Azure / Azure/data-api-builder

[Bug]: Data Api Builder should be consuming JwtBearerOptions

オープン
#2,254 コメント 3 件 リアクション 2 件 担当者 0 名 GitHub で見る
auth bug cri enhancement
主要言語
C#
スター
1.5k
フォーク
370
平均マージ
3日 22時間
マージ済み PR(30日)
9

説明

### What happened?

I have created a complete docker-compose environment for my development team. MSSQL, DAB, KeyCloak, Traefik, Next.js front end.

The entire system is up and running for dev and is working quite well.

I am now able to log in and retrieve a valid access token with KeyCloak, and send it downstream to my DAB.

The dev environment in docker is all running http (not https), so the keycloak issued token has an http issuer.

DAB rejects the token because the JwtBearer middleware rejects http issuers UNLESS RequireHttpsMetadata is set to false for development.

If DAB was properly consuming JwtBearerOptions, then I could simply add an environment variable, or an appsettings.json file to override certain auth settings for dev. However, DAB has essentially hard coded much of the configuration (Except the issuer and audience settings).

I would have to migrate a bunch of my dev container environment to use https in order to make the E2E scenario work, but would rather be able to run http in dev mode.

### Version

0.12.0-rc

### What database are you using?

Azure SQL

### What hosting model are you using?

Custom Docker host

### Which API approach are you accessing DAB through?

GraphQL

### Relevant log output

```Text
2024-06-07 15:41:02 fail: Microsoft.AspNetCore.Server.Kestrel[13]
2024-06-07 15:41:02 Connection id "0HN477A3CGGK2", Request id "0HN477A3CGGK2:00000002": An unhandled exception was thrown by the application.
2024-06-07 15:41:02 System.InvalidOperationException: The MetadataAddress or Authority must use HTTPS unless disabled for development by setting RequireHttpsMetadata=false.
2024-06-07 15:41:02 at Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerPostConfigureOptions.PostConfigure(String name, JwtBearerOptions options)
2024-06-07 15:41:02 at Microsoft.Extensions.Options.OptionsFactory`1.Create(String name)
2024-06-07 15:41:02 at Microsoft.Extensions.Options.OptionsMonitor`1.<>c__DisplayClass10_0.b__0()
2024-06-07 15:41:02 at System.Lazy`1.ViaFactory(LazyThreadSafetyMode mode)
2024-06-07 15:41:02 at System.Lazy`1.ExecutionAndPublication(LazyHelper executionAndPublication, Boolean useDefaultConstructor)
2024-06-07 15:41:02 at System.Lazy`1.CreateValue()
2024-06-07 15:41:02 at Microsoft.AspNetCore.Authentication.AuthenticationHandler`1.InitializeAsync(AuthenticationScheme scheme, HttpContext context)
2024-06-07 15:41:02 at Microsoft.AspNetCore.Authentication.AuthenticationHandlerProvider.GetHandlerAsync(HttpContext context, String authenticationScheme)
2024-06-07 15:41:02 at Microsoft.AspNetCore.Authentication.AuthenticationService.AuthenticateAsync(HttpContext context, String scheme)
2024-06-07 15:41:02 at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
2024-06-07 15:41:02 at Azure.DataApiBuilder.Service.Startup.<>c__DisplayClass15_0.<b__3>d.MoveNext() in /_/src/Service/Startup.cs:line 345
2024-06-07 15:41:02 --- End of stack trace from previous location ---
2024-06-07 15:41:02 at Azure.DataApiBuilder.Core.Services.PathRewriteMiddleware.InvokeAsync(HttpContext httpContext) in /_/src/Core/Services/PathRewriteMiddleware.cs:line 89
2024-06-07 15:41:02 at Azure.DataApiBuilder.Core.Services.CorrelationIdMiddleware.Invoke(HttpContext httpContext) in /_/src/Core/Services/CorrelationIdMiddleware.cs:line 53
2024-06-07 15:41:02 at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol.ProcessRequests[TContext](IHttpApplication`1 application)
```

### Code of Conduct

- [X] I agree to follow this project's Code of Conduct

コントリビューションガイド

コントリビューションガイドを開く

調査の方向性

認証ミドルウェアが構成されていることをスタックトレースが示している、src/Service/Startup.cs の345行目付近から開始し、JwtBearerOptions がどのように提供されているかを調べます。開発用構成が JWT bearer 設定にどのように到達するかを確認し、そのうえで、環境または appsettings 構成を通じて RequireHttpsMetadata を上書きし、HTTP の開発用 issuer を受け入れられることを確認します。

索引モデルが issue の本文から書いたものです。

評価

技術スタック
azure, csharp, docker, graphql
領域
api, authentication, backend, devops
issue の種類
バグ
難易度
3/5
見積もり時間
1〜2日
活発さ
停滞
明瞭さ
おおむね明確
初心者へのやさしさ
42/100

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。