(DOC) REST API authentication to a WCS cluster

[eostis]

Hi,

I'm trying to connect to an authentication enabled WCS cluster, with the REST API (for WooCommerce owners who want to use WCS hosting rather than installing Weaviate).

Could you point me to the documentation ?
I received a 404 link after the cluster was created https://www.semi.technology/developers/weaviate/v1.8.0/configuration/authentication

I noticed the Enterprise token, but I do not think it is what I need.
https://www.semi.technology/developers/weaviate/current/configuration/authentication.html is only about self setup I suspect.

[eostis]

@bobvanluijt Any idea?

[bobvanluijt]

Hi @eostis – in principle all the clients should work. Could it be the case that the 404 happens because of the creation of the instance? I.e., it takes some time to complete.

Is this something you or somebody in your team recognizes @michaverhagen?

PS:
The enterprise token is set automatically for WCS users

PPS:
The WCS is still in beta. Depending on the module you choose there might not be the desired GPU support (yet)

[eostis]

WCS is working. But I want to protect it with a token. How can I generate a token for a WCS cluster?

[bobvanluijt]

Ooo – gotcha – @michaverhagen can you / your team help with the above question?

[michaverhagen]

I will ask someone to look into this

[StefanBogdan]

Hi @eostis , do you use one of our client libraries, or you do it with curl?

In python all you need is the instance URL, which is https://WCS_CLUSTER_NAME.semi.technology and your credentials, then you can connect to the instance like this:

from weaviate import Client, AuthClientPassword

credentials = weaviate.AuthClientPassword(
    username='WCS_EMAIL',
    password='WCS_PASSWORD'
)

weaviate_client = Client(
    url='https://WCS_CLUSTER_NAME.semi.technology',
    auth_client_secret=credentials,
)

Now there is a workaround to get the Bearer token, it can be done like this (ONLY IF NEEDED):

print(weaviate_client._connection._auth_bearer)

NOTE: The token has a lifespan of 15 mins.

[eostis]

Hi @StefanBogdan Thanks for the help !

I tested with 2 clusters:

• The OIDC enabled cluster indeed required a token, which I could find by inspecting the console Ajax queries. But it lasted a few minutes only as you mentioned.
• The OIDC disabled cluster did not required an OIDC, neither a user/password ! (no auth required)

Conclusion: I'm back to square one !

[bobvanluijt]

Quick question @eostis, you said: "back to square one" I'm not sure I understand, you are now able to connect, no?

[eostis]

I can connect, but only unauthenticated.

WCS uses OIDC authentication (with a token I do not know how to generate), or no authentication (user/pwd is not necessary)

[StefanBogdan]

WCS uses OIDC authentication (with a token I do not know how to generate)

@eostis , this is not entirely true, you can authenticate EITHER with a token OR with your WCS credentials.

In this example, I showed you that you can connect to the WCS Weaviate cluster instance with your WCS credentials (since WSC does not allow configuring your OICD it uses the same for the console and the cluster):

from weaviate import Client, AuthClientPassword

credentials = weaviate.AuthClientPassword(
    username='WCS_EMAIL',
    password='WCS_PASSWORD'
)

weaviate_client = Client( # Note that here we are creating a Client object
    url='https://WCS_CLUSTER_NAME.semi.technology', # this is the cluster URL, where WCS_CLUSTER_NAME is the name of the instance you created
    auth_client_secret=credentials,
)

Let me know if this works.

[eostis]

If the cluster is OIDC enabled, you need to send an OIDC (the email/password is not considered)
If it is not, you need ... nothing. Not even an email/pwd (tested)

[StefanBogdan]

If the cluster is OIDC enabled, you need to send an OIDC.

Yes, and it is the same one used to Login to the console, i.e. the same one used to Login here: https://console.semi.technology/

NOTE: The created instance has also an authorization layer (if you enabled authentication), and by default only one user can access it, the creator of the instance.

[StefanBogdan]

(the email/password is not considered)

When you use username/password the python-client gets the token from the issuer (and updates it whenever it expires), so you do not need to get any tokens.

[eostis]

Login to https://console.semi.technology/ requires an email/pwd, right? Where can I get the token?

[StefanBogdan]

It should be listed in the Well Known OpenID configuration: https://YOUR_INSTANCE_NAME.semi.network/v1/.well-known/openid-configuration

{"clientId":"wcs","href":"https://auth.wcs.api.semi.technology/auth/realms/SeMI/.well-known/openid-configuration"}

[eostis]

oh!

credentials = weaviate.AuthClientPassword(
    username='WCS_EMAIL',
    password='WCS_PASSWORD'
)

is here to generate the token from my email/password. Is it?

I guess I'll have to dig into the python's client code (I'm working with PHP).

[StefanBogdan]

is here to generate the token from my email/password. Is it?

Yes.

With this I am closing this Issue, feel free to open if needed.

[eostis]

Here is what worked for me:

# Install OIDC PHP client with composer
composer require jumbojett/openid-connect-php

use Jumbojett\OpenIDConnectClient;

$oidc = new OpenIDConnectClient(
	'https://auth.wcs.api.semi.technology/auth/realms/SeMI/.well-known/openid-configuration',
	'wcs'
);
$oidc->providerConfigParam( [ 'token_endpoint' => 'https://auth.wcs.api.semi.technology/auth/realms/SeMI/protocol/openid-connect/token' ] );
$oidc->addAuthParam( [ 'username' => 'WCS_EMAIL' ] );
$oidc->addAuthParam( [ 'password' => 'WCS_PASSWORD' ] );

$clientCredentialsToken = $oidc->requestResourceOwnerToken( true );
if ( empty( $clientCredentialsToken ) ) {
	throw new \Exception( 'Credential error. No explanation available.' );
} elseif ( ! empty( $clientCredentialsToken->error ) ) {
	throw new \Exception( $clientCredentialsToken->error_description );
}
$token = $clientCredentialsToken->access_token;

// Add the token to the request
$headers['Authorization'] = sprintf( 'Bearer %s', $token );

# Prepare and call the request on your OIDC protected WCS cluster
...