Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix authentication issues with the http-requests against the proxy #1514

Conversation

ivangonzalezacuna
Copy link
Contributor

The handler was using the old authentication setup instead of the new one using the new auth service. Let's use this instead and always set the token if defined. This is following the same idea as other upstream actions, such as the one to register a new component: https://github.com/backstage/backstage/blob/e6c52e7e7ec21ceb98cfbaad55c84b3e3683649f/plugins/scaffolder-backend/src/scaffolder/actions/builtin/catalog/fetch.ts#L93

In our setup, we needed to set the credentials: dangerously-allow-unauthenticated temporarily. I've tested it without them again and the requests weren't returning the 401 any more.

This should be fixing #1475, and I followed the idea in backstage/backstage#25096 (comment)

✔️ Checklist

  • Added tests for new functionality and regression tests for bug fixes
  • Added changeset (run yarn changeset in the root)
  • Screenshots of before and after attached (for UI changes)
  • Added or updated documentation (if applicable)

The handler was using the old authentication setup instead of the new one
using the new auth service. Let's use this instead and always set the token
if defined. This is following the same idea as other upstream actions, such
as the one to register a new component: https://github.com/backstage/backstage/blob/e6c52e7e7ec21ceb98cfbaad55c84b3e3683649f/plugins/scaffolder-backend/src/scaffolder/actions/builtin/catalog/fetch.ts#L93
@ivangonzalezacuna ivangonzalezacuna requested a review from a team as a code owner July 29, 2024 12:55
@davormilutinovic
Copy link

davormilutinovic commented Aug 3, 2024

Hi. For some reason your changes are still not working for me.

I have used your fork and there was an error during execution of one template

...There was an issue with your request. Status code: 401 Response body: {"error":{"name":"AuthenticationError","message":"Invalid plugin token; caused by JWTClaimValidationFailed: unexpected "aud" claim value","cause":{"code":"ERR_JWT_CLAIM_VALIDATION_FAILED...

After I reverted from

      const { token } = (await auth?.getPluginRequestToken({
        onBehalfOf: await ctx.getInitiatorCredentials(),
        targetPluginId: 'proxy',
      })) ?? { token: ctx.secrets?.backstageToken };

to

const credentials = await ctx.getInitiatorCredentials(); 

// @ts-expect-error
const token = credentials.token;

It has start working again?

Copy link
Contributor

This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution!

@github-actions github-actions bot added the stale label Aug 10, 2024
@github-actions github-actions bot closed this Aug 15, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants