Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Question] 1.2.0 create graph in rest-api throws auth related permission #2500

Closed
1 task done
chenhong1990 opened this issue Apr 2, 2024 · 7 comments
Closed
1 task done
Labels
api Changes of API inactive question Further information is requested rocksdb RocksDB backend

Comments

@chenhong1990
Copy link

Bug Type (问题类型)

rest-api (结果不合预期)

Before submit

  • 我已经确认现有的 IssuesFAQ 中没有相同 / 重复问题 (I have confirmed and searched that there are no similar problems in the historical issue and documents)

Environment (环境信息)

  • Server Version: 1.2.0 (Apache Release Version)
  • Backend: RocksDB x nodes, HDD or SSD
  • OS: xx CPUs, xx G RAM, Ubuntu 2x.x / CentOS 7.x
  • Data Size: xx vertices, xx edges

Expected & Actual behavior (期望与实际表现)

curl --location 'http://172.30.96.162:8081/graphs/test'
--header 'Content-Type: text/plain'
--header 'Authorization: Basic YWRtaW46MTIzNDU2Nzg='
--data 'gremlin.graph=org.apache.hugegraph.auth.HugeFactoryAuthProxy
backend=rocksdb
serializer=binary
store=test
rocksdb.data_path=/data/hugegraph1.2.0/apache-hugegraph-incubating-1.2.0/data/test
rocksdb.wal_path=/data/hugegraph1.2.0/apache-hugegraph-incubating-1.2.0/wal/test'

根据api调用创建图报错如下:
2024-04-02 17:47:42 [db-open-1] [INFO] o.a.h.b.s.r.RocksDBStore - Opening RocksDB with data path: /data/hugegraph1.2.0/apache-hugegraph-incubating-1.2.0/data/test/s
2024-04-02 17:47:42 [db-open-1] [INFO] o.a.h.b.s.r.RocksDBStore - Opening RocksDB with data path: /data/hugegraph1.2.0/apache-hugegraph-incubating-1.2.0/data/test/g
2024-04-02 17:47:42 [grizzly-http-server-8] [INFO] o.a.h.b.s.r.RocksDBStore - Write down the backend version: 1.11
2024-04-02 17:47:43 [grizzly-http-server-8] [ERROR] o.a.h.c.GraphManager - Failed to create graph 'test' due to: Failed to update/query TaskStore: java.util.concurrent.ExecutionException: java.lang.IllegalStateException: Missing authentication context when verifying resource permission
org.apache.hugegraph.HugeException: Failed to update/query TaskStore: java.util.concurrent.ExecutionException: java.lang.IllegalStateException: Missing authentication context when verifying resource permission
at org.apache.hugegraph.task.StandardTaskScheduler.call(StandardTaskScheduler.java:717) ~[hugegraph-core-1.2.0.jar:1.2.0]
at org.apache.hugegraph.task.StandardTaskScheduler.call(StandardTaskScheduler.java:704) ~[hugegraph-core-1.2.0.jar:1.2.0]
at org.apache.hugegraph.task.StandardTaskScheduler.init(StandardTaskScheduler.java:464) ~[hugegraph-core-1.2.0.jar:1.2.0]
at org.apache.hugegraph.StandardHugeGraph.initSystemInfo(StandardHugeGraph.java:415) ~[hugegraph-core-1.2.0.jar:1.2.0]
at org.apache.hugegraph.StandardHugeGraph.initBackend(StandardHugeGraph.java:364) ~[hugegraph-core-1.2.0.jar:1.2.0]
at org.apache.hugegraph.StandardHugeGraph.create(StandardHugeGraph.java:979) ~[hugegraph-core-1.2.0.jar:1.2.0]
at org.apache.hugegraph.auth.HugeGraphAuthProxy.create(HugeGraphAuthProxy.java:781) ~[hugegraph-api-1.2.0.jar:1.2.0]
at org.apache.hugegraph.core.GraphManager.createGraph(GraphManager.java:586) ~[hugegraph-api-1.2.0.jar:0.71.0.0]
at org.apache.hugegraph.core.GraphManager.createGraph(GraphManager.java:186) ~[hugegraph-api-1.2.0.jar:0.71.0.0]
at org.apache.hugegraph.api.profile.GraphsAPI.create(GraphsAPI.java:136) ~[hugegraph-api-1.2.0.jar:0.71.0.0]
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_202]
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_202]
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_202]
at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_202]
at org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory.lambda$static$0(ResourceMethodInvocationHandlerFactory.java:52) ~[jersey-server-3.0.3.jar:?]
at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:124) ~[jersey-server-3.0.3.jar:?]
at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:167) ~[jersey-server-3.0.3.jar:?]
at org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$ObjectOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:192) ~[jersey-server-3.0.3.jar:?]
at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:79) ~[jersey-server-3.0.3.jar:?]
at org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:475) ~[jersey-server-3.0.3.jar:?]
at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:397) ~[jersey-server-3.0.3.jar:?]
at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:81) ~[jersey-server-3.0.3.jar:?]

Vertex/Edge example (问题点 / 边数据举例)

No response

Schema [VertexLabel, EdgeLabel, IndexLabel] (元数据结构)

No response

@chenhong1990 chenhong1990 added the bug Something isn't working label Apr 2, 2024
Copy link

dosubot bot commented Apr 2, 2024

Hey @chenhong1990, great to see you back here! Hope everything else has been going smoothly for you.

Based on the error message you provided, it seems like the request to create the graph is not being correctly authenticated, possibly due to the credentials not being correctly applied to the request.

To resolve this issue, you need to ensure that your application is correctly using the OkHttpBasicAuthInterceptor to inject the authentication credentials into every request made to the HugeGraph server. Here's a checklist to troubleshoot and resolve the issue:

  1. Ensure Interceptor is Added: Make sure that the OkHttpBasicAuthInterceptor is properly added to your OkHttpClient instance. This is crucial for the interceptor to be invoked for every request.
OkHttpClient client = new OkHttpClient.Builder()
    .addInterceptor(new OkHttpBasicAuthInterceptor("your_username", "your_password"))
    .build();
  1. Correct Credentials: Double-check that the username and password provided to the OkHttpBasicAuthInterceptor constructor are correct and have the necessary permissions to create a graph in HugeGraph.

  2. Use Latest Client Libraries: Ensure you are using a compatible version of the OkHttpClient library that works well with your version of HugeGraph. Incompatibilities between library versions can sometimes lead to unexpected behavior.

  3. Review Server Configuration: On the server side, ensure that HugeGraph is correctly configured to require and validate basic authentication for API requests. Check the HugeGraph server's configuration files and logs for any indications of misconfiguration or errors related to authentication.

  4. Inspect Request and Response: Use a tool like Wireshark or the logging capabilities of OkHttpClient to inspect the outgoing request and ensure that the Authorization header is correctly included and that the server's response does not indicate any other underlying issues.

You can find more details about the OkHttpBasicAuthInterceptor and its role in the authentication process in the source code.

If after following these steps the issue persists, it may be beneficial to consult the HugeGraph documentation or reach out to the HugeGraph community for further assistance, as there might be version-specific nuances or bugs affecting authentication.

Sources

About Dosu

This response is meant to be useful and save you time. It is not meant to be a precise solution, but rather a starting point for your own research.

Help me be more useful! Please leave a 👍 if this is helpful and 👎 if it is irrelevant.

If you want to continue the conversation, start your reply with @dosu-bot.

@dosubot dosubot bot added api Changes of API rocksdb RocksDB backend labels Apr 2, 2024
@imbajin
Copy link
Member

imbajin commented Apr 2, 2024

@dosu-bot nope, u get the wrong context, this should have nothing to do with OKHTTP

You should let the user try to access the creation without setting permissions first, check if it is OK, then gradually narrow down the scope of the problem and have the user test it in a clean environment/container environment.

If it can be easily replicated, provide the steps for replication so that it is convenient to confirm the problem

refer:

  1. https://hugegraph.apache.org/docs/clients/restful-api/graphs/#615-create-graphthis-operation-requires-administrator-privileges

Copy link

dosubot bot commented Apr 2, 2024

Apologies for the confusion earlier, and thank you for your patience, @chenhong1990.

Based on the further guidance provided, it seems the issue might not be related to the client-side authentication setup as initially suggested. Instead, we should approach this problem by first ensuring that the issue isn't related to permission settings or environment-specific configurations.

Here's a step-by-step guide to help you troubleshoot and hopefully resolve the issue:

  1. Access Without Setting Permissions: Try to access the creation of the graph without setting any permissions first. This step is to ensure that the basic functionality (creating a graph) works without the added complexity of permissions. If this works, it indicates that the issue is likely related to permission settings.

  2. Narrow Down the Scope: If the graph creation works without permissions, gradually reintroduce permissions to narrow down the specific setting or configuration causing the issue. This incremental approach helps identify the exact cause.

  3. Test in a Clean/Container Environment: If possible, replicate the issue in a clean environment or a container (e.g., Docker). This can help determine if the issue is environment-specific. A clean environment ensures that no previous configurations or data interfere with the process.

  4. Provide Replication Steps: If the issue can be easily replicated, especially in a clean or container environment, please provide the steps you took to replicate the problem. This information is invaluable for diagnosing the issue more effectively and can help in identifying whether it's a bug or a misconfiguration.

By following these steps, we aim to isolate the problem and identify whether it's related to permissions, environment configurations, or perhaps something else. Your cooperation and detailed feedback at each step will be crucial in resolving this issue.

If you encounter any specific errors or behaviors at any step, please share them. This information will be critical in understanding what's going wrong and how we can help you fix it.

Thank you for working with us on this, and we look forward to getting to the bottom of this issue together.

About Dosu

This response is meant to be useful and save you time. It is not meant to be a precise solution, but rather a starting point for your own research.

Help me be more useful! Please leave a 👍 if this is helpful and 👎 if it is irrelevant.

If you want to continue the conversation, start your reply with @dosu-bot.

@imbajin imbajin changed the title hugegraph1.2.0在调用创建图的时候报没有权限,实际是我已经输入用户名和密码 [Question] 1.2.0 create graph in rest-api throws auth related permission Apr 2, 2024
@imbajin imbajin added question Further information is requested and removed bug Something isn't working labels Apr 2, 2024
Copy link

Due to the lack of activity, the current issue is marked as stale and will be closed after 20 days, any update will remove the stale label

@Github-Polaris
Copy link

Github-Polaris commented Apr 23, 2024

@dosu-bot

I got the same problem and here is my situation. I did not config any information in rest-server.properties such as auth.authenticator, so in theory authentication should be not working or there is an default value to auth.authenticator?

# authentication configs
# choose 'org.apache.hugegraph.auth.StandardAuthenticator' or
# 'org.apache.hugegraph.auth.ConfigAuthenticator'
#auth.authenticator=

This is the code in GraphsAPI

   @POST
    @Timed
    @Path("{name}")
    @Consumes(TEXT_PLAIN)
    @Produces(APPLICATION_JSON_WITH_CHARSET)
    @RolesAllowed({"admin"}) // The entry point for problem, maybe.
    public Object create(@Context GraphManager manager,
                         @PathParam("name") String name,
                         @QueryParam("clone_graph_name") String clone,
                         String configText) {
        LOG.debug("Create graph '{}' with clone graph '{}', config text '{}'",
                  name, clone, configText);
        HugeGraph graph;
        if (StringUtils.isNotEmpty(clone)) {
            graph = manager.cloneGraph(clone, name, configText);
        } else {
            graph = manager.createGraph(name, configText);
        }
        return ImmutableMap.of("name", graph.name(),
                               "backend", graph.backend());
    }

Please tell me how to close the authentication or how to write the right code corresponding @RolesAllowed({"admin"})

@JackyYangPassion
Copy link
Contributor

JackyYangPassion commented Apr 24, 2024

dynamic create graph you can use this body close the authentication

gremlin.graph=org.apache.hugegraph.HugeFactory
vertex.cache_type=l2
edge.cache_type=l2
backend=rocksdb
serializer=binary
store=test
rocksdb.data_path=/hugegraph-server/data/test/data
rocksdb.wal_path=/hugegraph-server/data/test/wal

ref #2418

Copy link

github-actions bot commented May 9, 2024

Due to the lack of activity, the current issue is marked as stale and will be closed after 20 days, any update will remove the stale label

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
api Changes of API inactive question Further information is requested rocksdb RocksDB backend
Projects
None yet
Development

No branches or pull requests

4 participants