prohtex
commented
3 months ago Hi @micbar, hope you are well! Any idea why this might be happening? I could not find any documentation for upgrading from prerelease v5 to 5.0.5 or from 5 to 6. I am just assuming the upgrade path for the precompiled binaries is to swap out the binary, but if there are more steps I'd be grateful for a point in the right direction.
It seems like "Cannot get user by claim" has something to do with my authentication method, but beyond that I'm lost.
Here's the script I use to run OCIS on macos as well as the contents of my ocis.yaml
#!/bin/bash
export OCIS_URL=https://files.<redacted>.com
export PROXY_HTTP_ADDR=0.0.0.0:9200
export PROXY_TLS=true
export OCIS_INSECURE=true
export OCIS_LOG_LEVEL=error
export OCIS_CONFIG_DIR=/opt/ocis
export OCIS_BASE_DATA_PATH=/Volumes/<redacted>/ocis
export PROXY_ENABLE_BASIC_AUTH=true
#export IDP_ACCESS_TOKEN_EXPIRATION=86400
#export IDP_ID_TOKEN_EXPIRATION=86400
export OCIS_SERVICE_ACCOUNT_ID=<redacted-j>
export OCIS_SERVICE_ACCOUNT_SECRET=<redacted-k>
ulimit -n 1024
#/opt/local/bin/ocis server
/opt/local/bin/ocis-5.0.5-darwin-amd64 server
#/opt/local/bin/ocis-6.0.0-darwin-amd64 servertoken_manager:
jwt_secret: <redacted-a>
machine_auth_api_key: <redacted-b>
system_user_api_key: <redacted-c>
transfer_secret: <redacted-d>
system_user_id: <redacted-e>
admin_user_id: <redacted-f>
graph:
application:
id: 4<redacted-g>
events:
tls_insecure: true
spaces:
insecure: true
identity:
ldap:
bind_password: <redacted-i>
service_account:
service_account_id: <redacted-j>
service_account_secret: <redacted-k>
idp:
ldap:
bind_password: <redacted-l>
idm:
service_user_passwords:
admin_password: <redacted-m>
idm_password: <redacted-i>
reva_password: <redacted-n>
idp_password: <redacted-l>
proxy:
oidc:
insecure: true
insecure_backends: true
service_account:
service_account_id: <redacted-j>
service_account_secret: <redacted-k>
frontend:
app_handler:
insecure: true
archiver:
insecure: true
service_account:
service_account_id: <redacted-j>
service_account_secret: <redacted-k>
auth_basic:
auth_providers:
ldap:
bind_password: <redacted-n>
auth_bearer:
auth_providers:
oidc:
insecure: true
users:
drivers:
ldap:
bind_password: <redacted-n>
groups:
drivers:
ldap:
bind_password: <redacted-n>
ocdav:
insecure: true
thumbnails:
thumbnail:
transfer_secret: <redacted-o>
webdav_allow_insecure: true
cs3_allow_insecure: true
search:
events:
tls_insecure: true
service_account:
service_account_id: <redacted-j>
service_account_secret: <redacted-k>
audit:
events:
tls_insecure: true
settings:
service_account_ids:
- <redacted-j>
sharing:
events:
tls_insecure: true
storage_users:
events:
tls_insecure: true
mount_id: <redacted-p>
service_account:
service_account_id: <redacted-j>
service_account_secret: <redacted-k>
notifications:
notifications:
events:
tls_insecure: true
service_account:
service_account_id: <redacted-j>
service_account_secret: <redacted-k>
nats:
nats:
tls_skip_verify_client_cert: true
gateway:
storage_registry:
storage_users_mount_id: <redacted-p>
userlog:
service_account:
service_account_id: <redacted-j>
service_account_secret: <redacted-k>
auth_service:
service_account:
service_account_id: <redacted-j>
service_account_secret: <redacted-k>
clientlog:
service_account:
service_account_id: <redacted-j>
service_account_secret: <redacted-k>
micbar
ScharfViktor
meveric
2403905
I have an OCIS deployment running on macos. I recently upgraded from a 5.0 alpha to 5.0.5 by replacing the binary and adding the needed OCIS_SERVICE_ACCOUNT and OCIS_SERVICE_ACCOUNT_SECRET env vars.
When I attempt to download a file from the web, I get a standard apache web authentication dialogue. Clicking "cancel" results in a 0b file. Very odd.
Below is the terminal output from the server. The relevant messages seem to be "proxy error signature match" "Could not get user by claim"