search

Kong / kong

🦍 The Cloud-Native API Gateway and AI Gateway.
https://konghq.com/install/#kong-community
Apache License 2.0
39.27k stars 4.82k forks source link

Oauth2 Plugin query param client_id not working into admin api. -> "kong:8001/oauth2?client_id=XXX" #5293

Closed supervisaproject closed 1 year ago

supervisaproject commented 4 years ago

Summary

As described in the manual of the plugin Oauth2 in its "version 1.0.X latest", in the section "OAuth 2.0 Flows" option "Authorization Code" must make use of the query param client_id in order to obtain the information of Application Name, and Developer Name. I attach the image of the manual in which it appears. image

The use of the query param for that endpoint of the administration api has stopped working. The result is the complete list. image *Sensitive data is from a test environment

Is working with client_id value like api rest path parameter: image *Sensitive data is from a test environment

This causes many of the applications we have running now in a previous version of kong to fail. The query params on other oAuth2 endpoints like oauth2_tokens have also stopped working: http://localhost:8001/oauth2_tokens?authenticated_userid= for example

Steps To Reproduce

  1. Create a consumer1 and consumer 2
  2. Activate plugin oauth2 in both consumers
  3. Try to obtain with query param client_id only the information of cosumer 1 curl http://localhost:8001/oauth2?client_id=[CONSUMER_CLIENT_ID]

Additional Details & Logs

458994.172
_2019/12/04 11:29:54 [debug] 33#0: *51885 [lua] cluster.lua:476: next_coordinator(): [lua-cassandra] load balancing policy chose host at 10.104.150.115
2019/12/04 11:29:59 [debug] 33#0: *51981 [lua] init.lua:227: [cluster_events] polling events from: 1575456435.244 to: 1575458999.184
2019/12/04 11:29:59 [debug] 33#0: *51981 [lua] cluster.lua:476: next_coordinator(): [lua-cassandra] load balancing policy chose host at 10.104.150.115
2019/12/04 11:29:59 [debug] 34#0: *51755 [lua] cluster.lua:476: next_coordinator(): [lua-cassandra] load balancing policy chose host at 10.104.150.115
**192.168.65.3 - - [04/Dec/2019:11:29:59 +0000] "GET /oauth2?client_id=DUMMY HTTP/1.1" 200 645 "-" "PostmanRuntime/7.20.1"**
2019/12/04 11:30:08 [debug] 32#0: *52150 [lua] init.lua:227: [cluster_events] polling events from: 1575456435.244 to: 1575

*Sensitive data is from a test environment

_{ "plugins": { "enabled_in_cluster": [ "azrolepermission", "acl", "oauth2" ], "available_on_server": { "correlation-id": true, "pre-function": true, "cors": true, "ldap-auth": true, "loggly": true, "hmac-auth": true, "zipkin": true, "request-size-limiting": true, "azure-functions": true, "request-transformer": true, "oauth2": true, "response-transformer": true, "ip-restriction": true, "statsd": true, "jwt": true, "proxy-cache": true, "basic-auth": true, "key-auth": true, "http-log": true, "azrolepermission": true, "datadog": true, "tcp-log": true, "rate-limiting": true, "post-function": true, "prometheus": true, "acl": true, "kubernetes-sidecar-injector": true, "syslog": true, "file-log": true, "udp-log": true, "response-ratelimiting": true, "aws-lambda": true, "session": true, "bot-detection": true, "request-termination": true } }, "tagline": "Welcome to kong", "configuration": { "error_default_type": "text/plain", "client_ssl": false, "proxy_access_log": "/dev/stdout", "trusted_ips": {}, "prefix": "/usr/local/kong", "loaded_plugins": { "correlation-id": true, "pre-function": true, "cors": true, "ldap-auth": true, "loggly": true, "hmac-auth": true, "zipkin": true, "request-size-limiting": true, "azure-functions": true, "request-transformer": true, "oauth2": true, "response-transformer": true, "syslog": true, "statsd": true, "jwt": true, "proxy-cache": true, "basic-auth": true, "key-auth": true, "http-log": true, "prometheus": true, "datadog": true, "tcp-log": true, "bot-detection": true, "post-function": true, "session": true, "acl": true, "kubernetes-sidecar-injector": true, "ip-restriction": true, "file-log": true, "udp-log": true, "response-ratelimiting": true, "aws-lambda": true, "rate-limiting": true, "azrolepermission": true, "request-termination": true }, "cassandra_username": "kong", "ssl_cert_key": "/usr/local/kong/ssl/kong-default.key", "admin_ssl_cert_key": "/usr/local/kong/ssl/admin-kong-default.key", "dns_resolver": {}, "pg_user": "kong", "mem_cache_size": "128m", "ssl_ciphers": "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256", "nginx_admin_directives": {}, "nginx_http_upstream_directives": [ { "value": "60s", "name": "keepalive_timeout" }, { "value": "100", "name": "keepalive_requests" }, { "value": "60", "name": "keepalive" } ], "nginx_http_directives": [ { "value": "TLSv1.1 TLSv1.2 TLSv1.3", "name": "ssl_protocols" }, { "value": "prometheus_metrics 5m", "name": "lua_shared_dict" } ], "pg_host": "auditzone-cassandra-sv", "nginx_acc_logs": "/usr/local/kong/logs/access.log", "pg_semaphore_timeout": 60000, "proxy_listen": [ "0.0.0.0:8000", "0.0.0.0:8443 http2 ssl" ], "nginx_kong_stream_conf": "/usr/local/kong/nginx-kong-stream.conf", "cassandra_ssl": false, "dns_no_sync": false, "db_update_propagation": 0, "stream_listen": [ "off" ], "nginx_err_logs": "/usr/local/kong/logs/error.log", "cassandra_port": 9042, "dns_order": [ "LAST", "SRV", "A", "CNAME" ], "dns_error_ttl": 1, "headers": [ "server_tokens", "latency_tokens" ], "admin_listen": [ "0.0.0.0:8001", "0.0.0.0:8444 ssl" ], "cassandra_schema_consensus_timeout": 10000, "status_listen": [ "off" ], "cassandra_lb_policy": "RequestRoundRobin", "nginx_optimizations": true, "nginx_http_upstream_keepalive_timeout": "60s", "ssl_cert_key_default": "/usr/local/kong/ssl/kong-default.key", "pg_timeout": 5000, "router_update_frequency": 1, "nginx_http_upstream_keepalive_requests": "100", "database": "cassandra", "db_update_frequency": 5, "dns_stale_ttl": 4, "origins": {}, "pg_database": "kong", "nginx_worker_processes": "auto", "ssl_cert_csr_default": "/usr/local/kong/ssl/kong-default.csr", "lua_package_cpath": "", "proxy_error_log": "/dev/stderr", "admin_acc_logs": "/usr/local/kong/logs/admin_access.log", "client_ssl_cert_default": "/usr/local/kong/ssl/kong-default.crt", "cassandra_refresh_frequency": 60, "lua_package_path": "./?.lua;./?/init.lua;", "nginx_pid": "/usr/local/kong/pids/nginx.pid", "upstream_keepalive": 60, "admin_error_log": "/dev/stderr", "admin_ssl_cert": "/usr/local/kong/ssl/admin-kong-default.crt", "anonymous_reports": true, "pg_ssl_verify": false, "admin_access_log": "/dev/stdout", "ssl_cipher_suite": "modern", "nginx_proxy_directives": {}, "proxy_listeners": [ { "listener": "0.0.0.0:8000", "proxy_protocol": false, "reuseport": false, "transparent": false, "ssl": false, "ip": "0.0.0.0", "deferred": false, "http2": false, "port": 8000, "bind": false }, { "listener": "0.0.0.0:8443 ssl http2", "proxy_protocol": false, "reuseport": false, "transparent": false, "ssl": true, "ip": "0.0.0.0", "deferred": false, "http2": true, "port": 8443, "bind": false } ], "proxy_ssl_enabled": true, "nginx_http_upstream_keepalive": "60", "db_cache_warmup_entities": [ "services", "plugins" ], "enabled_headers": { "latency_tokens": true, "X-Kong-Response-Latency": true, "Server": true, "X-Kong-Admin-Latency": true, "X-Kong-Upstream-Status": false, "Via": true, "X-Kong-Proxy-Latency": true, "server_tokens": true, "X-Kong-Upstream-Latency": true }, "nginx_http_ssl_protocols": "TLSv1.1 TLSv1.2 TLSv1.3", "nginx_stream_directives": {}, "db_resurrect_ttl": 30, "nginx_sproxy_directives": {}, "cassandra_consistency": "ONE", "client_max_body_size": "0", "service_mesh": false, "status_listeners": {}, "dns_not_found_ttl": 30, "pg_ssl": false, "db_cache_ttl": 0, "status_access_log": "off", "cassandra_repl_strategy": "SimpleStrategy", "status_error_log": "logs/status_error.log", "kong_env": "/usr/local/kong/.kong_env", "cassandra_timeout": 5000, "cassandra_data_centers": [ "dc1:2", "dc2:3" ], "nginx_kong_conf": "/usr/local/kong/nginx-kong.conf", "real_ip_header": "X-Real-IP", "dns_hostsfile": "/etc/hosts", "admin_listeners": [ { "listener": "0.0.0.0:8001", "proxy_protocol": false, "reuseport": false, "transparent": false, "ssl": false, "ip": "0.0.0.0", "deferred": false, "http2": false, "port": 8001, "bind": false }, { "listener": "0.0.0.0:8444 ssl", "proxy_protocol": false, "reuseport": false, "transparent": false, "ssl": true, "ip": "0.0.0.0", "deferred": false, "http2": false, "port": 8444, "bind": false } ], "cassandra_contact_points": [ "auditzone-cassandra-sv" ], "ssl_cert": "/usr/local/kong/ssl/kong-default.crt", "log_level": "debug", "admin_ssl_cert_key_default": "/usr/local/kong/ssl/admin-kong-default.key", "cassandra_ssl_verify": false, "plugins": [ "bundled", "azrolepermission" ], "nginx_http_status_directives": {}, "real_ip_recursive": "off", "cassandra_repl_factor": 1, "client_ssl_cert_key_default": "/usr/local/kong/ssl/kong-default.key", "nginx_daemon": "off", "router_consistency": "strict", "stream_listeners": {}, "lua_socket_pool_size": 30, "pg_port": 9042, "admin_ssl_cert_default": "/usr/local/kong/ssl/admin-kong-default.crt", "client_body_buffer_size": "8k", "ssl_preread_enabled": true, "lua_ssl_verify_depth": 1, "nginx_conf": "/usr/local/kong/nginx.conf", "cassandra_keyspace": "kong", "ssl_cert_default": "/usr/local/kong/ssl/kong-default.crt", "pg_max_concurrent_queries": 0, "admin_ssl_enabled": true }, "version": "1.4.1", "node_id": "e136c561-f3bb-415e-953c-f77ba5ba83cb", "lua_version": "LuaJIT 2.1.0-beta3", "prngseeds": { "pid: 34": 825229188191, "pid: 33": 185345920119, "pid: 37": 105101198242, "pid: 35": 226127320105, "pid: 36": 156190150751, "pid: 32": 255113994666, "pid: 1": 136991829320 }, "timers": { "pending": 6, "running": 0 }, "hostname": "auditzone-kong-67bb948b4b-dwwfp" }


***Sensitive data is from a test environment** 
- Operating system
docker image kong:1.4.1  4.9.184-linuxkit
bungle commented 4 years ago

Yes, docs are not right they still seem to refer 0.x behavior here and there.

Max-Pol commented 4 years ago

+1 I also need these to be fixed, and for the route /oauth2_tokens?authenticated_userid= as well...

bob983 commented 4 years ago

According to https://github.com/Kong/kong/issues/6016 /oauth2?client_id=XXX could be replaced by oauth2/XXX but I don't see a workaround for /oauth2_tokens?authenticated_userid= or /oauth2_tokens?credential_id=... that used to work as well.

I'm happy to fix this if I'm pointed in the right direction ... :)

bob983 commented 4 years ago

@bungle hi, this is preventing us from upgrading to Kong 1.x I understand this is not a top priority and I'd like help with the fix. Or do the changes in 1.x actually preventing things to work as they did before in 0.x?

bob983 commented 3 years ago

@bungle what is the status of this issue, please? Is it a "won't fix"? Or did it just fall between the cracks?

bob983 commented 3 years ago

Can I please at least get some kind of won't fix response? :pray:

hanshuebner commented 1 year ago

We don't have current plans to fix this, sorry.