Azure / Azure/data-api-builder
[Bug]: Data Api Builder should be consuming JwtBearerOptions
- Lenguaje dominante
- C#
- Estrellas
- 1.5k
- Forks
- 370
- Merge medio
- 3 d 22 h
- PR fusionados (30 d)
- 9
Descripción
### What happened?
I have created a complete docker-compose environment for my development team. MSSQL, DAB, KeyCloak, Traefik, Next.js front end.
The entire system is up and running for dev and is working quite well.
I am now able to log in and retrieve a valid access token with KeyCloak, and send it downstream to my DAB.
The dev environment in docker is all running http (not https), so the keycloak issued token has an http issuer.
DAB rejects the token because the JwtBearer middleware rejects http issuers UNLESS RequireHttpsMetadata is set to false for development.
If DAB was properly consuming JwtBearerOptions, then I could simply add an environment variable, or an appsettings.json file to override certain auth settings for dev. However, DAB has essentially hard coded much of the configuration (Except the issuer and audience settings).
I would have to migrate a bunch of my dev container environment to use https in order to make the E2E scenario work, but would rather be able to run http in dev mode.
### Version
0.12.0-rc
### What database are you using?
Azure SQL
### What hosting model are you using?
Custom Docker host
### Which API approach are you accessing DAB through?
GraphQL
### Relevant log output
```Text
2024-06-07 15:41:02 fail: Microsoft.AspNetCore.Server.Kestrel[13]
2024-06-07 15:41:02 Connection id "0HN477A3CGGK2", Request id "0HN477A3CGGK2:00000002": An unhandled exception was thrown by the application.
2024-06-07 15:41:02 System.InvalidOperationException: The MetadataAddress or Authority must use HTTPS unless disabled for development by setting RequireHttpsMetadata=false.
2024-06-07 15:41:02 at Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerPostConfigureOptions.PostConfigure(String name, JwtBearerOptions options)
2024-06-07 15:41:02 at Microsoft.Extensions.Options.OptionsFactory`1.Create(String name)
2024-06-07 15:41:02 at Microsoft.Extensions.Options.OptionsMonitor`1.<>c__DisplayClass10_0.b__0()
2024-06-07 15:41:02 at System.Lazy`1.ViaFactory(LazyThreadSafetyMode mode)
2024-06-07 15:41:02 at System.Lazy`1.ExecutionAndPublication(LazyHelper executionAndPublication, Boolean useDefaultConstructor)
2024-06-07 15:41:02 at System.Lazy`1.CreateValue()
2024-06-07 15:41:02 at Microsoft.AspNetCore.Authentication.AuthenticationHandler`1.InitializeAsync(AuthenticationScheme scheme, HttpContext context)
2024-06-07 15:41:02 at Microsoft.AspNetCore.Authentication.AuthenticationHandlerProvider.GetHandlerAsync(HttpContext context, String authenticationScheme)
2024-06-07 15:41:02 at Microsoft.AspNetCore.Authentication.AuthenticationService.AuthenticateAsync(HttpContext context, String scheme)
2024-06-07 15:41:02 at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
2024-06-07 15:41:02 at Azure.DataApiBuilder.Service.Startup.<>c__DisplayClass15_0.<b__3>d.MoveNext() in /_/src/Service/Startup.cs:line 345
2024-06-07 15:41:02 --- End of stack trace from previous location ---
2024-06-07 15:41:02 at Azure.DataApiBuilder.Core.Services.PathRewriteMiddleware.InvokeAsync(HttpContext httpContext) in /_/src/Core/Services/PathRewriteMiddleware.cs:line 89
2024-06-07 15:41:02 at Azure.DataApiBuilder.Core.Services.CorrelationIdMiddleware.Invoke(HttpContext httpContext) in /_/src/Core/Services/CorrelationIdMiddleware.cs:line 53
2024-06-07 15:41:02 at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol.ProcessRequests[TContext](IHttpApplication`1 application)
```
### Code of Conduct
- [X] I agree to follow this project's Code of Conduct
Guía de contribución
Línea de trabajo
Comienza en src/Service/Startup.cs alrededor de la línea 345, donde el stack trace muestra que se está configurando el middleware de autenticación, e inspecciona cómo se proporcionan JwtBearerOptions. Verifica cómo la configuración de desarrollo llega a la configuración de JWT bearer y, después, confirma que RequireHttpsMetadata puede sobrescribirse mediante el entorno o la configuración de appsettings para aceptar emisores de desarrollo HTTP.
Escrito por el modelo de indexación a partir del texto del issue.
Evaluación
- Stack tecnológico
- azure, csharp, docker, graphql
- Área
- api, authentication, backend, devops
- Tipo de issue
- Error
- Dificultad
- 3/5
- Tiempo estimado
- 1-2 días
- Estado de actividad
- Estancado
- Claridad
- Bastante claro
- Aptitud para principiantes
- 42/100