Is it possible to use UaaClient with a standalone UAA app ?

[drennalls]

Is it possible to use the cf-java-client library to interface with a standalone UAA app ? It seems that the UAA endpoint is derived from the CF apiHost's token_endpoint, so all operations will be against the system UAA. I'm just wondering if there's some way to simply specify the UAA endpoint directly, or should I be using a different library for that ?

https://github.com/cloudfoundry-incubator/uaa-java-client doesn't seem to be active... and there's https://github.com/cloudfoundry/uaa/tree/master/client-lib but it's unclear whether it's fully supported or not.

[nebhale]

We don't really test for this, but you should be able to specify the UAA root URI directly:

ReactorUaaClient.builder()
    .connectionContext(connectionContext)
    .tokenProvider(tokenProvider)
    .root(Mono.just("https://my.other.uaa"))
    .build();

Let me know if this works for you, and if not let's see if we can work through the issues; this might be an interesting (if uncommon) use case for others.

/cc @sreetummidi

[DanielJonesEB]

@nebhale FWIW we've seen a few instances where independent UAAs have been deployed by Pivotal customers for use with BOSH and Concourse. @drennalls has a particularly valid use case in using the UAA to expose OAuth functionality to tenants on their CF, without those tenants being able to interfere with the system UAA.

[DanielJonesEB]

I've quickly tried the above, and the issue seems to be that one needs a ConnectionContext that must point to a CF, and between the ConnectionContext and TokenProvider the client is authenticating against the Cloud Foundry's UAA, which unsurprisingly gets a 401.

Is there any easy way of cutting the CF ConnectionContext out of the loop?

ConnectionContext connectionContext = DefaultConnectionContext.builder()
	.apiHost("api.system.somecf.io")
	.skipSslValidation(true)
	.build();
TokenProvider tokenProvider = PasswordGrantTokenProvider.builder()
	.username("marissa")
	.password("koala")
	.build();
ReactorUaaClient uaa = ReactorUaaClient.builder()
	.connectionContext(connectionContext)
	.root(Mono.just("myuaa.apps.somecf.io"))
	.tokenProvider(tokenProvider)
	.build();
ListUsersResponse response = uaa.users()
	.list(ListUsersRequest.builder().filter("username eq \"marissa\"").build()).block();

[DanielJonesEB]

Using a custom, dumb anonymous ConnectionContext that doesn't try and do anything with the CloudController.

ConnectionContext connectionContext = DefaultConnectionContext.builder()
	.apiHost("myuaa.apps.ant.dpsas.io")
	.skipSslValidation(true).build();

ConnectionContext custom = new ConnectionContext() {

	@Override
	public Mono<String> getRoot(String key) {
		return Mono.just("myuaa.apps.somecf.io");
	}

	@Override
	public Mono<String> getRoot() {
		return Mono.just("myuaa.apps.somecf.io");
	}

	@Override
	public ObjectMapper getObjectMapper() {
		return connectionContext.getObjectMapper();
	}

	@Override
	public HttpClient getHttpClient() {
		return connectionContext.getHttpClient();
	}
};

This seems to be able to get a token from the UAA I'm after, but I have insufficient permissions to list users. I'm guessing this is just the way the default marissa user is set up though.

[nebhale]

@DanielJonesEB The ConnectionContext actually serves a couple of different roles. First, it provides the network connections used for the request. Second, it’s used as the key for caching tokens between requests (TokenProviders can be shared between ConnectionContexts as ConnectionContexts can be shared between TokenProviders). The third is to provide the root URI to request tokens.

The first two requirements aren’t really negotiable (there will always need to be a ConnectionContext for them), but the last one is the problematic one and we can devise a strategy around it. I’ll look into creating a RootProvider interface that the ConnectionContext implements for most people (so a transparent change), but allowing you to configure as such:

TokenProvider tokenProvider = PasswordGrantTokenProvider.builder()
    .username("marissa")
    .password("koala")
    .rootProvider(endpoint -> Mono.just(“https://my.other.uaa”))
    .build();

[nebhale]

@drennalls and @DanielJonesEB OK, I think I've got it. There's now a RootProvider that is created by default in most cases, but you can override if you're connecting to a single server. You'll want to use the newly introduced SingleEndpointRootProvider:

public static void main(String[] args) throws InterruptedException {

    SingleEndpointRootProvider rootProvider = SingleEndpointRootProvider.builder()
        .apiHost("login.local.pcfdev.io")
        .build();

    ConnectionContext connectionContext = DefaultConnectionContext.builder()
        .rootProvider(rootProvider)
        .skipSslValidation(true)
        .build();

    TokenProvider tokenProvider = PasswordGrantTokenProvider.builder()
        .username("admin")
        .password("admin")
        .build();

    ReactorUaaClient uaaClient = ReactorUaaClient.builder()
        .connectionContext(connectionContext)
        .tokenProvider(tokenProvider)
        .build();

    CountDownLatch latch = new CountDownLatch(1);

    PaginationUtils
        .requestUaaResources(startIndex -> uaaClient.users()
            .list(ListUsersRequest.builder()
                .filter("username eq \"admin\"")
                .startIndex(startIndex)
                .build()))
        .subscribe(System.out::println, t -> {
            t.printStackTrace();
            latch.countDown();
        }, latch::countDown);

    latch.await();
}

Let me know how this works for you.

[drennalls]

Thanks @nebhale for digging into this. I'll give SingleEndpointRootProvider a try as soon as I'm able and report back