Enable test mode on API gateway #389

nicoloboschi · 2023-09-08T14:58:39Z

Changes:

Added boolean field allow-test-mode to the authentication gateway field. By default is true.

- id: consume-output-auth-github
      type: consume
      topic: output-topic
      authentication:
        provider: github
        configuration:
          clientId: "{{ secrets.github.client-id }}"
        allow-test-mode: true

In the api gateway it's possible to configure the test gateway authentication provider
The principal values are computed based on the input credentials. The computation is sha256+base64. Better to not "store" test credentials in plain text, but the computed value must be the same for the same token/credential.

There are two new auth implementations:

http that performs a GET to a fixed url passing the header and check the status
jwt that performs JWT validation

They can be used also by the gateway for production authentications.

The client needs to pass a test-credentials param instead of credentials to enter the test mode.

Client connect string example with token:

ws://localhost:8091/v1/consume/tenant1/application1/consume?test-credentials=TOKEN

In the api gateway, you have to configure the test auth provider

HTTP

application.gateways.auth.test.type=http
application.gateways.auth.test.configuration.base-url=http://xxxx
application.gateways.auth.test.configuration.path-template=/token/{tenant}
application.gateways.auth.test.configuration.headers.myheader=myvalue
application.gateways.auth.test.configuration.accepted-statuses=200,201

JWT

application.gateways.auth.test.type=jwt
application.gateways.auth.test.configuration.secretKey=xxx
application.gateways.auth.test.configuration.authClaim=sub
application.gateways.auth.test.configuration.adminRoles=adminuser

eolivelli · 2023-09-08T15:57:45Z

examples/applications/gateway-authentication/gateways.yaml

@@ -21,20 +21,20 @@ gateways:
    topic: input-topic
    parameters:
      - sessionId
-    produceOptions:
+    produce-options:


this reads like a breaking change and we have stuff in production, please don't do it

no it's not, it's an alias and they both work

eolivelli

Nice work but:

I don't think we need a separate class hierarchy, we can make jwt and http regular authentication providers
I don't think we need the ability to override the values (if we need it then we have to configure it statically somewhere, not let the client override security related pieces of information)
I don't think we need to have a different admin-credentials parameter, it is enough to have "credentials"

My idea is that if you enable the system authentication then you gateway accepts also the credentials for the system provider and run the authentication flow.

The question maybe is "how do the gateway know that the client is authenticating with one provider, like Google, or another provider, like the System provider ?"

if that's the problem maybe it is good to have "admin-credentials", but I won't create different class hierarchies for the "System Gateway Authentication" and the regular Gateway Authentication

eolivelli · 2023-09-08T15:59:46Z

...c/main/java/ai/langstream/apigateway/auth/impl/jwt/admin/JwtAdminAuthenticationProvider.java

+import java.util.Map;
+import lombok.SneakyThrows;
+
+public class JwtAdminAuthenticationProvider implements GatewayAdminAuthenticationProvider {


why only "admin", we can make it a regular implementation

eolivelli · 2023-09-08T15:59:52Z

.../main/java/ai/langstream/apigateway/auth/impl/jwt/admin/HttpAdminAuthenticationProvider.java

+import lombok.extern.slf4j.Slf4j;
+
+@Slf4j
+public class HttpAdminAuthenticationProvider implements GatewayAdminAuthenticationProvider {


why only "admin", we can make it a regular implementation

eolivelli · 2023-09-08T16:00:20Z

langstream-api-gateway-auth/pom.xml

@@ -30,5 +30,7 @@
  <modules>
    <module>langstream-google-api-gateway-auth</module>
    <module>langstream-github-api-gateway-auth</module>
+    <module>langstream-jwt-gateway-admin-auth</module>


I would drop "admin" from everywhere

eolivelli · 2023-09-08T16:01:58Z

...-api-gateway/src/main/java/ai/langstream/apigateway/websocket/AuthenticationInterceptor.java

+            }
+
+            final GatewayAdminAuthenticationProvider gatewayAdminAuthenticationProvider =
+                    adminAuthProviders.get(provider);


I think that we shouldn't let the client decide which provider,
there will be only one configured, there is no need to have more

eolivelli · 2023-09-08T16:02:36Z

...m-api-gateway/src/main/java/ai/langstream/apigateway/websocket/handlers/AbstractHandler.java

            Map<String, String> pathVars,
            Map<String, String> queryString,
            Map<String, String> httpHeaders) {
        Map<String, String> options = new HashMap<>();
        Map<String, String> userParameters = new HashMap<>();

        final String credentials = queryString.remove("credentials");
+        final String adminCredentials = queryString.remove("admin-credentials");


I don't think there is need to have a different parameter

eolivelli · 2023-09-08T16:03:40Z

...m-api-gateway/src/main/java/ai/langstream/apigateway/websocket/handlers/AbstractHandler.java


        for (Map.Entry<String, String> entry : queryString.entrySet()) {
+            if (entry.getKey().startsWith("admin-credentials-input-")) {


I am not sure we need this thing, it seems like a security hole, what's the use case ?

eolivelli · 2023-09-08T16:04:07Z

...tream-api/src/main/java/ai/langstream/api/gateway/GatewayAuthenticationProviderRegistry.java

@@ -42,4 +42,26 @@ public static GatewayAuthenticationProvider loadProvider(
        store.initialize(configuration);
        return store;
    }
+
+    public static GatewayAdminAuthenticationProvider loadAdminProvider(


no need to have a different mechanism

eolivelli · 2023-09-08T16:04:36Z

langstream-cli/src/main/java/ai/langstream/cli/commands/gateway/ChatGatewayCmd.java

@@ -67,6 +67,21 @@ public class ChatGatewayCmd extends BaseGatewayCmd {
            description = "Connect timeout for WebSocket connections in seconds.")
    private long connectTimeoutSeconds = 0;

+    @CommandLine.Option(


eolivelli

LGTM

nicoloboschi added 6 commits September 8, 2023 16:42

Enable admin authentication on API gateway

5e9c009

spotless

7ad04b1

kebab

247e7fd

add to all examples

d13cd33

implement Cli

213db1b

spotless

8f70724

nicoloboschi marked this pull request as draft September 8, 2023 15:54

eolivelli requested changes Sep 8, 2023

View reviewed changes

change name and others

c0a8df3

nicoloboschi changed the title ~~Enable admin authentication on API gateway~~ Enable test mode on API gateway Sep 11, 2023

nicoloboschi added 3 commits September 11, 2023 11:06

spotless

09d1c79

rename & fix example

3dd647b

spotless

e3d6de7

nicoloboschi marked this pull request as ready for review September 11, 2023 12:58

nicoloboschi requested a review from eolivelli September 11, 2023 12:58

nicoloboschi added 2 commits September 11, 2023 14:58

spotless

439c164

spotless

1c3ed85

eolivelli approved these changes Sep 11, 2023

View reviewed changes

nicoloboschi merged commit 0b72100 into main Sep 11, 2023
8 checks passed

nicoloboschi deleted the jwt-on-gw branch September 11, 2023 13:24

eolivelli added the needs-doc label Sep 15, 2023

benfrank241 pushed a commit to vectorize-io/langstream that referenced this pull request May 2, 2024

Enable test mode on API gateway (LangStream#389)

5b6f394

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Enable test mode on API gateway #389

Enable test mode on API gateway #389

nicoloboschi commented Sep 8, 2023 •

edited

Loading

eolivelli Sep 8, 2023

nicoloboschi Sep 8, 2023

eolivelli left a comment

eolivelli Sep 8, 2023

eolivelli Sep 8, 2023

eolivelli Sep 8, 2023

eolivelli Sep 8, 2023

eolivelli Sep 8, 2023

eolivelli Sep 8, 2023

eolivelli Sep 8, 2023

eolivelli Sep 8, 2023

eolivelli left a comment


		for (Map.Entry<String, String> entry : queryString.entrySet()) {
		if (entry.getKey().startsWith("admin-credentials-input-")) {

Enable test mode on API gateway #389

Enable test mode on API gateway #389

Conversation

nicoloboschi commented Sep 8, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

eolivelli left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

eolivelli left a comment

Choose a reason for hiding this comment

nicoloboschi commented Sep 8, 2023 •

edited

Loading