Commits on Aug 30, 2021

1. OIDC: Fix issues with subset of services. …

   By default, APICast stores all services in an array of Service Objects, also,
   another array with the OIDC objects, something like this:
   
   ```
   {
     "services": [
       {
         "id": 1,
         "issuer": "http://foo.com",
         "auth_type": "oidc",
         ...
       },
       {
         "id": 2,
         "auth_type": "provider_key"
         ...
       },
       {
         "id": 3,
         "issuer": "http://bar.com",
         "auth_type": "oidc",
         ...
       }
     ],
     "oidc": [
       {
         "issuer": "http://foo.com",
         ...
       },
       false,
       {
         "issuer": "http://bar.com",
         ...
       }
     ]
   }
   ```
   
   The mapping, on APICast config is like this:
   
   ```
   service[0] using oidc[0]
   service[1] using oidc[1]
   service[2] using oidc[2]
   ```
   
   When we filter using `APICAST_SERVICE_LIST`, it filters based on the array, so
   it'll transform to this:
   
   export APICAST_SERVICE_LIST=3
   
   ```
   {
     "services": [
       {
         "id": 3,
         "issuer": "http://bar.com",
         "auth_type": "oidc",
         ...
       }
     ],
     "oidc": [
       false,
       {
         "issuer": "http://bar.com",
         ...
       }
     ]
   }
   ```
   
   So, OIDC will fail, because the first entry of the OIDC array is false, because
   false is added on filtering.
   
   This PR added a new entry on oidc object, that it's service_id, so filtering can
   be done without issues, config will be like this:
   
   ```
   {
     "services": [
       {
         "id": 1,
         "issuer": "http://foo.com",
         "auth_type": "oidc",
         ...
       },
       {
         "id": 2,
         "auth_type": "provider_key"
         ...
       },
       {
         "id": 3,
         "issuer": "http://bar.com",
         "auth_type": "oidc",
         ...
       }
     ],
     "oidc": [
       {
         "issuer": "http://foo.com",
         "service_id": 1,
         ...
       },
       {
         "service_id": 2,
       },
       {
         "issuer": "http://bar.com",
         "service_id": 3,
         ...
       }
     ]
   }
   ```
   
   On non-oidc services, the oidc will be not hitted at all. On invalid fetch,
   It'll be not fail, because the issuer is not in there, so it'll not work as
   expected.
   
   OIDC config links:
   
   Service OIDC setup:
   https://github.com/3scale/APIcast/blob/c184ff3e904f3d75857032a3da0004f8d74eba00/gateway/src/apicast/configuration/service.lua#L221-L231
   
   OIDC error on invalid oicd setup:
   https://github.com/3scale/APIcast/blob/c184ff3e904f3d75857032a3da0004f8d74eba00/gateway/src/apicast/oauth/oidc.lua#L55
   
   Warning message:
   
   https://github.com/3scale/APIcast/blob/c184ff3e904f3d75857032a3da0004f8d74eba00/gateway/src/apicast/proxy.lua#L199-L205
   
   Filtering part:
   https://github.com/3scale/APIcast/blob/c184ff3e904f3d75857032a3da0004f8d74eba00/gateway/src/apicast/configuration.lua#L173-L297
   
   Fix: THREESCALE-6042
   Reported-by: Kevin Price <kevprice@redhat.com>
   Reported-by: Samuele Illuminati <sillumin@redhat.com>
   Signed-off-by: Eloy Coto <eloy.coto@acalustra.com>

   

   eloycoto committed Aug 30, 2021
   Configuration menu

   • View commit details
   • Copy full SHA for 0a6e5f5
   • Browse repository at this point

   Copy the full SHA

   0a6e5f5 View commit details

   Browse the repository at this point in the history