gabriel-farache opened a new issue, #1922:
URL: https://github.com/apache/incubator-kie-kogito-apps/issues/1922
### Describe the bug
With the following properties are added to in the `application.properties`
of the data index instance (running on local minikube) to only allow some users
to access the graphql endpoint:
```
quarkus.http.auth.policy.role-policy1.roles-allowed=user
quarkus.http.auth.permission.roles1.paths=/graphql/*
quarkus.http.auth.permission.roles1.policy=role-policy1
```
But I get the following error:
```
Caused by: java.lang.RuntimeException: Unable to find HTTP security policy
role-policy1
at
io.quarkus.vertx.http.runtime.security.PathMatchingHttpSecurityPolicy.init(PathMatchingHttpSecurityPolicy.java:96)
at
io.quarkus.vertx.http.runtime.security.HttpSecurityRecorder$4.created(HttpSecurityRecorder.java:217)
at
io.quarkus.arc.runtime.ArcRecorder.initBeanContainer(ArcRecorder.java:73)
at
io.quarkus.deployment.steps.ArcProcessor$generateResources844392269.deploy_0(Unknown
Source)
at
io.quarkus.deployment.steps.ArcProcessor$generateResources844392269.deploy(Unknown
Source)
```
It's like the 1st property is ignored...
When setting those properties in a brand new quarkus project
(https://quarkus.io/guides/security-oidc-bearer-token-authentication-tutorial)
or inside a workflow project, there is no such error
### Expected behavior
No Error should be thrown and only user associated with the role `user`
shall be able to access `/graphql` endpoint
### Actual behavior
An error is thrown so the DataIndex is not starting
### How to Reproduce?
Steps to reproduce:
1. Add the following props to the application.properties file:
```
quarkus.http.auth.policy.role-policy1.roles-allowed=user
quarkus.http.auth.permission.roles1.paths=/graphql/*
quarkus.http.auth.permission.roles1.policy=role-policy1
```
2. Start the application or restart the pod
### Output of `uname -a` or `ver`
_No response_
### Output of `java -version`
_No response_
### GraalVM version (if different from Java)
_No response_
### Kogito version or git rev (or at least Quarkus version if you are using
Kogito via Quarkus platform BOM)
_No response_
### Build tool (ie. output of `mvnw --version` or `gradlew --version`)
_No response_
### Additional information
Here is the manifest I use to deploy the DataIndex service in minikue:
```
kind: Deployment
apiVersion: apps/v1
metadata:
name: data-index
spec:
replicas: 1
selector:
matchLabels:
app: data-index
template:
metadata:
labels:
app: data-index
spec:
containers:
- name: data-index
image: quay.io/kiegroup/kogito-data-index-postgresql:1.44.1
resources:
requests:
memory: "256Mi"
cpu: "500m"
limits:
memory: "512Mi"
cpu: "1000m"
ports:
- containerPort: 8080
env:
- name: QUARKUS_PROFILE
value: http-events-support
- name: KOGITO_DATA_INDEX_QUARKUS_PROFILE
value: http-events-support
- name: QUARKUS_HTTP_AUTH_POLICY__ROLE_POLICY12__ROLES_ALLOWED
value: user
- name: QUARKUS_HTTP_AUTH_PERMISSION__PERMISSIONS12__POLICY
value: ROLE_POLICY12
- name: QUARKUS_HTTP_AUTH_PERMISSION__PERMISSIONS12__PATH
value: /graphql/*
- name: QUARKUS_DATASOURCE_USERNAME
valueFrom:
secretKeyRef:
name: postgres-secrets
key: POSTGRES_USER
- name: QUARKUS_DATASOURCE_PASSWORD
valueFrom:
secretKeyRef:
name: postgres-secrets
key: POSTGRES_PASSWORD
volumeMounts:
- name: application-config
mountPath: "/home/kogito/config"
livenessProbe:
failureThreshold: 3
httpGet:
path: /q/health/live
port: 8080
scheme: HTTP
initialDelaySeconds: 0
periodSeconds: 30
successThreshold: 1
timeoutSeconds: 10
readinessProbe:
failureThreshold: 3
httpGet:
path: /q/health/ready
port: 8080
scheme: HTTP
initialDelaySeconds: 0
periodSeconds: 30
successThreshold: 1
timeoutSeconds: 10
volumes:
- name: application-config
configMap:
name: data-index-properties
initContainers:
- name: init-postgres
image: busybox:1.36
imagePullPolicy: IfNotPresent
command: ['sh', '-c', 'until nc -vz
postgres-db-service.postgres.svc.cluster.local 5432; do echo "Waiting for
postgres server"; sleep 3; done;']
---
kind: Service
apiVersion: v1
metadata:
name: data-index-service
labels:
app: data-index
spec:
selector:
app: data-index
ports:
- protocol: TCP
port: 80
targetPort: 8080
type: NodePort
```
And here is my application.properties files (that is in the configmap
`data-index-properties`):
```
quarkus.http.port=8080
quarkus.http.cors=true
quarkus.http.cors.origins=/.*/
quarkus.profile=http-events-support
#quarkus.log.category."org.kie.kogito.index".min-level=DEBUG
quarkus.log.category."org.kie.kogito.index".level=DEBUG
quarkus.log.category."io.quarkus.vertx.http".level=TRACE
quarkus.log.category."io.quarkus.arc".level=TRACE
quarkus.datasource.data_index.db-kind=postgresql
quarkus.datasource.jdbc.url=jdbc:postgresql://postgres-db-service.postgres:5432/sonataflow?currentSchema=data-index-service
quarkus.hibernate-orm.database.generation=update
quarkus.flyway.migrate-at-start=true
quarkus.flyway.table=data-index-flyway
#kogito.data-index.quarkus_profile=http-events-support
# Disable kafka client health check since the quarkus-http connector is
being used instead.
quarkus.smallrye-health.check."io.quarkus.kafka.client.health.KafkaHealthCheck".enabled=false
#quarkus.kafka.devservices.enabled=false
#quarkus.kafka.health.enabled=false
# OIDC Configuration
quarkus.oidc.auth-server-url=https://keycloak.192.168.58.2.nip.io/realms/quarkus
quarkus.oidc.client-id=test
quarkus.oidc.credentials.secret=DP4yGzYhtdzGt9jEEJW7bvWmeqmekKii
quarkus.oidc.tls.verification=none
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
