apache / incubator-kie-kogito-apps

Kogito Apps - Kogito is a cloud-native business automation technology for building cloud-ready business applications.
http://kogito.kie.org
Apache License 2.0
59 stars 126 forks source link

Error when configuring auth policy with DataIndex #1922

Closed gabriel-farache closed 9 months ago

gabriel-farache commented 9 months ago

Describe the bug

With the following properties are added to in the application.properties of the data index instance (running on local minikube) to only allow some users to access the graphql endpoint:

quarkus.http.auth.policy.role-policy1.roles-allowed=user
quarkus.http.auth.permission.roles1.paths=/graphql/*
quarkus.http.auth.permission.roles1.policy=role-policy1

But I get the following error:

Caused by: java.lang.RuntimeException: Unable to find HTTP security policy role-policy1
        at io.quarkus.vertx.http.runtime.security.PathMatchingHttpSecurityPolicy.init(PathMatchingHttpSecurityPolicy.java:96)
        at io.quarkus.vertx.http.runtime.security.HttpSecurityRecorder$4.created(HttpSecurityRecorder.java:217)
        at io.quarkus.arc.runtime.ArcRecorder.initBeanContainer(ArcRecorder.java:73)
        at io.quarkus.deployment.steps.ArcProcessor$generateResources844392269.deploy_0(Unknown Source)
        at io.quarkus.deployment.steps.ArcProcessor$generateResources844392269.deploy(Unknown Source)

It's like the 1st property is ignored...

When setting those properties in a brand new quarkus project (https://quarkus.io/guides/security-oidc-bearer-token-authentication-tutorial) or inside a workflow project, there is no such error

Expected behavior

No Error should be thrown and only user associated with the role user shall be able to access /graphql endpoint

Actual behavior

An error is thrown so the DataIndex is not starting

How to Reproduce?

Steps to reproduce:

  1. Add the following props to the application.properties file:
    quarkus.http.auth.policy.role-policy1.roles-allowed=user
    quarkus.http.auth.permission.roles1.paths=/graphql/*
    quarkus.http.auth.permission.roles1.policy=role-policy1
  2. Start the application or restart the pod

Output of uname -a or ver

No response

Output of java -version

No response

GraalVM version (if different from Java)

No response

Kogito version or git rev (or at least Quarkus version if you are using Kogito via Quarkus platform BOM)

No response

Build tool (ie. output of mvnw --version or gradlew --version)

No response

Additional information

Here is the manifest I use to deploy the DataIndex service in minikue:

kind: Deployment
apiVersion: apps/v1
metadata:
  name: data-index
spec:
  replicas: 1
  selector:
    matchLabels:
      app: data-index
  template:
    metadata:
      labels:
        app: data-index
    spec:
      containers:
      - name: data-index
        image: quay.io/kiegroup/kogito-data-index-postgresql:1.44.1
        resources:
          requests:
            memory: "256Mi"
            cpu: "500m"
          limits:
            memory: "512Mi"
            cpu: "1000m"
        ports:
        - containerPort: 8080
        env:
        - name: QUARKUS_PROFILE
          value: http-events-support
        - name: KOGITO_DATA_INDEX_QUARKUS_PROFILE
          value: http-events-support
        - name: QUARKUS_HTTP_AUTH_POLICY__ROLE_POLICY12__ROLES_ALLOWED
          value: user
        - name: QUARKUS_HTTP_AUTH_PERMISSION__PERMISSIONS12__POLICY
          value: ROLE_POLICY12
        - name: QUARKUS_HTTP_AUTH_PERMISSION__PERMISSIONS12__PATH
          value: /graphql/*
        - name: QUARKUS_DATASOURCE_USERNAME
          valueFrom:
            secretKeyRef:
              name: postgres-secrets
              key: POSTGRES_USER
        - name: QUARKUS_DATASOURCE_PASSWORD
          valueFrom:
            secretKeyRef:
              name: postgres-secrets
              key: POSTGRES_PASSWORD
        volumeMounts:
        - name: application-config
          mountPath: "/home/kogito/config"
        livenessProbe:
          failureThreshold: 3
          httpGet:
            path: /q/health/live
            port: 8080
            scheme: HTTP
          initialDelaySeconds: 0
          periodSeconds: 30
          successThreshold: 1
          timeoutSeconds: 10
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /q/health/ready
            port: 8080
            scheme: HTTP
          initialDelaySeconds: 0
          periodSeconds: 30
          successThreshold: 1
          timeoutSeconds: 10
      volumes:
      - name: application-config
        configMap:
          name: data-index-properties
      initContainers:
      - name: init-postgres
        image: busybox:1.36
        imagePullPolicy: IfNotPresent
        command: ['sh', '-c', 'until nc -vz postgres-db-service.postgres.svc.cluster.local 5432; do echo "Waiting for postgres server"; sleep 3; done;']
---
kind: Service
apiVersion: v1
metadata:
  name: data-index-service
  labels:
    app: data-index
spec:
  selector:
    app: data-index
  ports:
  - protocol: TCP
    port: 80
    targetPort: 8080
  type: NodePort

And here is my application.properties files (that is in the configmap data-index-properties):

quarkus.http.port=8080
quarkus.http.cors=true
quarkus.http.cors.origins=/.*/
quarkus.profile=http-events-support
#quarkus.log.category."org.kie.kogito.index".min-level=DEBUG
quarkus.log.category."org.kie.kogito.index".level=DEBUG
quarkus.log.category."io.quarkus.vertx.http".level=TRACE
quarkus.log.category."io.quarkus.arc".level=TRACE

quarkus.datasource.data_index.db-kind=postgresql
quarkus.datasource.jdbc.url=jdbc:postgresql://postgres-db-service.postgres:5432/sonataflow?currentSchema=data-index-service
quarkus.hibernate-orm.database.generation=update
quarkus.flyway.migrate-at-start=true
quarkus.flyway.table=data-index-flyway

#kogito.data-index.quarkus_profile=http-events-support

# Disable kafka client health check since the quarkus-http connector is being used instead.
quarkus.smallrye-health.check."io.quarkus.kafka.client.health.KafkaHealthCheck".enabled=false
#quarkus.kafka.devservices.enabled=false
#quarkus.kafka.health.enabled=false

# OIDC Configuration
quarkus.oidc.auth-server-url=https://keycloak.192.168.58.2.nip.io/realms/quarkus
quarkus.oidc.client-id=test
quarkus.oidc.credentials.secret=DP4yGzYhtdzGt9jEEJW7bvWmeqmekKii
quarkus.oidc.tls.verification=none
nmirasch commented 9 months ago

It is happening with whatever container that contains a quarkus application. The thing is that properties are processed in buildtime see https://quarkus.io/guides/all-config#quarkus-vertx-http_quarkus.http.auth.policy.-role-policy-.roles-allowed Those policies added in runtime are not being considered. If it's needed some kind security configuration, you will need to set that at container level. (https://kubernetes.io/docs/concepts/security/)