How to enable authentication token mode for http endpoint when using cloudformation

[enlinxu]

I want to set up http username and password for http endpoint access, using cli. Any suggestion? Is there a sample cloudformation template that I can refer?

What version of DC/OS + DC/OS CLI are you using (dcos --version)?

Enlins-MacBook-Pro:dcos Enlin$ dcos --version
dcoscli.version=0.4.10
dcos.version=1.8.4
dcos.commit=e64024af95b62c632c90b9063ed06296fcf38ea5
dcos.bootstrap-id=5b4aa43610c57ee1d60b4aa0751a1fb75824c083

What operating system and version are you using?

I am using DC/OS cloudformation

What did you do?

I am simply following the online instruction to set up the docs cluster. The cluster is up and running, but I want to enable the authentication token mode for http endpoint access.

What did you expect to see?

I want to set up http username and password for http endpoint access, using cli.

[tamarrow-zz]

@enlinxu: dcos auth login

[enlinxu]

Sorry, I didn't made myself clear. Once the dcos auth login is done, I tried to post a request to /acs/api/v1/auth/login in order to get the token, but I am getting:
{
"title": "Bad Request",
"description": "JWT parsing failed"
}

My request contains following in the body in json:
{
"uid":"{My username}",
"password":"{My password}"
}

[tamarrow-zz]

What are you trying to do? Once you run dcos auth login you will generate a token that will be stored in a config file. Afterwards all cli commands will use that token if they require authentication.

[enlinxu]

@tamarrow Thanks a lot for your quick responses.
I am trying to set up an enterprise ready Mesos DC/OS cluster on AWS, with http authentication enabled. So that my 3rd party tool can access the cluster using the DC/OS api, with the authentication.

According to https://docs.mesosphere.com/1.8/administration/id-and-access-mgt/iam-api/ , I just need to post a request to http://{cluster_url}/acs/api/v1/auth/login , with body:
{
"uid":"{Username}",
"password":"{Password}"
}

But I keep getting:
{
"title": "Bad Request",
"description": "JWT parsing failed"
}

I wonder if it's possible to do so. Thanks

[enlinxu]

I think I have set up the cluster correctly in terms of the cluster http endpoint authentication. If I do
curl http://{Cluster_IP}/mesos/master/state.json
I will get Unauthorized as response

But if I do curl --header "Authorization: token={token}" http://{Cluster_IP}/mesos/master/state.json
I can get the full response back.

But the only way to get the token is through dcos auth login and open the browser. Can I get the token from REST?

[tamarrow-zz]

You can get the token from the api that you mentioned above. I presume your curl command is invalid. Just verified this works:

using curl: curl -H "Content-Type: application/json" -X POST -d '{"uid":"uid/here", "password": "password/here"}' http://cluster/url/here/acs/api/v1/auth/login

using httpie: http POST http://cluster/url/here/acs/api/v1/auth/login uid="uid/here" password="password/here"

[tamarrow-zz]

@enlinxu closing issue. If you feel it's not resolved feel free to reopen

[ensonik]

I'm not sure this is a CLI issue, but still posting this here because I have the same problem as @enlinxu.

Essentially, the following: curl -H "Content-Type: applicatio/json" --data '{"uid":"a","password":"b"}' http://master.mesos/acs/api/v1/auth/login

Gives me a 400 Bad Request along with the following: {"title":"Bad Request","description":"JWT parsing failed"}

I need this to work to setup automated deployments through a CI server.

[andimitre]

Also having the same issue as @enlinxu

@ensonik were you able to get it to work?

[tamarrow-zz]

Are you running an open or enterprise cluster? This will only work for enterprise clusters.

[ensonik]

@tamarrow @andimitre That's what I figured out late in my investigation. We are running the OS version (1.7) and I only realized later that the documentation I found was on the enterprise version of your site (but no where to be found on the os version of it).

[andimitre]

@ensonik thanks for confirming!
@tamarrow open for now

[enlinxu]

Hi, @tamarrow I am installing my cluster based on https://dcos.io/docs/1.8/administration/installing/cloud/aws/

Is that an enterprise cluster?

[tamarrow-zz]

No, anything under "dcos.io" is open

[ghost]

Hi @enlinxu @tamarrow @ensonik,

I have the same problem. I'm trying run marathon-autoescale.py but I'm getting this:

This application tested with Python3 only
{'description': 'JWT parsing failed', 'title': 'Bad Request'}
Traceback (most recent call last):
File "marathon-autoscale.py", line 113, in
dcos_auth_token=dcos_auth_login(dcos_master,userid,password)
File "marathon-autoscale.py", line 89, in dcos_auth_login
auth_token=response['token']
KeyError: 'token'

How can I solve this? IT'S VERY IMPORTANT FOR ME!!!!!!!

THANK YOU

[ensonik]

@canmenev If you're running the Open Source version of dcos, it won't work. It's an enterprise feature.

[ghost]

@ensonik thank you very much! I would like to run marathon-autoescale.py in Open Source version, is there any other possible way to do it? THANK YOU!