temporalio / temporalio/temporal
Bearer token not passed to remote cluster when adding or upserting remote cluster
Open
@dnr is already working on this.
Since Sep 1, 2023.
potential-bug
- Dominant language
- Go
- Stars
- 23.2k
- Forks
- 1.9k
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 228
Description
Set up:
2 seperate running clusters, Cluster-1 and Cluster-2. Both are configured with custom authorizers with OAuth authorization.
Expected Behavior
- Request-1: addOrUpsertRemoteCluster request to Cluster-1 with bearer token.
- Request-1 passes authorization check on Cluster-1
- Frontend service from Cluster-1 makes a Request-2 to Cluster-2 with propagated token from Request-1
- Request-2 passes authorization check on Cluster-2
Actual Behavior
- Request-1: addOrUpsertRemoteCluster request to Cluster-1 with bearer token.
- Request-1 passes authorization check on Cluster-1
- Frontend service from Cluster-1 makes a Request-2 to Cluster-2 does not propagate token from Request-1
- Request-2 fails authorization check on Cluster-2
Steps to Reproduce the Problem
- Run 2 seperate clusters with OAuth authorizers (set them up to deny request with emtpy tokens)
- Make a request addOrUpsertRemoteCluster :
temporal operator cluster upsert --frontend-address 'remote.address' --grpc-meta 'authorization=bearer TOKEN'
Specifications
- Version: 1.20.3
- Platform: kubernetes, docker compose, any.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.