dbeaver / dbeaver/cloudbeaver

reverseProxyAuth: If user has more groups than configured then login fails

Open
#2,851 9 comments 2 reactions 0 assignees View on GitHub
xf:authentication
Dominant language
TypeScript
Stars
5.1k
Forks
563
Avg merge
3d 9h
Merged PRs (30d)
59

Description

I had this working well when my user was only a member of 2 groups and I configured the groups in initial-data.conf
```
{
teams: [
{
subjectId: "Administrators",
teamName: "Administrators",
description: "Administrative access. Has all permissions.",
permissions: [ "admin" ]
},
{
subjectId: "Domain Users",
teamName: "Domain Users",
description: "All users, including anonymous.",
permissions: [ ]
}
]
}
```

When I added an additional group to the user in my upstream auth, causing the reverse proxy auth header to contain more groups, I was no longer able to login and was presented with this in the logs:
```
17-08-2024 15:16:17.672 [qtp1835713430-44] DEBUG i.c.service.auth.RPSessionHandler - Attempting to authenticate user 'cbtestuser' with teams [Domain Users, Administrators, Qsync] through reverse proxy
17-08-2024 15:16:17.695 [qtp1835713430-44] ERROR i.c.service.core.impl.WebServiceCore - Error calling session handler 'RPSessionHandler'
io.cloudbeaver.DBWebException: Error:
Error saving user teams in database
.....
Caused by: org.jkiss.dbeaver.model.exec.DBCException: Error saving user teams in database
at io.cloudbeaver.service.security.CBEmbeddedSecurityController.setUserTeams(CBEmbeddedSecurityController.java:222)
at io.cloudbeaver.service.security.CBEmbeddedSecurityController.findOrCreateExternalUserByCredentials(CBEmbeddedSecurityController.java:2454)
at io.cloudbeaver.service.security.CBEmbeddedSecurityController.finishAuthentication(CBEmbeddedSecurityController.java:2160)
at io.cloudbeaver.service.security.CBEmbeddedSecurityController.authenticate(CBEmbeddedSecurityController.java:1565)
at io.cloudbeaver.service.auth.RPSessionHandler.reverseProxyAuthentication(RPSessionHandler.java:130)
... 61 common frames omitted
Caused by: org.postgresql.util.PSQLException: ERROR: insert or update on table "cb_user_team" violates foreign key constraint "cb_user_team_team_id_fkey"
Detail: Key (team_id)=(Qsync) is not present in table "cb_team".
```

Here's my auth config as well
```
authConfigurations: [
{
id: "reverseProxy",
provider: "reverseProxy",
displayName: "Reverse Proxy",
disabled: false,
iconURL: "",
description: "Authelia Reverse Proxy with ingress-nginx",
parameters: {
full-name-header: "Remote-Name",
user-header: "Remote-User",
team-header: "Remote-Groups",
team-delimiter: ",",
logout-url: "https://auth.${SECRET_DOMAIN}/logout?rd\u003dhttps://cloudbeaver.${SECRET_DOMAIN}"
}
}
]
```

I can resolve the issue by adding the qsync group to my config but I don't believe I should need to do this because cloudbeaver should be able to deal with a user being a member of a group it doesn't know about.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with reverseProxyAuthentication in RPSessionHandler.java and setUserTeams in CBEmbeddedSecurityController.java, then reproduce authentication with a group such as Qsync that is absent from initial-data.conf. Trace the cb_user_team foreign-key failure and verify that users with unknown groups can log in without the database error while configured teams still work.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, postgresql
Domain
authentication, backend, databases
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.