-
|
Is the issue already present in https://github.com/cloudera/hue/issues or discussed in the forum https://discourse.gethue.com? Describe the bug: I am using the Docker Guide and have configured my [[auth]]
[[[jwt]]]
is_enabled=true
key_server_url=https://sso.common.cloud.hpe.com/pf/JWKS
issuer=https://qa-sso.ccs.arubathena.com
audience=triton-lite-user-authI can successfully start the docker containers ( However, every time I try to call an API with a valid JWT the API returns an error, e.g.: And I can see the following in the docker compose logs: Steps to reproduce it?
Hue version or source? (e.g. open source 4.5, CDH 5.16, CDP 1.0...). System info (e.g. OS, Browser...). |
Beta Was this translation helpful? Give feedback.
Replies: 5 comments
-
|
I'm confused about a few things (note I am not a Python expert) on the line that seems to cause a problem
|
Beta Was this translation helpful? Give feedback.
-
|
Hi @mvilrokx, thanks for reaching out. @Harshg999 do you have any insight on this part of the code? |
Beta Was this translation helpful? Give feedback.
-
|
Hey @mvilrokx, thanks for the detailed description of the issue! Your observations are correct. For the custom JWT auth backend, the implementation reflects the requirements we had at the time of developing this feature. However, Hue is open-source and we can't support all the use-cases with the external key servers other users might have, so we gave an option to add your own JWT auth backend implementation as per different scenarios. I think for your use-case, you need to change how the key server is sending the Key Set and extracting the public key for decoding the JWT. Docs: https://docs.gethue.com/developer/api/rest/#custom-jwt-authentication |
Beta Was this translation helpful? Give feedback.
-
|
Thank you for the response @Harshg999, I'm still slightly confused: I am actually doing exactly what the documentation you are pointing to is mentioning, i.e. I have configured Hue as per the documentation you shared (https://docs.gethue.com/developer/api/rest/#custom-jwt-authentication) and it is pointing to my own |
Beta Was this translation helpful? Give feedback.
-
|
@mvilrokx It is not working because the the Key-Set your key server is sending is different for how it is implemented to receive one (the key server for which the implementation was done send it in some different way which was not trivial). But the JWT handling flow is the same: Because of this issue (that it is not possible to support all key server or different algorithms requirements), there is a config to mention your own custom auth backend which can work for your key server. In short, I think there are 2 ways in which you can solve this scenario: 1 - In 2 - Or you can write your own auth backend in And then, add the new auth backend in the config (comma separated and in order of priority if multiple auth backends present): This way, JWT handling will be picked up but the newly created auth backend. |
Beta Was this translation helpful? Give feedback.
@mvilrokx It is not working because the the Key-Set your key server is sending is different for how it is implemented to receive one (the key server for which the implementation was done send it in some different way which was not trivial).
But the JWT handling flow is the same:
Because of…