Azure / Azure/data-api-builder
[Bug]: Data Api Builder should be consuming JwtBearerOptions
- Vorherrschende Sprache
- C#
- Sterne
- 1.5k
- Forks
- 370
- Ø Merge
- 3 T. 22 Std.
- Gemergte PRs (30 T.)
- 9
Beschreibung
### What happened?
I have created a complete docker-compose environment for my development team. MSSQL, DAB, KeyCloak, Traefik, Next.js front end.
The entire system is up and running for dev and is working quite well.
I am now able to log in and retrieve a valid access token with KeyCloak, and send it downstream to my DAB.
The dev environment in docker is all running http (not https), so the keycloak issued token has an http issuer.
DAB rejects the token because the JwtBearer middleware rejects http issuers UNLESS RequireHttpsMetadata is set to false for development.
If DAB was properly consuming JwtBearerOptions, then I could simply add an environment variable, or an appsettings.json file to override certain auth settings for dev. However, DAB has essentially hard coded much of the configuration (Except the issuer and audience settings).
I would have to migrate a bunch of my dev container environment to use https in order to make the E2E scenario work, but would rather be able to run http in dev mode.
### Version
0.12.0-rc
### What database are you using?
Azure SQL
### What hosting model are you using?
Custom Docker host
### Which API approach are you accessing DAB through?
GraphQL
### Relevant log output
```Text
2024-06-07 15:41:02 fail: Microsoft.AspNetCore.Server.Kestrel[13]
2024-06-07 15:41:02 Connection id "0HN477A3CGGK2", Request id "0HN477A3CGGK2:00000002": An unhandled exception was thrown by the application.
2024-06-07 15:41:02 System.InvalidOperationException: The MetadataAddress or Authority must use HTTPS unless disabled for development by setting RequireHttpsMetadata=false.
2024-06-07 15:41:02 at Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerPostConfigureOptions.PostConfigure(String name, JwtBearerOptions options)
2024-06-07 15:41:02 at Microsoft.Extensions.Options.OptionsFactory`1.Create(String name)
2024-06-07 15:41:02 at Microsoft.Extensions.Options.OptionsMonitor`1.<>c__DisplayClass10_0.b__0()
2024-06-07 15:41:02 at System.Lazy`1.ViaFactory(LazyThreadSafetyMode mode)
2024-06-07 15:41:02 at System.Lazy`1.ExecutionAndPublication(LazyHelper executionAndPublication, Boolean useDefaultConstructor)
2024-06-07 15:41:02 at System.Lazy`1.CreateValue()
2024-06-07 15:41:02 at Microsoft.AspNetCore.Authentication.AuthenticationHandler`1.InitializeAsync(AuthenticationScheme scheme, HttpContext context)
2024-06-07 15:41:02 at Microsoft.AspNetCore.Authentication.AuthenticationHandlerProvider.GetHandlerAsync(HttpContext context, String authenticationScheme)
2024-06-07 15:41:02 at Microsoft.AspNetCore.Authentication.AuthenticationService.AuthenticateAsync(HttpContext context, String scheme)
2024-06-07 15:41:02 at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
2024-06-07 15:41:02 at Azure.DataApiBuilder.Service.Startup.<>c__DisplayClass15_0.<b__3>d.MoveNext() in /_/src/Service/Startup.cs:line 345
2024-06-07 15:41:02 --- End of stack trace from previous location ---
2024-06-07 15:41:02 at Azure.DataApiBuilder.Core.Services.PathRewriteMiddleware.InvokeAsync(HttpContext httpContext) in /_/src/Core/Services/PathRewriteMiddleware.cs:line 89
2024-06-07 15:41:02 at Azure.DataApiBuilder.Core.Services.CorrelationIdMiddleware.Invoke(HttpContext httpContext) in /_/src/Core/Services/CorrelationIdMiddleware.cs:line 53
2024-06-07 15:41:02 at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol.ProcessRequests[TContext](IHttpApplication`1 application)
```
### Code of Conduct
- [X] I agree to follow this project's Code of Conduct
Beitragsleitfaden
Rechercherichtung
Beginnen Sie in src/Service/Startup.cs ungefähr bei Zeile 345, wo der Stacktrace zeigt, dass die Authentifizierungs-Middleware konfiguriert wird, und untersuchen Sie, wie JwtBearerOptions bereitgestellt werden. Überprüfen Sie, wie die Entwicklungskonfiguration die JWT-Bearer-Einstellungen erreicht, und bestätigen Sie anschließend, dass RequireHttpsMetadata über die Umgebung oder die appsettings-Konfiguration überschrieben werden kann, sodass HTTP-Entwicklungs-Issuer akzeptiert werden.
Vom Indexierungsmodell aus dem Issue-Text verfasst.
Bewertung
- Tech-Stack
- azure, csharp, docker, graphql
- Bereich
- api, authentication, backend, devops
- Issue-Typ
- Bug
- Schwierigkeit
- 3/5
- Geschätzter Aufwand
- 1-2 Tage
- Aktivitätsstatus
- Veraltet
- Klarheit
- Größtenteils klar
- Anfängerfreundlichkeit
- 42/100