Azure / Azure/data-api-builder

[Bug]: Data Api Builder should be consuming JwtBearerOptions

Aperta
#2,254 3 commenti 2 reazioni 0 assegnatari Vedi su GitHub
auth bug cri enhancement
Lingua principale
C#
Stelle
1.5k
Fork
370
Merge medio
3g 22h
PR unite (30g)
9

Descrizione

### What happened?

I have created a complete docker-compose environment for my development team. MSSQL, DAB, KeyCloak, Traefik, Next.js front end.

The entire system is up and running for dev and is working quite well.

I am now able to log in and retrieve a valid access token with KeyCloak, and send it downstream to my DAB.

The dev environment in docker is all running http (not https), so the keycloak issued token has an http issuer.

DAB rejects the token because the JwtBearer middleware rejects http issuers UNLESS RequireHttpsMetadata is set to false for development.

If DAB was properly consuming JwtBearerOptions, then I could simply add an environment variable, or an appsettings.json file to override certain auth settings for dev. However, DAB has essentially hard coded much of the configuration (Except the issuer and audience settings).

I would have to migrate a bunch of my dev container environment to use https in order to make the E2E scenario work, but would rather be able to run http in dev mode.

### Version

0.12.0-rc

### What database are you using?

Azure SQL

### What hosting model are you using?

Custom Docker host

### Which API approach are you accessing DAB through?

GraphQL

### Relevant log output

```Text
2024-06-07 15:41:02 fail: Microsoft.AspNetCore.Server.Kestrel[13]
2024-06-07 15:41:02 Connection id "0HN477A3CGGK2", Request id "0HN477A3CGGK2:00000002": An unhandled exception was thrown by the application.
2024-06-07 15:41:02 System.InvalidOperationException: The MetadataAddress or Authority must use HTTPS unless disabled for development by setting RequireHttpsMetadata=false.
2024-06-07 15:41:02 at Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerPostConfigureOptions.PostConfigure(String name, JwtBearerOptions options)
2024-06-07 15:41:02 at Microsoft.Extensions.Options.OptionsFactory`1.Create(String name)
2024-06-07 15:41:02 at Microsoft.Extensions.Options.OptionsMonitor`1.<>c__DisplayClass10_0.b__0()
2024-06-07 15:41:02 at System.Lazy`1.ViaFactory(LazyThreadSafetyMode mode)
2024-06-07 15:41:02 at System.Lazy`1.ExecutionAndPublication(LazyHelper executionAndPublication, Boolean useDefaultConstructor)
2024-06-07 15:41:02 at System.Lazy`1.CreateValue()
2024-06-07 15:41:02 at Microsoft.AspNetCore.Authentication.AuthenticationHandler`1.InitializeAsync(AuthenticationScheme scheme, HttpContext context)
2024-06-07 15:41:02 at Microsoft.AspNetCore.Authentication.AuthenticationHandlerProvider.GetHandlerAsync(HttpContext context, String authenticationScheme)
2024-06-07 15:41:02 at Microsoft.AspNetCore.Authentication.AuthenticationService.AuthenticateAsync(HttpContext context, String scheme)
2024-06-07 15:41:02 at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
2024-06-07 15:41:02 at Azure.DataApiBuilder.Service.Startup.<>c__DisplayClass15_0.<b__3>d.MoveNext() in /_/src/Service/Startup.cs:line 345
2024-06-07 15:41:02 --- End of stack trace from previous location ---
2024-06-07 15:41:02 at Azure.DataApiBuilder.Core.Services.PathRewriteMiddleware.InvokeAsync(HttpContext httpContext) in /_/src/Core/Services/PathRewriteMiddleware.cs:line 89
2024-06-07 15:41:02 at Azure.DataApiBuilder.Core.Services.CorrelationIdMiddleware.Invoke(HttpContext httpContext) in /_/src/Core/Services/CorrelationIdMiddleware.cs:line 53
2024-06-07 15:41:02 at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol.ProcessRequests[TContext](IHttpApplication`1 application)
```

### Code of Conduct

- [X] I agree to follow this project's Code of Conduct

Guida per i contributori

Apri la guida per i contributori

Direzione di ricerca

Inizia in src/Service/Startup.cs intorno alla riga 345, dove lo stack trace mostra che il middleware di autenticazione viene configurato, e verifica come vengono fornite le JwtBearerOptions. Verifica come la configurazione di sviluppo raggiunge le impostazioni JWT bearer, quindi conferma che RequireHttpsMetadata può essere sovrascritto tramite l’ambiente o la configurazione appsettings, in modo da accettare gli issuer di sviluppo HTTP.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Valutazione

Stack tecnologico
azure, csharp, docker, graphql
Ambito
api, authentication, backend, devops
Tipo di issue
Bug
Difficoltà
3/5
Tempo stimato
1-2 giorni
Stato di attività
Ferma
Chiarezza
Abbastanza chiara
Idoneità per principianti
42/100

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.