selector:
app: data-index
ports:
- protocol: TCP
port: 80
targetPort: 8080
type: NodePort
```
And here is my application.properties files (that is in the configmap `data-index-properties`):
```
quarkus.http.port=8080
quarkus.http.cors=true
quarkus.http.cors.origins=/.*/
quarkus.profile=http-events-support
#quarkus.log.category."org.kie.kogito.index".min-level=DEBUG
quarkus.log.category."org.kie.kogito.index".level=DEBUG
quarkus.log.category."io.quarkus.vertx.http".level=TRACE
quarkus.log.category."io.quarkus.arc".level=TRACE
quarkus.datasource.data_index.db-kind=postgresql
quarkus.datasource.jdbc.url=jdbc:postgresql://postgres-db-service.postgres:5432/sonataflow?currentSchema=data-index-service
quarkus.hibernate-orm.database.generation=update
quarkus.flyway.migrate-at-start=true
quarkus.flyway.table=data-index-flyway
#kogito.data-index.quarkus_profile=http-events-support
# Disable kafka client health check since the quarkus-http connector is being used instead.
quarkus.smallrye-health.check."io.quarkus.kafka.client.health.KafkaHealthCheck".enabled=false
#quarkus.kafka.devservices.enabled=false
#quarkus.kafka.health.enabled=false
# OIDC Configuration
quarkus.oidc.auth-server-url=https://keycloak.192.168.58.2.nip.io/realms/quarkus
quarkus.oidc.client-id=test
quarkus.oidc.credentials.secret=DP4yGzYhtdzGt9jEEJW7bvWmeqmekKii
quarkus.oidc.tls.verification=none
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org
Re: [I] Error when configuring auth policy with DataIndex [incubator-kie-kogito-apps]
Posted by "nmirasch (via GitHub)" <gi...@apache.org>.
nmirasch closed issue #1922: Error when configuring auth policy with DataIndex
URL: https://github.com/apache/incubator-kie-kogito-apps/issues/1922
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org
Re: [I] Error when configuring auth policy with DataIndex [incubator-kie-kogito-apps]
Posted by "nmirasch (via GitHub)" <gi...@apache.org>.
nmirasch commented on issue #1922:
URL: https://github.com/apache/incubator-kie-kogito-apps/issues/1922#issuecomment-1823288233
It is happening with whatever container that contains a quarkus application. The thing is that properties are processed in buildtime see https://quarkus.io/guides/all-config#quarkus-vertx-http_quarkus.http.auth.policy.-role-policy-.roles-allowed Those policies added in runtime are not being considered. If it's needed some kind security configuration, you will need to set that at container level. (https://kubernetes.io/docs/concepts/security/)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org