Unable to use /run endpoint with token authentication
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 15.7k
- Forks
- 5.6k
- Avg merge
- 2d 44m
- Merged PRs (30d)
- 80
Description
Description of Issue
Reading the docs on how to use the salt-api /run endpoint tells me that the following should work:
curl -sS localhost:8000/run \
-H 'Accept: application/x-yaml' \
-H 'Content-type: application/json' \
-d '[{
"client": "local",
"tgt": "*",
"fun": "test.ping",
"token": "<salt eauth token here>"
}]'
I have created a token and ran the code above, and I am receiving a 401 error:
2020-02-14T16:29:08Z [salt.auth][WARNING] Authentication failure of type "token" occurred.
2020-02-14T16:29:08Z [salt.master][WARNING] Authentication failure of type "token" occurred.
Setup
My salt eauth setup, I am using an ldap service account for this named 'automation_user'. That account can create a token, and use that same token against other endpoints. It appears to only have issues with endpoints where the token is included in the data. If the token is part of the header there is no issue.
auth.ldap.accountattributename: sAMAccountName
auth.ldap.activedirectory: true
auth.ldap.anonymous: false
auth.ldap.auth_by_group_membership_only: false
auth.ldap.basedn: DC=example,DC=com
auth.ldap.filter: sAMAccountName={{ username }}
auth.ldap.groupclass: group
auth.ldap.no_verify: true
auth.ldap.persontype: person
auth.ldap.port: 636
auth.ldap.scope: 2
auth.ldap.server: ldap.example.com
auth.ldap.tls: true
external_auth:
ldap:
ldap_admin_group%:
- .*
- '@wheel'
- '@runner'
automation_user:
- .*
- '@runner'
fileserver_backend:
- gitfs
- roots
gitfs_base: develop
gitfs_provider: pygit2
gitfs_saltenv_whitelist:
- base
id: salt-master-0-staging.example.com
log_datefmt: '%Y-%m-%dT%H:%M:%SZ'
log_datefmt_logfile: '%Y-%m-%dT%H:%M:%SZ'
log_fmt_console: '%(asctime)s [%(name)s][%(levelname)s]%(jid)s %(message)s'
log_fmt_logfile: '%(asctime)s [%(name)s][%(levelname)s]%(jid)s %(message)s'
log_level_console: info
log_level_logfile: info
presence_events: true
top_file_merging_strategy: same
Steps to Reproduce Issue
Create Token as automation_user,
Use token in example code to run a test.ping on the /run endpoint
Receive 401 error from salt-api: "No permission -- see authorization schemes"
salt-master container also generates two errors:
"2020-02-14T16:29:08Z [salt.auth][WARNING] Authentication failure of type "token" occurred.
2020-02-14T16:29:08Z [salt.master][WARNING] Authentication failure of type "token" occurred."
Versions Report
Salt Version:
Salt: 2019.2.3
Dependency Versions:
cffi: Not Installed
cherrypy: unknown
dateutil: 2.6.1
docker-py: Not Installed
gitdb: Not Installed
gitpython: Not Installed
ioflo: Not Installed
Jinja2: 2.10
libgit2: 0.26.0
libnacl: Not Installed
M2Crypto: Not Installed
Mako: Not Installed
msgpack-pure: Not Installed
msgpack-python: 0.5.6
mysql-python: Not Installed
pycparser: Not Installed
pycrypto: 2.6.1
pycryptodome: Not Installed
pygit2: 0.26.2
Python: 3.6.9 (default, Nov 7 2019, 10:44:02)
python-gnupg: 0.4.1
PyYAML: 3.12
PyZMQ: 16.0.2
RAET: Not Installed
smmap: Not Installed
timelib: Not Installed
Tornado: 4.5.3
ZMQ: 4.2.5
System Versions:
dist: Ubuntu 18.04 bionic
locale: ANSI_X3.4-1968
machine: x86_64
release: 4.15.0-1064-azure
system: Linux
version: Ubuntu 18.04 bionic
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the salt-api /run endpoint documentation and reproduce the request using the supplied curl example, then compare its token handling with endpoints where the token is sent in a header. Done means a valid token in the /run request body authenticates successfully and the reported 401 regression is covered by a test.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- api, authentication
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100