Jarown opened a new issue, #6166:
URL: https://github.com/apache/couchdb/issues/6166
### Description
After upgrading from 3.5.2 to 3.5.3, JWT authentication stopped working and
all Bearer-token requests returned 401. Basic auth kept working.
Our `[chttpd]` config:
```ini
[chttpd]
authentication_handlers = {couch_httpd_auth, jwt_authentication_handler},
{chttpd_auth, default_authentication_handler}
require_valid_user = true
```
#6152 changed `chttpd:set_auth_handlers/0` to map entries through a fixed
whitelist. Only the short names and the `{chttpd_auth, ...}` tuples are
accepted. Any other entry falls through to `authentication_handler_map(_) ->
false` and is dropped without a log message.
In 3.5.2, `chttpd_auth:jwt_authentication_handler/1` just delegates to
`couch_httpd_auth:jwt_authentication_handler/1`, and both were exported. The
configured tuple was valid and worked. The PR states that "for compatibility we
still accept existing tuple forms", but this functionally equivalent tuple is
no longer accepted, in a patch release.
### Steps to Reproduce
1. Run CouchDB 3.5.3 with the config above and a valid `[jwt_keys]` /
`[jwt_auth]` setup.
2. `curl -H "Authorization: Bearer <valid token>"
http://localhost:5984/_session`
3. The response is a 401 (or `"authenticated"` is not `"jwt"`). The same
request works on 3.5.2.
4. `GET /_node/_local/_config/chttpd/authentication_handlers` still shows
the configured value, and nothing in the log shows that the JWT handler was
dropped.
### Expected Behaviour
- Either keep accepting previously working tuples (for example by falling
back to the old `make_arity_1_fun` behaviour for unknown `{Module, Function}`
entries),
- or at least log a warning or error at startup for each ignored entry, so a
misconfiguration is visible instead of silently disabling an authentication
method.
### Workaround
Change the entry to `{chttpd_auth, jwt_authentication_handler}` or `jwt`.
### Your Environment
- CouchDB version used: 3.5.3 (official Docker image, tag `couchdb:3.5`)
- Operating system and version: Linux (Docker)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
