search

opensearch-project / opensearch-java

Java Client for OpenSearch
Apache License 2.0
115 stars 181 forks source link

[BUG] Clear scroll request fails with sigv4 signature mismatch for java client 2.8.0 #712

Open mschmie opened 10 months ago

mschmie commented 10 months ago

What is the bug?

clearScroll request to opensearch client fails with sigv4 signing mismatch:

org.opensearch.client.opensearch._types.OpenSearchException: Request failed: [security_exception] The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details.

The Canonical String for this request should have been 'DELETE /_search/scroll

... remaining request info...

How can one reproduce the bug?

How can one reproduce the bug?

Create an OpenSearchClient following instructions from here (https://opensearch.org/docs/2.7/clients/java/#connecting-to-amazon-opensearch-service) and then attempt to use the client's clearScroll API.

I believe this is because it is a DELETE request with a body. The search/scroll method works as intended. Sending the request results in a sigv4 error

What is the expected behavior?

The clearScroll API call does not have a signature mismatch

What is your host/environment?

Ubuntu 22.04 implementation 'org.opensearch.client:opensearch-java:2.8.0'

Do you have any screenshots?

If applicable, add screenshots to help explain your problem.

Do you have any additional context?

Add any other context about the problem.

houssain-barouni commented 9 months ago

Hello,

any updates or hints about this issue ? We have got the same issue when using Opensearch in AWS

Best regards,

dblock commented 9 months ago

AFAIK nobody is working on this. Want to help?

  1. Double check whether this is/not reproduced with curl against the Amazon managed service and serverless, https://code.dblock.org/2022/07/11/making-sigv4-authenticated-requests-to-managed-opensearch.html can help.
  2. Expand the existing POST tests for Sigv4 to DELETE and let's see if it's as trivial as always signing the body on a DELETE.
dblock commented 9 months ago

Is this a dup of https://github.com/opensearch-project/opensearch-java/issues/521? There's a failing integration test in https://github.com/opensearch-project/opensearch-java/issues/712 if you want to fix this and include it.

houssain-barouni commented 8 months ago

Replacing ApacheHttpClient by NettyNioAsyncHttpClient solves the issue. cf https://github.com/opensearch-project/data-prepper/pull/3338