Failing to configure Graph Explorer authentication with Amazon Neptune using IAM

[rodrigofrs13]

Failing to configure Graph Explorer authentication with Amazon Neptune using IAM

I cannot successfully authenticate when I configure IAM, I configured it following the doc https://github.com/aws/graph-explorer/blob/main/README.md#authentication.

But when I test it I get the error "{"requestId":"12c4b54b-6aac-9c45-6511-47293baf8180","code":"AccessDeniedException","detailedMessage":"Missing Authentication Token"}"

Can you help please.

[triggan]

Where are you running Graph-Explorer? Is it on an EC2 instance? Have you created an IAM role with permissions to your Neptune cluster and attached that role to the compute infrastructure that is running Graph Explorer?

[rodrigofrs13]

I'm running EC2, my function has NeptuneFullAccess, when I run a test with awscurl from within EC2 it works correctly, but when I create the connection through the Graph Explorer UI I can't close the connection.
In the Graph Explorer UI, I filled in:

• Public or proxy endpoint
• Using Proxy-Server
• AWS IAM Auth enabled
• AWS Region

Print Works into EC2

Print error Graph Explorer UI

[triggan]

So for your connection settings, you should be using the following (with substitutions for your EC2 instance hostname and your Neptune cluster endpoint). Can you confirm this is what you are using?

Public or Proxy Endpoint: https://your-ec2-instance.region.ec2.amazonaws.com
Using Proxy-Server: checked
Graph Connection URL: https://your.neptune.endpoint.amazonaws.com:port
AWS IAM Auth Enabled: checked
AWS Region: whatever region your Neptune cluster is using (i.e. us-east-1)

[rodrigofrs13]

My original settings

After changes with your configuration

[triggan]

The Pubic or Proxy Endpoint should equal the same URL that you are using to connect to Graph Explorer. You appear to be using the internal (private IP address) EC2 instance hostname. Do you have separate connectivity established to your VPC (VPN tunnel or Direct Connect connection)? If not, that needs to be the public EC2 instance endpoint (but should ultimately be the same URL you are using to connect to Graph Explorer).

[rodrigofrs13]

Same error

I used VPC, Neptune, ECS with Graph Explorer and EC2 Windows Graph Explorer UI same VPC and subnets.

But before enabling IAM, I had configured Pubic or Proxy Endpoint with "neptune-endpount:port" and Graph Connect with "http://localhhost" and it was working.

But after enabling IAM, enabling IAM and Proxy flag didn't work anymore

[triggan]

I missed the point that you were running this from a Windows EC2 instance in the same VPC. So this makes sense now. Your settings look correct. Can you pull up developer tools in your browser and provide further details as to the errors that you are seeing (Network tab in dev tools)?

[rodrigofrs13]

There is a print. Let me remember this is works without IAM Authentication DB.

[rodrigofrs13]

Someone can help?

[michaelnchin]

Main branch currently has a bug with IAM request signing, related issue: #136

If you are following the installation steps here, please skip building your own Docker image in Steps 1-2, and modify the docker run command in Step 3 to replace graph-explorer with public.ecr.aws/neptune/graph-explorer:1.2.0; this will ensure that the stable base version of Graph Explorer v1.2.0 is installed.

[rodrigofrs13]

Tks @michaelnchin
The version 1.1.0 have the same problem?
On the one hand we used Graph Explorer with ECS in de version 1.2.0, with sabe problem.
One the other hand we try using step 3 with "docker run -p 80:80 -p 443:443 --env HOST={hostname-or-ip-address} public.ecr.aws/neptune/graph-explorer:1.2.0" but same problem.

[charlesivie]

This should be fixed as part of an upcoming pull request. #140

[rodrigofrs13]

Tks your awnser @charlesivie . Can you or would you be able to provide a forecast of when the PR will run?

[krlawrence]

The PR is now merged @rodrigofrs13