influxdata / influxdata/influxdb

Cannot init a new Stack from cli using an "All Access" token

Open
#21,997 1 comment 0 reactions 0 assignees View on GitHub
area/2.x area/auth area/templates
Dominant language
Rust
Stars
31.7k
Forks
3.7k
Avg merge
13h 37m
Merged PRs (30d)
8

Description

__Steps to reproduce:__
List the minimal actions needed to reproduce the behavior.

1. Create a new InfluxDB 2.0.3 instance
2. Create a token with "All Access" permissions
3. Configure influx CLI to use the token and set the default org
3. from the CLI run `influx stacks init -n TEST`

__Expected behavior:__
Stack is created and ID is returned

__Actual behavior:__
`Error: Not authorized to create stack.`

Interestingly though an "influx apply -f XXXX.json" works and create a new stack

__Environment info:__

* System info: Linux przx1 5.10.2-2-MANJARO influxdata/influxdb#1 SMP PREEMPT Tue Dec 22 08:14:42 UTC 2020 x86_64 GNU/Linux
* InfluxDB version: 2.0.3 both client and server
* Other relevant environment details: Kubernetes 1.19.1 / KinD

__Logs:__

* Token
```
influx auth list --id 06e370b23dbe4000
ID Description Token U
ser Name User ID Permissions
06e370b23dbe4000 All Powerful Token 6n5bIojkPl78eQIjKQo4ki27zDJKJQwSNupuHfSg-50ug7PD3s4m4x5yKeiHZahJcY58QDmxZjUYL
eNMeDyumQ== admin 06e37007a87e4000 [read:orgs/9a9e5751c4332d9b/authorizations write:orgs/9a9e5751c4332d9
b/authorizations read:orgs/9a9e5751c4332d9b/buckets write:orgs/9a9e5751c4332d9b/buckets read:orgs/9a9e5751c4332d9b/checks wri
te:orgs/9a9e5751c4332d9b/checks read:orgs/9a9e5751c4332d9b/dashboards write:orgs/9a9e5751c4332d9b/dashboards read:orgs/9a9e57
51c4332d9b/dbrp write:orgs/9a9e5751c4332d9b/dbrp read:orgs/9a9e5751c4332d9b/documents write:orgs/9a9e5751c4332d9b/documents r
ead:orgs/9a9e5751c4332d9b/labels write:orgs/9a9e5751c4332d9b/labels read:orgs/9a9e5751c4332d9b/notificationRules write:orgs/9
a9e5751c4332d9b/notificationRules read:orgs/9a9e5751c4332d9b/notificationEndpoints write:orgs/9a9e5751c4332d9b/notificationEn
dpoints read:orgs/9a9e5751c4332d9b read:orgs/9a9e5751c4332d9b/secrets write:orgs/9a9e5751c4332d9b/secrets read:orgs/9a9e5751c
4332d9b/scrapers write:orgs/9a9e5751c4332d9b/scrapers read:orgs/9a9e5751c4332d9b/sources write:orgs/9a9e5751c4332d9b/sources
read:orgs/9a9e5751c4332d9b/tasks write:orgs/9a9e5751c4332d9b/tasks read:orgs/9a9e5751c4332d9b/telegrafs write:orgs/9a9e5751c4
332d9b/telegrafs read:users/06e37007a87e4000 write:users/06e37007a87e4000 read:orgs/9a9e5751c4332d9b/variables write:orgs/9a9
e5751c4332d9b/variables read:orgs/9a9e5751c4332d9b/views write:orgs/9a9e5751c4332d9b/views]
```

* Influx CLI Config
```
influx config set -a -n LOCAL --org org --token 6n5bIojkPl78eQIjKQo4ki27zDJKJQwSNupuHfSg-50ug7PD3s4m4x5yKeiHZahJcY58QDmxZjUYLeNMeDyumQ==
```

* Error log
```
ts=2021-01-07T17:20:33.490509Z lvl=error msg="api error encountered" log_id=0RZRso3G000 handler=stacks error="not authorized to create stack"
```

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the authorization failure with `influx stacks init -n TEST` using an All Access token, then compare it with the successful `influx apply -f XXXX.json` path. Trace the CLI and server handling for stack creation and identify why the token is rejected; done means the CLI creates the stack and returns its ID with the documented token.

Written by the indexing model from the issue text.

Assessment

Domain
authorization, cli, databases
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.