search

eclipse-hawkbit / hawkbit

Eclipse hawkBit™
https://projects.eclipse.org/projects/iot.hawkbit
Eclipse Public License 2.0
463 stars 188 forks source link

Authenticating with Target Token is allowed even if UI says it isn't #1369

Closed frjonsen closed 10 months ago

frjonsen commented 1 year ago

Possibly tangentially related to https://github.com/eclipse/hawkbit/pull/1074

By default, we want Target Token authentication to be allowed. Thus we have set hawkbit.server.ddi.security.authentication.targettoken.enabled=true in our `application.properties.

Launching Hawkbit and creating a target, I can indeed authenticate using the token (i.e. curl -v -H 'Authorization: TargetToken <token>' localhost:8080/default/controller/v1/<target> works fine).

However, going to http://localhost:8080/UI/#!spSystemConfig I noticed Allow targets to authenticate directly with their target security token is unchecked.

Primarily, this sounds like just a UI bug, but I also noticed that if I make a change to any other setting, such as Approve rollout before it can be started, then target token authentication is still unchecked and is now disabled, meaning I can no longer make the previously mentioned curl request until I checked the target token authentication box and save the settings again.

avgustinmm commented 10 months ago

It seems like enabling takes into account property + written into db

UI checks however only in db - thus UI issue - doesn't show the correct state Then, when you change a setting, I suppose all settings are filled into db - including target token auth enabled to false. That's why you cannot do it anymore - maybe UI shall apply changes only. So it seems UI bug only. Having that this UI is discontinued (Vaadin 8 UI is discontinued - https://eclipse.dev/hawkbit/blog/2023-11-22-vaadin8_ui_discontinuation/) I'll close the issue

manojams commented 10 months ago

Possibly tangentially related to #1074

By default, we want Target Token authentication to be allowed. Thus we have set hawkbit.server.ddi.security.authentication.targettoken.enabled=true in our `application.properties.

Launching Hawkbit and creating a target, I can indeed authenticate using the token (i.e. curl -v -H 'Authorization: TargetToken <token>' localhost:8080/default/controller/v1/<target> works fine).

However, going to http://localhost:8080/UI/#!spSystemConfig I noticed Allow targets to authenticate directly with their target security token is unchecked.

Primarily, this sounds like just a UI bug, but I also noticed that if I make a change to any other setting, such as Approve rollout before it can be started, then target token authentication is still unchecked and is now disabled, meaning I can no longer make the previously mentioned curl request until I checked the target token authentication box and save the settings again.

@frjonsen how did u resolved it , facing the same issue