counteractive / o365beat

Elastic Beat for fetching and shipping Office 365 audit events
Other
66 stars 27 forks source link

Response body not printed for authentication errors which hinders debugging. #21

Closed chris-counteractive closed 4 years ago

chris-counteractive commented 4 years ago

Debugging and error information for authentication issues should be just as verbose as during API calls. The most common error during auth is an incorrect client secret, but the current debugging output won't show those details, it just says ERROR instance/beat.go:877 Exiting: non-200 status during auth. and the response object, but not the response body which has the good stuff in it.

Fix is to match the API call debug message and include the body.

chris-counteractive commented 4 years ago

The fix gives this output for incorrect client secret, for example, which should help when troubleshooting/debugging connection issues:

Exiting: non-200 status during auth.
        check client secret and other config details.
        req: &{<request-object>}
        res: &{<response-object>}
        {"error":"invalid_client","error_description":"AADSTS7000215: Invalid client secret is provided.<snip>}
aymenwerg commented 4 years ago

Hii chris, did you find a solution for this problem I have the same Error

chris-counteractive commented 4 years ago

@aymenwerg - yes indeed, the versions since 4430cfc all print the authentication requests and responses. I just replied to your email, if you email me your config file (o365beat.yml) and more of your error output (as much as you can provide), I should be able to help diagnose the issue. Thanks!

chris-counteractive commented 4 years ago

@aymenwerg - the specific, most useful lines of the debugging output are the lines starting with req and res after the error message (check client secret and other config details.). They can contain potentially sensitive info, so please send them via email. Thanks!