Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[3scale_batcher] Update regrex to match app_id with special characters #1457

Merged
merged 1 commit into from
Apr 18, 2024

Conversation

tkan145
Copy link
Contributor

@tkan145 tkan145 commented Apr 16, 2024

What

A user reported similar error in #1453 but they have app_id with special chars instead. I also think that user with access_token will have similar problem

From the portal code, app_id allows the following:

Allowed characters: 
A-Z a-z 0-9 ! " # $ % & ' ( ) * + , - . / : ; < = > ? @ [ \ ] ^ _ ` { | } ~ # Spaces are not allowed

I'm not sure if porta ever validate access_token but from the RFC the format is as follow

b64token    = 1*( ALPHA / DIGIT /
                       "-" / "." / "_" / "~" / "+" / "/" ) *"="
credentials = "Bearer" 1*SP b64token

Verification steps

  • Configure Product A with app_id/app_key both contains special characters. For example
app_id: something:special
app_key: coffee_brain_food
  • Configure batcher policy for both Product A and Product B with the following:

{ "name" : "apicast.policy.3scale_batcher", "configuration" : { "batch_report_seconds" : 1 } }

  • Start dev environment
make development
make dependencies
  • Run apicast locally
THREESCALE_DEPLOYMENT_ENV=staging APICAST_LOG_LEVEL=debug APICAST_WORKER=1 APICAST_CONFIGURATION_LOADER=lazy APICAST_CONFIGURATION_CACHE=0 THREESCALE_PORTAL_ENDPOINT=https://token@3scale-admin.example.com ./bin/apicast
  • Capture APIcast IP
APICAST_IP=$(docker inspect apicast_build_0-development-1 | yq e -P '.[0].NetworkSettings.Networks.apicast_build_0_default.IPAddress' -)
  • Send a query to Product A with the valid app_id/app_key
curl -i -k -H "Host: example.com" "http://${APICAST_IP}:8080/?app_id=something:special&app_key=coffee_brain_food"
  • Check that credentials not found error does not appear in the log. For example:
reports_batcher.lua:99: get_all(): failed to get report for key service_id:12,app_id:something:special,app_key:coffee_brain_food,metric:Hits err: credentials not found, context: ngx.timer, client: 10.10.10.1, server: 0.0.0.0:8080 

  • Configure a single Product B with an OpenID Provider + realm basic
  • Create 3scale application App01 for product B. That will generate Client ID and Client Secret.
  • Configure batcher policy for Product B with the following:
{ "name" : "apicast.policy.3scale_batcher", "configuration" : { "batch_report_seconds" : 1 } }
  • Generate token from a realm basic using client credentials from the application App01
curl -v -k -H "Content-Type: application/x-www-form-urlencoded" \
        -d 'grant_type=password' \
        -d 'client_id=${CLIENT_ID_FROM_3SCALE_APPLICATION}' \
        -d 'client_secret=${CLIENT_SECRET_FROM_3SCALE_APPLICATION}' \
        -d 'username=${USER_CREATED_IN_KEYCLOAK}' \
        -d 'password=***' "https://keycloak.example.com/auth/realms/basic/protocol/openid-connect/token"

# capture access token
ACCESS_TOKEN=eyJhb...
  • Send a query to Product B with a valid access token
curl -i -k -H "Host: example.com"  -H "Authorization: Bearer ${ACCESS_TOKEN}" "http://${APICAST_IP}:8080/"
  • Check that credentials not found error does not appear in the log. For example:

@tkan145 tkan145 marked this pull request as ready for review April 17, 2024 09:54
@tkan145 tkan145 requested a review from a team as a code owner April 17, 2024 09:54
Copy link
Member

@eguzki eguzki left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Verification steps working
LGTM

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants