search

flowcate / deephub-advanced-setup

GNU General Public License v3.0
2 stars 1 forks source link

Race condition between token request and api calls when enabling oauth #4

Closed NilsEngelbach closed 1 week ago

NilsEngelbach commented 4 months ago

I have enabled oauth as described in the documentation / code example here on github.

Problem:

I am stuck on the "Login" page, reloading the page or hitting the "Login" Button only works sporadicaly.

Identified Cause:

It seems to me that there is a race condition between getting the inital token and making the first api requests.

Token Request is completed before first API Call:

image

image

Token Request is completed after first API Call (stuck on login page):

image

image

Since it is an timing issue it is hard to reproduce but setting the network speed to "Fast 3G" in Chrome DEV Tools made it reproducible for me.

Version: 2.5.0

wraromer commented 4 months ago

Hello Nils,

thanks for the report and especially the lengthy analysis. We will dig into this!

Wolfgang

wraromer commented 4 months ago

@NilsEngelbach: In case it does not work, do you reach the keycloak authentication page at least - see attached screenshot - or what does exactly happen? image

NilsEngelbach commented 4 months ago

Initially I get redirected to the IDP for authentication, after that I am "stuck" on the "Login Screen". Clicking "Login" reloads the page and with a little luck (timing as described above) the application opens...

I also recorded an example: login-2-blurred

As you can see, as soon as i open the dev tools it works...

wraromer commented 4 months ago

Concerning the screencast gif: Is it a coincidence that it always works in case the developer console is open?

NilsEngelbach commented 4 months ago

I think due to the logging etc. that is going on when opening the dev tools, the timing is just different enough to make it work. As mentioned if i change it to a slower network (e.g. Fast 3G) it always fails, even with Dev Tools open...

wraromer commented 3 months ago

We are working on a fix which will be released as a 2.5.1 version of DeepHub 2024 R1.

wraromer commented 3 months ago

The 2.5.1 bug fix release is now officially available. It fixes this race condition.

NilsEngelbach commented 3 months ago

Thank you for the quick fix! I just tested with the 2.5.1 version and it works.

Only two small problems i noticed.

  1. It used to be possible to enter the license key in the UI (when it was not provided as envrionment variable). It seems that this is no longer possible when enabling the authorization. I can see the screen to enter the license flashing up shortly, but then i am stuck on the login page.

The /lease request has an error because it is missing the authoriation header: image image

And all the API request fail because the license is invalid: image image

I also tried to add the /lease endpoint to the guest user in the permissions.yaml but this did not work either:

guest:
  description: A read only guest access
  '/health':
    - READ_ANY
  '/version':
    - READ_ANY
  '/lease':
    - READ_ANY

Only solution for me was to provide the license key as environment variable.

  1. The second "problem" i noticed is that it seems that the deephub is extracting the roles of the user from the realm_access.roles claim of the token. The claim name might be different for other identity provider than keycloak and ideally it would be configurable as environment variable as well (to support other claim names).

image

wraromer commented 3 months ago

Hello Nils,

concerning "It used to be possible to enter the license key in the UI": I would oppose this because you can login in the login screen and will then be redirected to the error page, claiming that no license was found or is invalid. There you can enter the license key.

I would therefore close this issue here as solved.

Concerning "deephub is extracting the roles of the user from the realm_access.roles claim of the token": we will dig into this.

Wolfgang

NilsEngelbach commented 3 months ago

No I am not redirected to the page to enter the license key thats the point.

wraromer commented 3 months ago

It works for us here. Could you please clear your browser's cache etc. to ensure that there is no "interference" with some older cookies etc., please.

NilsEngelbach commented 3 months ago

login-3-blurred

wraromer commented 3 months ago

I can confirm this happening with the Firefox browser on my Windows machine. It works fine when using the Edge browser. We'll investigate.

code-ha commented 2 weeks ago

Hello @NilsEngelbach , this has been fixed with the latest release of the DeepHub, version 2.5.3. Please let us know if everything looks good on your end.