Insufficient Permission error for new confirmationBase API call

[Sourabh-ALTEN]

Hello,

I am currently testing the new DDI API call GET /{tenant}/controller/v1/{controllerid}/confirmationBase in 0.3.0M8 release. But, I am getting an error: "errorCode": "hawkbit.server.error.insufficientpermission"

curl --location --request GET 'https://hawkbit.xxx.com/DEFAULT/controller/v1/0x11112222/confirmationBase' \
--header 'Accept: application/hal+json' \
--header 'Authorization: TargetToken xxxx'

But the response is:'

403 forbidden
{
    "exceptionClass": "org.eclipse.hawkbit.repository.exception.InsufficientPermissionException",
    "errorCode": "hawkbit.server.error.insufficientpermission",
    "message": "Insufficient Permission"
}

However, other calls like GET /{tenant}/controller/v1/{controllerid}/confirmationBase/{actionId} and POST /{tenant}/controller/v1/{controllerid}/confirmationBase/{actionId}/feedback are working as expected (same header is used)

Can anyone please let me know what am I missing?

Thanks in advance

P.S: Testing using Postman. Also, enabled "Request confirmation for actions before proceeding with download/install process." option in hawkBit UI under System Config.

[strailov]

Hey @Sourabh-ALTEN
Thanks for posting this issue!

Not sure what could be wrong here ...
One option for you in order this to work is to try with GatewayToken and see if it works this way.
Also you could provide some additional logs if you enable debug mode in order to see what is going on.

[Sourabh-ALTEN]

Hello @strailov thanks for the update. Currently our server accepts only TargetToken. I cannot change this configuration

Also you could provide some additional logs if you enable debug mode in order to see what is going on.

How do I enable debug mode?

Thank you
Sourabh

[strailov]

Hawkbit is a Spring based application, so you can add logging.level.logger_name=DEBUG in application.properties file

[Delete-S]

@strailov I chane log level to bedug .Also I've the same trouble.

here is the log ,

2023-10-16 15:06:09 2023-10-16 07:06:09.594 DEBUG 1 --- [nio-8080-exec-7] o.e.h.d.rest.resource.DdiRootController  : getConfirmationBase is called [controllerId=targetClaude].
2023-10-16 15:06:09 2023-10-16 07:06:09.594 DEBUG 1 --- [nio-8080-exec-7] o.s.retry.support.RetryTemplate          : Retry: count=0
2023-10-16 15:06:09 2023-10-16 07:06:09.594 DEBUG 1 --- [nio-8080-exec-7] h.r.j.c.MultiTenantJpaTransactionManager : Found thread-bound EntityManager [org.eclipse.persistence.internal.jpa.EntityManagerImpl@58e8095a] for JPA transaction
2023-10-16 15:06:09 2023-10-16 07:06:09.594 DEBUG 1 --- [nio-8080-exec-7] h.r.j.c.MultiTenantJpaTransactionManager : Creating new transaction with name [org.eclipse.hawkbit.repository.jpa.JpaControllerManagement.findOrRegisterTargetIfItDoesNotExist]: PROPAGATION_REQUIRED,ISOLATION_READ_COMMITTED
2023-10-16 15:06:09 2023-10-16 07:06:09.595 DEBUG 1 --- [nio-8080-exec-7] h.r.j.c.MultiTenantJpaTransactionManager : Exposing JPA transaction as JDBC [org.springframework.orm.jpa.vendor.EclipseLinkJpaDialect$EclipseLinkConnectionHandle@1e41e932]
2023-10-16 15:06:09 2023-10-16 07:06:09.595 DEBUG 1 --- [nio-8080-exec-7] o.s.s.a.i.a.MethodSecurityInterceptor    : Authorized ReflectiveMethodInvocation: public org.eclipse.hawkbit.repository.model.Target org.eclipse.hawkbit.repository.jpa.JpaControllerManagement.findOrRegisterTargetIfItDoesNotExist(java.lang.String,java.net.URI); target is of class [org.eclipse.hawkbit.repository.jpa.JpaControllerManagement] with attributes [[authorize: 'hasAnyRole('ROLE_CONTROLLER_ANONYMOUS', 'ROLE_CONTROLLER')', filter: 'null', filterTarget: 'null']]
2023-10-16 15:06:09 2023-10-16 07:06:09.596 DEBUG 1 --- [nio-8080-exec-7] h.r.j.c.MultiTenantJpaTransactionManager : Found thread-bound EntityManager [org.eclipse.persistence.internal.jpa.EntityManagerImpl@58e8095a] for JPA transaction
2023-10-16 15:06:09 2023-10-16 07:06:09.596 DEBUG 1 --- [nio-8080-exec-7] h.r.j.c.MultiTenantJpaTransactionManager : Participating in existing transaction
2023-10-16 15:06:09 2023-10-16 07:06:09.598 DEBUG 1 --- [nio-8080-exec-7] h.r.j.c.MultiTenantJpaTransactionManager : Initiating transaction commit
2023-10-16 15:06:09 2023-10-16 07:06:09.598 DEBUG 1 --- [nio-8080-exec-7] h.r.j.c.MultiTenantJpaTransactionManager : Committing JPA transaction on EntityManager [org.eclipse.persistence.internal.jpa.EntityManagerImpl@58e8095a]
2023-10-16 15:06:09 2023-10-16 07:06:09.599 DEBUG 1 --- [nio-8080-exec-7] com.zaxxer.hikari.pool.PoolBase          : HikariPool-1 - Reset (isolation) on connection org.mariadb.jdbc.MariaDbConnection@659925f4
2023-10-16 15:06:09 2023-10-16 07:06:09.599 DEBUG 1 --- [nio-8080-exec-7] h.r.j.c.MultiTenantJpaTransactionManager : Not closing pre-bound JPA EntityManager after transaction
2023-10-16 15:06:09 2023-10-16 07:06:09.599 DEBUG 1 --- [nio-8080-exec-7] h.r.j.c.MultiTenantJpaTransactionManager : Found thread-bound EntityManager [org.eclipse.persistence.internal.jpa.EntityManagerImpl@58e8095a] for JPA transaction
2023-10-16 15:06:09 2023-10-16 07:06:09.599 DEBUG 1 --- [nio-8080-exec-7] h.r.j.c.MultiTenantJpaTransactionManager : Creating new transaction with name [org.eclipse.hawkbit.repository.jpa.JpaControllerManagement.findActiveActionWithHighestWeight]: PROPAGATION_REQUIRED,ISOLATION_DEFAULT,readOnly
2023-10-16 15:06:09 2023-10-16 07:06:09.599 DEBUG 1 --- [nio-8080-exec-7] h.r.j.c.MultiTenantJpaTransactionManager : Exposing JPA transaction as JDBC [org.springframework.orm.jpa.vendor.EclipseLinkJpaDialect$EclipseLinkConnectionHandle@232adbe8]
2023-10-16 15:06:09 2023-10-16 07:06:09.600 DEBUG 1 --- [nio-8080-exec-7] o.s.s.a.i.a.MethodSecurityInterceptor    : Authorized ReflectiveMethodInvocation: public java.util.Optional org.eclipse.hawkbit.repository.jpa.JpaControllerManagement.findActiveActionWithHighestWeight(java.lang.String); target is of class [org.eclipse.hawkbit.repository.jpa.JpaControllerManagement] with attributes [[authorize: 'hasAnyRole('ROLE_CONTROLLER_ANONYMOUS', 'ROLE_CONTROLLER')', filter: 'null', filterTarget: 'null']]
2023-10-16 15:06:09 2023-10-16 07:06:09.600 DEBUG 1 --- [nio-8080-exec-7] h.r.j.c.MultiTenantJpaTransactionManager : Found thread-bound EntityManager [org.eclipse.persistence.internal.jpa.EntityManagerImpl@58e8095a] for JPA transaction
2023-10-16 15:06:09 2023-10-16 07:06:09.600 DEBUG 1 --- [nio-8080-exec-7] h.r.j.c.MultiTenantJpaTransactionManager : Participating in existing transaction
2023-10-16 15:06:09 2023-10-16 07:06:09.602 DEBUG 1 --- [nio-8080-exec-7] h.r.j.c.MultiTenantJpaTransactionManager : Found thread-bound EntityManager [org.eclipse.persistence.internal.jpa.EntityManagerImpl@58e8095a] for JPA transaction
2023-10-16 15:06:09 2023-10-16 07:06:09.602 DEBUG 1 --- [nio-8080-exec-7] h.r.j.c.MultiTenantJpaTransactionManager : Participating in existing transaction
2023-10-16 15:06:09 2023-10-16 07:06:09.606 DEBUG 1 --- [nio-8080-exec-7] h.r.j.c.MultiTenantJpaTransactionManager : Found thread-bound EntityManager [org.eclipse.persistence.internal.jpa.EntityManagerImpl@58e8095a] for JPA transaction
2023-10-16 15:06:09 2023-10-16 07:06:09.606 DEBUG 1 --- [nio-8080-exec-7] h.r.j.c.MultiTenantJpaTransactionManager : Participating in existing transaction
2023-10-16 15:06:09 2023-10-16 07:06:09.615 DEBUG 1 --- [nio-8080-exec-7] h.r.j.c.MultiTenantJpaTransactionManager : Initiating transaction commit
2023-10-16 15:06:09 2023-10-16 07:06:09.615 DEBUG 1 --- [nio-8080-exec-7] h.r.j.c.MultiTenantJpaTransactionManager : Committing JPA transaction on EntityManager [org.eclipse.persistence.internal.jpa.EntityManagerImpl@58e8095a]
2023-10-16 15:06:09 2023-10-16 07:06:09.615 DEBUG 1 --- [nio-8080-exec-7] h.r.j.c.MultiTenantJpaTransactionManager : Not closing pre-bound JPA EntityManager after transaction
2023-10-16 15:06:09 2023-10-16 07:06:09.616 DEBUG 1 --- [nio-8080-exec-7] h.r.j.c.MultiTenantJpaTransactionManager : Found thread-bound EntityManager [org.eclipse.persistence.internal.jpa.EntityManagerImpl@58e8095a] for JPA transaction
2023-10-16 15:06:09 2023-10-16 07:06:09.616 DEBUG 1 --- [nio-8080-exec-7] h.r.j.c.MultiTenantJpaTransactionManager : Creating new transaction with name [org.eclipse.hawkbit.repository.jpa.JpaConfirmationManagement.getStatus]: PROPAGATION_REQUIRED,ISOLATION_DEFAULT,readOnly
2023-10-16 15:06:09 2023-10-16 07:06:09.616 DEBUG 1 --- [nio-8080-exec-7] h.r.j.c.MultiTenantJpaTransactionManager : Exposing JPA transaction as JDBC [org.springframework.orm.jpa.vendor.EclipseLinkJpaDialect$EclipseLinkConnectionHandle@44406994]
2023-10-16 15:06:09 2023-10-16 07:06:09.616 DEBUG 1 --- [nio-8080-exec-7] o.s.s.a.i.a.MethodSecurityInterceptor    : Failed to authorize ReflectiveMethodInvocation: public java.util.Optional org.eclipse.hawkbit.repository.jpa.JpaConfirmationManagement.getStatus(java.lang.String); target is of class [org.eclipse.hawkbit.repository.jpa.JpaConfirmationManagement] with attributes [[authorize: 'hasAuthority('READ_TARGET') or hasAuthority('ROLE_SYSTEM_CODE')', filter: 'null', filterTarget: 'null']]
2023-10-16 15:06:09 2023-10-16 07:06:09.617 DEBUG 1 --- [nio-8080-exec-7] h.r.j.c.MultiTenantJpaTransactionManager : Initiating transaction rollback
2023-10-16 15:06:09 2023-10-16 07:06:09.617 DEBUG 1 --- [nio-8080-exec-7] h.r.j.c.MultiTenantJpaTransactionManager : Rolling back JPA transaction on EntityManager [org.eclipse.persistence.internal.jpa.EntityManagerImpl@58e8095a]
2023-10-16 15:06:09 2023-10-16 07:06:09.617 DEBUG 1 --- [nio-8080-exec-7] h.r.j.c.MultiTenantJpaTransactionManager : Not closing pre-bound JPA EntityManager after transaction
2023-10-16 15:06:09 2023-10-16 07:06:09.618 DEBUG 1 --- [nio-8080-exec-7] .m.m.a.ExceptionHandlerExceptionResolver : Using @ExceptionHandler org.eclipse.hawkbit.rest.exception.ResponseExceptionHandler#handleSpServerRtExceptions(HttpServletRequest, Exception)
2023-10-16 15:06:09 2023-10-16 07:06:09.618 DEBUG 1 --- [nio-8080-exec-7] o.e.h.r.e.ResponseExceptionHandler       : Handling exception org.eclipse.hawkbit.repository.exception.InsufficientPermissionException of request http://localhost:8080/DEFAULT/controller/v1/targetClaude/confirmationBase
2023-10-16 15:06:09 2023-10-16 07:06:09.619 DEBUG 1 --- [nio-8080-exec-7] o.s.w.s.m.m.a.HttpEntityMethodProcessor  : Using 'application/json', given [application/json] and supported [application/json, application/*+json, application/json, application/*+json, application/cbor]
2023-10-16 15:06:09 2023-10-16 07:06:09.619 DEBUG 1 --- [nio-8080-exec-7] o.s.w.s.m.m.a.HttpEntityMethodProcessor  : Writing [org.eclipse.hawkbit.rest.json.model.ExceptionInfo@54ba9ce6]
2023-10-16 15:06:09 2023-10-16 07:06:09.620 DEBUG 1 --- [nio-8080-exec-7] .m.m.a.ExceptionHandlerExceptionResolver : Resolved [org.eclipse.hawkbit.repository.exception.InsufficientPermissionException: Insufficient Permission]
2023-10-16 15:06:09 2023-10-16 07:06:09.621 DEBUG 1 --- [nio-8080-exec-7] o.j.s.OpenEntityManagerInViewInterceptor : Closing JPA EntityManager in OpenEntityManagerInViewInterceptor
2023-10-16 15:06:09 2023-10-16 07:06:09.621 DEBUG 1 --- [nio-8080-exec-7] o.s.web.servlet.DispatcherServlet        : Completed 403 FORBIDDEN
2023-10-16 15:06:09 2023-10-16 07:06:09.622 DEBUG 1 --- [nio-8080-exec-7] s.s.w.c.SecurityContextPersistenceFilter : Cleared SecurityContextHolder to complete request
2023-10-16 15:06:09 2023-10-16 07:06:09.622 DEBUG 1 --- [nio-8080-exec-7] o.a.coyote.http11.Http11InputBuffer      : Before fill(): parsingHeader: [true], parsingRequestLine: [true], parsingRequestLinePhase: [0], parsingRequestLineStart: [0], byteBuffer.position(): [0], byteBuffer.limit(): [0], end: [352]
2023-10-16 15:06:09 2023-10-16 07:06:09.623 DEBUG 1 --- [nio-8080-exec-7] o.a.tomcat.util.net.SocketWrapperBase    : Socket: [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@38eb2b8:org.apache.tomcat.util.net.NioChannel@3e711cde:java.nio.channels.SocketChannel[connected local=/172.18.0.2:8080 remote=/172.18.0.1:55158]], Read from buffer: [0]
2023-10-16 15:06:09 2023-10-16 07:06:09.623 DEBUG 1 --- [nio-8080-exec-7] org.apache.tomcat.util.net.NioEndpoint   : Socket: [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@38eb2b8:org.apache.tomcat.util.net.NioChannel@3e711cde:java.nio.channels.SocketChannel[connected local=/172.18.0.2:8080 remote=/172.18.0.1:55158]], Read direct from socket: [0]
2023-10-16 15:06:09 2023-10-16 07:06:09.623 DEBUG 1 --- [nio-8080-exec-7] o.a.coyote.http11.Http11InputBuffer      : Received []
2023-10-16 15:06:09 2023-10-16 07:06:09.623 DEBUG 1 --- [nio-8080-exec-7] o.apache.coyote.http11.Http11Processor   : Socket: [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@38eb2b8:org.apache.tomcat.util.net.NioChannel@3e711cde:java.nio.channels.SocketChannel[connected local=/172.18.0.2:8080 remote=/172.18.0.1:55158]], Status in: [OPEN_READ], State out: [OPEN]
2023-10-16 15:06:09 2023-10-16 07:06:09.623 DEBUG 1 --- [nio-8080-exec-7] org.apache.tomcat.util.net.NioEndpoint   : Registered read interest for [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@38eb2b8:org.apache.tomcat.util.net.NioChannel@3e711cde:java.nio.channels.SocketChannel[connected local=/172.18.0.2:8080 remote=/172.18.0.1:55158]]
2023-10-16 15:06:10 2023-10-16 07:06:10.476 DEBUG 1 --- [nio-8080-exec-1] o.a.coyote.http11.Http11InputBuffer      : Before fill(): parsingHeader: [true], parsingRequestLine: [true], parsingRequestLinePhase: [0], parsingRequestLineStart: [0], byteBuffer.position(): [0], byteBuffer.limit(): [0], end: [352]
2023-10-16 15:06:10 2023-10-16 07:06:10.476 DEBUG 1 --- [nio-8080-exec-1] o.a.tomcat.util.net.SocketWrapperBase    : Socket: [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@38eb2b8:org.apache.tomcat.util.net.NioChannel@3e711cde:java.nio.channels.SocketChannel[connected local=/172.18.0.2:8080 remote=/172.18.0.1:55158]], Read from buffer: [0]
2023-10-16 15:06:10 2023-10-16 07:06:10.476 DEBUG 1 --- [nio-8080-exec-1] org.apache.tomcat.util.net.NioEndpoint   : Socket: [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@38eb2b8:org.apache.tomcat.util.net.NioChannel@3e711cde:java.nio.channels.SocketChannel[connected local=/172.18.0.2:8080 remote=/172.18.0.1:55158]], Read direct from socket: [352]
2023-10-16 15:06:10 2023-10-16 07:06:10.476 DEBUG 1 --- [nio-8080-exec-1] o.a.coyote.http11.Http11InputBuffer      : Received [GET /DEFAULT/controller/v1/targetClaude/confirmationBase HTTP/1.1
2023-10-16 15:06:10 Accept: application/json
2023-10-16 15:06:10 Authorization: GatewayToken a11a5d87cc80d06d9811bc17ca76e7b0
2023-10-16 15:06:10 User-Agent: PostmanRuntime/7.33.0
2023-10-16 15:06:10 Cache-Control: no-cache
2023-10-16 15:06:10 Postman-Token: eb15a38a-ae7d-4d67-9ede-2df04ede28bc
2023-10-16 15:06:10 Host: localhost:8080
2023-10-16 15:06:10 Accept-Encoding: gzip, deflate, br
2023-10-16 15:06:10 Connection: keep-alive
2023-10-16 15:06:10 
2023-10-16 15:06:10 ]
2023-10-16 15:06:10 2023-10-16 07:06:10.476 DEBUG 1 --- [nio-8080-exec-1] o.a.c.authenticator.AuthenticatorBase    : Security checking request GET /DEFAULT/controller/v1/targetClaude/confirmationBase
2023-10-16 15:06:10 2023-10-16 07:06:10.476 DEBUG 1 --- [nio-8080-exec-1] org.apache.catalina.realm.RealmBase      :   No applicable constraints defined
2023-10-16 15:06:10 2023-10-16 07:06:10.476 DEBUG 1 --- [nio-8080-exec-1] o.a.c.authenticator.AuthenticatorBase    : Not subject to any constraint
2023-10-16 15:06:10 2023-10-16 07:06:10.477 DEBUG 1 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy        : Securing GET /DEFAULT/controller/v1/targetClaude/confirmationBase
2023-10-16 15:06:10 2023-10-16 07:06:10.477 DEBUG 1 --- [nio-8080-exec-1] s.s.w.c.SecurityContextPersistenceFilter : Set SecurityContextHolder to empty SecurityContext
2023-10-16 15:06:10 2023-10-16 07:06:10.477 DEBUG 1 --- [nio-8080-exec-1] stractHttpControllerAuthenticationFilter : retrieving principal from URI request /DEFAULT/controller/v1/targetClaude/confirmationBase
2023-10-16 15:06:10 2023-10-16 07:06:10.477 DEBUG 1 --- [nio-8080-exec-1] o.e.h.security.SystemSecurityContext     : entering system code execution
2023-10-16 15:06:10 2023-10-16 07:06:10.477 DEBUG 1 --- [nio-8080-exec-1] o.e.h.security.SystemSecurityContext     : leaving system code execution
2023-10-16 15:06:10 2023-10-16 07:06:10.477 DEBUG 1 --- [nio-8080-exec-1] stractHttpControllerAuthenticationFilter : retrieving principal from URI request /DEFAULT/controller/v1/targetClaude/confirmationBase
2023-10-16 15:06:10 2023-10-16 07:06:10.478 DEBUG 1 --- [nio-8080-exec-1] o.e.h.security.SystemSecurityContext     : entering system code execution
2023-10-16 15:06:10 2023-10-16 07:06:10.478 DEBUG 1 --- [nio-8080-exec-1] o.e.h.security.SystemSecurityContext     : leaving system code execution
2023-10-16 15:06:10 2023-10-16 07:06:10.478 DEBUG 1 --- [nio-8080-exec-1] rollerPreAuthenticateSecurityTokenFilter : Authenticating null
2023-10-16 15:06:10 2023-10-16 07:06:10.478 DEBUG 1 --- [nio-8080-exec-1] stractHttpControllerAuthenticationFilter : retrieving principal from URI request /DEFAULT/controller/v1/targetClaude/confirmationBase
2023-10-16 15:06:10 2023-10-16 07:06:10.478 DEBUG 1 --- [nio-8080-exec-1] rollerPreAuthenticateSecurityTokenFilter : security token filter is enabled but requst does not

chatgpt answer me , the problem is here , but I cant find how to change it.
2023-10-16 15:06:09 2023-10-16 07:06:09.618 DEBUG 1 --- [nio-8080-exec-7] o.s.s.a.i.a.MethodSecurityInterceptor : Failed to authorize ReflectiveMethodInvocation: public java.util.Optional org.eclipse.hawkbit.repository.jpa.JpaConfirmationManagement.getStatus(java.lang.String); target is of class [org.eclipse.hawkbit.repository.jpa.JpaConfirmationManagement] with attributes [[authorize: 'hasAuthority('READ_TARGET') or hasAuthority('ROLE_SYSTEM_CODE')', filter: 'null', filterTarget: 'null']]

[avgustinmm]

#1360 shall fix the problem.