search

cyberark / conjur

CyberArk Conjur automatically secures secrets used by privileged users and machine identities
https://conjur.org
Other
780 stars 124 forks source link

Logging in using REST API + Basic Authn does not work on GET request #968

Closed sigalsax closed 5 years ago

sigalsax commented 5 years ago

Problem: Logging in as Alice using Basic Authn should not return a 401 error on GET request. I believe this to be a bug with Basic Authn.

When running ./start from conjur (OSS) and logging in as Alice with ‘secret’ as the password in Postman (using the basic authn format from the API docs), I am experiencing a 401 unauthorised error

Screen Shot 2019-04-16 at 17 39 44

API Docs

Screen Shot 2019-04-16 at 17 42 06

Starting OSS with oidc tag ./start —authn-oidc, I experience a 200 OK

Screen Shot 2019-04-16 at 17 47 01 1

Steps to reproduce:

  1. Navigate to Conjur repo
  2. Run OSS with ./start
  3. Start server with conjurctl server
  4. Navigate to Postman and create a GET request to http://localhost:3000/authn/cucumber/login according to API docs ** Can be done with curl as well
  5. Witness 401 error

To receive a 200 OK, need to run with Open IDC

  1. Navigate to Conjur repo
  2. Run OSS with ./start --authn-oidc
  3. Start server with conjurctl server
  4. Navigate to Postman and create a GET request to http://localhost:3000/authn/cucumber/login according to API docs ** Can be done with curl as well
  5. Witness 401 error
sigalsax commented 5 years ago

closing issue as we just had to add user to basic authn policy