Closed bsannicolas closed 4 years ago
Hi @bsannicolas, you shouldn't need to use a customs socket factory registry or route planner. Have you tried just with your first code snippet, without the custom factory registry or route planner?
val proxyEndpoint = URI.create(s"http://${proxyConfig.host}:${proxyConfig.port}")
val awsProxyConfig = ProxyConfiguration
.builder()
.username(proxyConfig.username)
.password(proxyConfig.password)
.endpoint(proxyEndpoint)
.build()
val awsHttpClient = ApacheHttpClient
.builder()
.withProxyConfiguration(awsProxyConfig)
.build()
A quick local test with the following code shows the SDK using plaintext HTTP to the proxy:
S3Client s3 = S3Client.builder()
.httpClient(ApacheHttpClient.builder()
.proxyConfiguration(ProxyConfiguration.builder()
.endpoint(HTTP_PROXY_ENDPOINT)
.build())
.build())
.build();
s3.listBuckets();
The problem is that it doesn't work when credentials are added. Internally, it looks like adding proxy configuration is the same as adding an httpRoutePlanner and, if authenticated, a credentials provider:
private void addProxyConfig(HttpClientBuilder builder,
DefaultBuilder configuration) {
ProxyConfiguration proxyConfiguration = configuration.proxyConfiguration;
Validate.isTrue(configuration.httpRoutePlanner == null || !isProxyEnabled(proxyConfiguration),
"The httpRoutePlanner and proxyConfiguration can't both be configured.");
Validate.isTrue(configuration.credentialsProvider == null || !isAuthenticatedProxy(proxyConfiguration),
"The credentialsProvider and proxyConfiguration username/password can't both be configured.");
HttpRoutePlanner routePlanner = configuration.httpRoutePlanner;
if (isProxyEnabled(proxyConfiguration)) {
log.debug(() -> "Configuring Proxy. Proxy Host: " + proxyConfiguration.host());
routePlanner = new SdkProxyRoutePlanner(proxyConfiguration.host(),
proxyConfiguration.port(),
proxyConfiguration.scheme(),
proxyConfiguration.nonProxyHosts());
}
CredentialsProvider credentialsProvider = configuration.credentialsProvider;
if (isAuthenticatedProxy(proxyConfiguration)) {
credentialsProvider = ApacheUtils.newProxyCredentialsProvider(proxyConfiguration);
}
if (routePlanner != null) {
builder.setRoutePlanner(routePlanner);
}
if (credentialsProvider != null) {
builder.setDefaultCredentialsProvider(credentialsProvider);
}
}
I've found that using only the http route planner does create an plaintext socket but if you specify a credentials provider this is no longer the case.
@bsannicolas apologies for the super long silence here. Are you still experiencing this issue? If so please reply with a comment and I'll investigate.
I think this ended up being related to our proxy configuration, but I can't say I remember the exact details. I don't think there is a problem with the SDK.
On Wed, Oct 7, 2020 at 8:28 PM Debora N. Ito notifications@github.com wrote:
@bsannicolas https://github.com/bsannicolas apologies for the super long silence here. Are you still experiencing this issue? If so please reply with a comment and I'll investigate.
— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/aws/aws-sdk-java-v2/issues/1234#issuecomment-705261947, or unsubscribe https://github.com/notifications/unsubscribe-auth/AL5XM2ZKYWQVYSFUQLYWNBTSJUBRBANCNFSM4HJHBUYA .
Thank you for the follow-up. Feel free to reach out if you have further issues.
Hey, I'm trying to set up the ApacheHttpClient to use a proxy without SSL, but I haven't been able to figure it out. I don't want SSL because my service makes all requests to localhost and a local proxy handles SSL with all remote services.
Here's my proxy configuration
I set the scheme to "http" hoping to get an unencrypted connection based on this:
but I get trust store errors (I don't have a trust store set up) with a stack trace through SSLConnectionSocketFactory.
I also tried using a route planner and credentials provider directly instead of the proxy configuration:
This also doesn't work. However, if I leave off the credentials provider it will in fact use the PlainConnectionSocketFactory (of course, I get 407 Proxy Authentication Required, so I need the credentials). Is there a way to configure this?