Missing custom_id for new users accessing GWA

Darv72 commented 6 years ago

Describe the bug When logging into GWA with my IDIR ID I receive a 500 error. My account has been added to the gwa_admin and gwa_user groups. The logs show the following error following login:

2018-07-25 11:49:47,798 ERROR ca.bc.gov.gwa.servlet.authentication.SiteminderAuthenticationFilter Error getting user's roles ca.bc.gov.gwa.http.HttpStatusException: Bad Request PATCH https://kdadmin.api.gov.bc.ca/consumers/be8905c7-72ee-4e26-b137-e4d353072ffb HTTP/1.1

https://kdadmin.api.gov.bc.ca/consumers/be8905c7-72ee-4e26-b137-e4d353072ffb resolves to:

{ "custom_id": "github_27308661", "created_at": 1525798982.241, "username": "github_mrtrev", "id": "be8905c7-72ee-4e26-b137-e4d353072ffb" }

If I try to make a call for my own ID at https://kdadmin.api.gov.bc.ca/consumers/idir_sddarvil the custom_id field is null:

{ "custom_id": null, "created_at": 1532454967, "username": "idir_sddarvil", "id": "f1999ebe-8122-4585-992c-fbe9f174db70" }

This same behavior happened for a second IDIR ID as well.

To Reproduce Steps to reproduce the behavior:

Add an IDIR ID to the gwa_admin group
Login to GWA with those IDIR credentials, 500 error is returned
Query the ID through the Kong admin api https://kdadmin.api.gov.bc.ca/consumers/idir_
custom_id field is null

Expected behavior I should be able to access the GWA UI.

pauldaustin commented 6 years ago

Please include the full stack trace

Darv72 commented 6 years ago

2018-07-25 11:55:18,218 ERROR ca.bc.gov.gwa.servlet.authentication.SiteminderAuthenticationFilter Error getting user's roles ca.bc.gov.gwa.http.HttpStatusException: Bad Request PATCH https://kdadmin.api.gov.bc.ca/consumers/be8905c7-72ee-4e26-b137-e4d353072ffb HTTP/1.1 at ca.bc.gov.gwa.http.JsonHttpClient.executeRequest(JsonHttpClient.java:125) at ca.bc.gov.gwa.http.JsonHttpClient.executeRequestJson(JsonHttpClient.java:136) at ca.bc.gov.gwa.http.JsonHttpClient.patch(JsonHttpClient.java:167) at ca.bc.gov.gwa.servlet.ApiService.userGroups(ApiService.java:1611) at ca.bc.gov.gwa.servlet.AbstractFilter.getGroups(AbstractFilter.java:28) at ca.bc.gov.gwa.servlet.authentication.SiteminderAuthenticationFilter.doFilterLogin(SiteminderAuthenticationFilter.java:73) at ca.bc.gov.gwa.servlet.authentication.SiteminderAuthenticationFilter.doFilter(SiteminderAuthenticationFilter.java:45) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:198) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:478) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:80) at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:650) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:342) at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:799) at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:868) at org.apache.tomcat.util.net.Nio2Endpoint$SocketProcessor.doRun(Nio2Endpoint.java:1697) at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) at java.lang.Thread.run(Thread.java:748)

Darv72 commented 6 years ago

I changed the configuration file in test gwa to use gwaKongAdminUrl: https://kpadmin.api.gov.bc.ca and was able to successfully log into GWA. Leo believes the problem may be caused by collision with my ID as the https://kdadmin.api.gov.bc.ca endpoint is coming from a nested cluster.

pauldaustin commented 6 years ago

I'm closing this as a the application seems to be working as expected with the correct configuration.

Basically with the IDIR accounts, depending on how the consumer is created it maybe missing some information. I then fill in that information when my code runs.

Darv72 commented 6 years ago

Please do not close this issue as it will need to be addressed

pauldaustin commented 6 years ago

@Darv72 What still needs to be addressed?