You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by GitBox <gi...@apache.org> on 2021/08/29 14:54:26 UTC
[GitHub] [apisix] mamalianggf opened a new issue #4922: request help: authz-cashin plugin is not working properly
mamalianggf opened a new issue #4922:
URL: https://github.com/apache/apisix/issues/4922
### Issue description
firstly,I put a plugin_meta like this:
`curl http://127.0.0.1:9080/apisix/admin/plugin_metadata/authz-casbin -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -i -X PUT -d '
{
"model": "[request_definition]
r = sub, obj
[policy_definition]
p = sub, obj
[role_definition]
g = _, _
[policy_effect]
e = some(where (p.eft == allow))
[matchers]
m = (g(r.sub, p.sub) || keyMatch(r.sub, p.sub)) && keyMatch(r.obj, p.obj)",
"policy": "p, admin, /api/v1/dms/sys/version
g, gaofeng, admin"
}'`
secondly,I reload plugin like this:
`curl http://127.0.0.1:9080/apisix/admin/plugins/reload -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT
`
thirdly,I put a route like this
` curl http://127.0.0.1:9080/apisix/admin/routes/1 -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -i -d '
{
"name": "route-gw-cloud-dms-version",
"uri": "/api/v1/dms/sys/version",
"plugins": {
"authz-casbin": {
"username": "user"
},
"proxy-rewrite": {
"uri": "/sys/version"
}
},
"upstream": {
"type": "roundrobin",
"nodes": {
"127.0.0.1:60200": 1
}
}
}'`
so,when I execute the following command,I expect the response to remind me that I forgotten the header parameter,but it not
`curl http://127.0.0.1:9080/api/v1/dms/sys/version`
`
<!DOCTYPE html>
<html>
<head>
<meta content="text/html;charset=utf-8" http-equiv="Content-Type">
<meta content="utf-8" http-equiv="encoding">
<title>500 Internal Server Error</title>
<style>
body {
width: 35em;
margin: 0 auto;
font-family: Tahoma, Verdana, Arial, sans-serif;
}
</style>
</head>
<body>
<h1>An error occurred.</h1>
<p>You can report issue to <a href="https://github.com/apache/apisix/issues">APISIX</a></p>
<p><em>Faithfully yours, <a href="https://apisix.apache.org/">APISIX</a>.</em></p>
</body>
</html>
`
The following information is displayed in the log
`2021/08/29 14:21:41 [error] 41#41: *68240 lua entry thread aborted: runtime error: ...cal/apisix//deps/share/lua/5.1/src/main/CoreEnforcer.lua:403: invalid request size
stack traceback:
coroutine 0:
[C]: in function 'error'
...cal/apisix//deps/share/lua/5.1/src/main/CoreEnforcer.lua:403: in function 'enforceEx'
...cal/apisix//deps/share/lua/5.1/src/main/CoreEnforcer.lua:526: in function 'enforce'
/usr/local/apisix/apisix/plugins/authz-casbin.lua:127: in function 'phase_func'
/usr/local/apisix/apisix/plugin.lua:660: in function 'run_plugin'
/usr/local/apisix/apisix/init.lua:440: in function 'http_access_phase'
access_by_lua(nginx.conf:261):2: in main chunk, client: 127.0.0.1, server: _, request: "GET /api/v1/dms/sys/version HTTP/1.1", host: "127.0.0.1:9080`
### Environment
- apisix version (cmd: `apisix version`):2.9(Clone the Master branch of Apisix and then generate the image locally through the guidance of the Apisix-Docker project)
- OS (cmd: `uname -a`):Linux tool 4.15.0-154-generic #ubuntu1804
- OpenResty / Nginx version (cmd: `nginx -V` or `openresty -V`):nginx version: openresty/1.19.3.1
- etcd version, if have (cmd: run `curl http://127.0.0.1:9090/v1/server_info` to get the info from server-info API):3.4.0
- luarocks version, if the issue is about installation (cmd: `luarocks --version`):/usr/local/openresty/luajit/bin/luarocks 3.7.0
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] rushitote commented on issue #4922: request help: authz-cashin plugin is not working properly
Posted by GitBox <gi...@apache.org>.
rushitote commented on issue #4922:
URL: https://github.com/apache/apisix/issues/4922#issuecomment-908036613
@mamalianggf
So, this plugin has a fixed request size of 3 variables i.e. `sub, obj, act` which is the username, the URL path and the request method. These three variables are always passed in the enforcement request. There was an error because you have defined the request as two parameters while three parameters are being passed in. So you could keep your model and policy as it is with just one change in the `request_definition` to make it like this:
```conf
[request_definition]
r = sub, obj, act
```
> so,when I execute the following command,I expect the response to remind me that I forgotten the header parameter,but it not
Here, if the header parameter isn't passed in the request - it won't give out an error instead it will use `anonymous` as the subject (username) and get the result of enforcement. In this case, it will result in false (since `anonymous` can't access anything as per the policy) and return the 403 status code.
Let me know if you have any more questions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] mamalianggf closed issue #4922: request help: authz-cashin plugin is not working properly
Posted by GitBox <gi...@apache.org>.
mamalianggf closed issue #4922:
URL: https://github.com/apache/apisix/issues/4922
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] mamalianggf closed issue #4922: request help: authz-cashin plugin is not working properly
Posted by GitBox <gi...@apache.org>.
mamalianggf closed issue #4922:
URL: https://github.com/apache/apisix/issues/4922
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] mamalianggf commented on issue #4922: request help: authz-cashin plugin is not working properly
Posted by GitBox <gi...@apache.org>.
mamalianggf commented on issue #4922:
URL: https://github.com/apache/apisix/issues/4922#issuecomment-908063838
ok,thanks.I updated the plugin_metadata of authz-plugin,then it working
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] mamalianggf commented on issue #4922: request help: authz-cashin plugin is not working properly
Posted by GitBox <gi...@apache.org>.
mamalianggf commented on issue #4922:
URL: https://github.com/apache/apisix/issues/4922#issuecomment-907955215
> > The following information is displayed in the log `2021/08/29 14:21:41 [error] 41#41: *68240 lua entry thread aborted: runtime error: ...cal/apisix//deps/share/lua/5.1/src/main/CoreEnforcer.lua:403: invalid request size stack traceback: coroutine 0: [C]: in function 'error' ...cal/apisix//deps/share/lua/5.1/src/main/CoreEnforcer.lua:403: in function 'enforceEx' ...cal/apisix//deps/share/lua/5.1/src/main/CoreEnforcer.lua:526: in function 'enforce' /usr/local/apisix/apisix/plugins/authz-casbin.lua:127: in function 'phase_func' /usr/local/apisix/apisix/plugin.lua:660: in function 'run_plugin' /usr/local/apisix/apisix/init.lua:440: in function 'http_access_phase' access_by_lua(nginx.conf:261):2: in main chunk, client: 127.0.0.1, server: _, request: "GET /api/v1/dms/sys/version HTTP/1.1", host: "127.0.0.1:9080
>
> @rushitote
> Do you have time to take a look at the error stack? Thanks!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] mamalianggf removed a comment on issue #4922: request help: authz-cashin plugin is not working properly
Posted by GitBox <gi...@apache.org>.
mamalianggf removed a comment on issue #4922:
URL: https://github.com/apache/apisix/issues/4922#issuecomment-907955215
> > The following information is displayed in the log `2021/08/29 14:21:41 [error] 41#41: *68240 lua entry thread aborted: runtime error: ...cal/apisix//deps/share/lua/5.1/src/main/CoreEnforcer.lua:403: invalid request size stack traceback: coroutine 0: [C]: in function 'error' ...cal/apisix//deps/share/lua/5.1/src/main/CoreEnforcer.lua:403: in function 'enforceEx' ...cal/apisix//deps/share/lua/5.1/src/main/CoreEnforcer.lua:526: in function 'enforce' /usr/local/apisix/apisix/plugins/authz-casbin.lua:127: in function 'phase_func' /usr/local/apisix/apisix/plugin.lua:660: in function 'run_plugin' /usr/local/apisix/apisix/init.lua:440: in function 'http_access_phase' access_by_lua(nginx.conf:261):2: in main chunk, client: 127.0.0.1, server: _, request: "GET /api/v1/dms/sys/version HTTP/1.1", host: "127.0.0.1:9080
>
> @rushitote
> Do you have time to take a look at the error stack? Thanks!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] spacewander commented on issue #4922: request help: authz-cashin plugin is not working properly
Posted by GitBox <gi...@apache.org>.
spacewander commented on issue #4922:
URL: https://github.com/apache/apisix/issues/4922#issuecomment-907933689
> The following information is displayed in the log `2021/08/29 14:21:41 [error] 41#41: *68240 lua entry thread aborted: runtime error: ...cal/apisix//deps/share/lua/5.1/src/main/CoreEnforcer.lua:403: invalid request size stack traceback: coroutine 0: [C]: in function 'error' ...cal/apisix//deps/share/lua/5.1/src/main/CoreEnforcer.lua:403: in function 'enforceEx' ...cal/apisix//deps/share/lua/5.1/src/main/CoreEnforcer.lua:526: in function 'enforce' /usr/local/apisix/apisix/plugins/authz-casbin.lua:127: in function 'phase_func' /usr/local/apisix/apisix/plugin.lua:660: in function 'run_plugin' /usr/local/apisix/apisix/init.lua:440: in function 'http_access_phase' access_by_lua(nginx.conf:261):2: in main chunk, client: 127.0.0.1, server: _, request: "GET /api/v1/dms/sys/version HTTP/1.1", host: "127.0.0.1:9080
@rushitote
Do you have time to take a look at the error stack? Thanks!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] tzssangglass commented on issue #4922: request help: authz-cashin plugin is not working properly
Posted by GitBox <gi...@apache.org>.
tzssangglass commented on issue #4922:
URL: https://github.com/apache/apisix/issues/4922#issuecomment-908036793
the code corresponding to this error: https://github.com/casbin/lua-casbin/blob/425ac40c127a6af88a4ef4c92f92e0ad265110fb/src/main/CoreEnforcer.lua#L399-L404
based on the information you provided, I reproduced the error and here is the key log
```
2021/08/30 07:00:37 [warn] 182320#182320: *144 [lua] CoreEnforcer.lua:402: enforceEx(): rTokens:{ "r_sub", "r_obj" }, client: 127.0.0.1, server: _, request: "GET /api/v1/dms/sys/version HTTP/1.1", host: "127.0.0.1:9080"
2021/08/30 07:00:37 [warn] 182320#182320: *144 [lua] CoreEnforcer.lua:403: enforceEx(): rvals:{ "anonymous", "/api/v1/dms/sys/version", "GET" }, client: 127.0.0.1, server: _, request: "GET /api/v1/dms/sys/version HTTP/1.1", host: "127.0.0.1:9080"
```
> "model": "[request_definition]
> r = sub, obj
I think you have the wrong configuration here.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org