Skip to content

Commit c6e5795

Browse files
ebocchiebocchi
committed
docs: oAuth troubles
1 parent e290fe7 commit c6e5795

File tree

1 file changed

+122
-0
lines changed

1 file changed

+122
-0
lines changed

‎docs/content/oauth_troubles.md

+122
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
## oAuth Troubles and Debugging in EOS
2+
3+
oAuth can be used for authentication by users accessing EOS via a fuse client.
4+
The example below is based on ScienceBox, with SWAN users accessing EOS through fusex. The oAuth tokens are created by the ocis (ownCloud Infinite Scale) identity provider.
5+
6+
EOS supports custom mapping fields for oAuth since version `4.8.68`. This allows for matching fields returned by the IDP in its json answer to EOS internal user information. See more at [EOS-5013](https://its.cern.ch/jira/browse/EOS-5013).
7+
8+
### Initial configuration
9+
- OpenID Connect Discovery at `https://edocker.cern.ch/.well-known/openid-configuration`
10+
- EOS oAuth configuration
11+
```sh
12+
eos vid enable oauth2
13+
eos vid set map -oauth2 key:edocker.cern.ch/konnect/v1/userinfo vuid:0
14+
```
15+
16+
Resulting in:
17+
```
18+
[root@sciencebox-mgm-0 /]# eos vid ls
19+
oauth2:"<pwd>":gid => root
20+
oauth2:"<pwd>":uid => root
21+
oauth2:"key:edocker.cern.ch/konnect/v1/userinfo":uid => root
22+
```
23+
- EOS reva user configured
24+
```sh
25+
eos -r 0 0 mkdir -p /eos/user/r/reva
26+
eos -r 0 0 chown 10001:15000 /eos/user/r/reva
27+
eos -r 0 0 chmod 2700 /eos/user/r/reva
28+
eos -r 0 0 attr set sys.acl=u:10001:rwx /eos/user/r/reva
29+
eos -r 0 0 attr set sys.mask=700 /eos/user/r/reva
30+
eos -r 0 0 attr set sys.allow.oc.sync=1 /eos/user/r/reva
31+
eos -r 0 0 attr set sys.mtime.propagation=1 /eos/user/r/reva
32+
eos -r 0 0 attr set sys.forced.atomic=1 /eos/user/r/reva
33+
eos -r 0 0 attr set sys.versioning=10 /eos/user/r/reva
34+
eos -r 0 0 access allow user 10001
35+
```
36+
- `nscd` and `nslcd` configured to provide EOS with the ability to resolve the username passed in the oAuth token. Local accounts would equally work.
37+
38+
39+
### Example of failed authentication
40+
The following log lines report a wrong mapping of the fields returned by the IDP:
41+
- EOS uses as `username` the field `sub` from the IDP (which is instead an internal random identifier)
42+
- `federation` and `email` fields are also not mapped properly
43+
44+
As a result, the oAuth user is mapped to `99:99` (`nobody`) and the authentication fails, resulting in permission denied
45+
```
46+
211102 11:15:48 INFO OAuth:106 token='eyJhbGciOiJQUzI1NiIs...' claims=[ kc.provider="identifier-ldap" kc.isAccessToken=true kc.identity={"kc.i.dn":"reva","kc.i.id":"cn=reva,ou=users,dc=example,dc=org","kc.i.un":"reva"} aud="swan-qa" jti="uJL0xHJAmNJ9z2HgSdOcVQFOviAE6XSV" exp=1635852122 iat=1635851522 sub="bWMsy-xSN7EHs8qz-zqLreSI3tXZlPc_zM9DukTpcTPHVJXFW6G-7nLggvQt4UvNKrwUtPI78jkON9RkziN2dA@konnect" kc.authorizedScopes=["email","profile","offline_access","openid"] iss="https:\/\/sciencebox.cernbox.cern.ch" ]
47+
211102 11:15:48 INFO OAuth:253 username='bWMsy-xSN7EHs8qz-zqLreSI3tXZlPc_zM9DukTpcTPHVJXFW6G-7nLggvQt4UvNKrwUtPI78jkON9RkziN2dA@konnect' name='reva' federation='' email='' expires=1635852122
48+
211102 11:16:06 time=1635851766.226921 func=Validate level=INFO logid=static.............................. unit=mgm@sciencebox-mgm-0.sciencebox-mgm.default.svc.cluster.local:1094 tid=00007f1deb5f6700 source=OAuth:106 tident= sec=(null) uid=99 gid=99 name=- geo="" token='eyJhbGciOiJQUzI1NiIs...' claims=[ kc.provider="identifier-ldap" kc.isAccessToken=true kc.identity={"kc.i.dn":"reva","kc.i.id":"cn=reva,ou=users,dc=example,dc=org","kc.i.un":"reva"} aud="swan-qa" jti="uJL0xHJAmNJ9z2HgSdOcVQFOviAE6XSV" exp=1635852122 iat=1635851522 sub="bWMsy-xSN7EHs8qz-zqLreSI3tXZlPc_zM9DukTpcTPHVJXFW6G-7nLggvQt4UvNKrwUtPI78jkON9RkziN2dA@konnect" kc.authorizedScopes=["email","profile","offline_access","openid"] iss="https:\/\/sciencebox.cernbox.cern.ch" ]
49+
211102 11:16:06 time=1635851766.226978 func=Handle level=INFO logid=static.............................. unit=mgm@sciencebox-mgm-0.sciencebox-mgm.default.svc.cluster.local:1094 tid=00007f1deb5f6700 source=OAuth:253 tident= sec=(null) uid=99 gid=99 name=- geo="" username='bWMsy-xSN7EHs8qz-zqLreSI3tXZlPc_zM9DukTpcTPHVJXFW6G-7nLggvQt4UvNKrwUtPI78jkON9RkziN2dA@konnect' name='reva' federation='' email='' expires=1635852122
50+
211102 11:16:06 time=1635851766.227164 func=FSctl level=ERROR logid=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx unit=mgm@sciencebox-mgm-0.sciencebox-mgm.default.svc.cluster.local:1094 tid=00007f1deb5f6700 source=Fsctl:242 tident=<single-exec> sec=oauth2 uid=2 gid=2 name=daemon geo="" user access restricted - unauthorized identity vid.uid=2, vid.gid=2, vid.host="[::ffff:172.17.0.5]", vid.tident="AAAAAAAE.25609:405@[::ffff:172.17.0.5]" for path="/proc/user/" user@domain="[email protected]]"
51+
211102 11:16:06 time=1635851766.227199 func=Emsg level=ERROR logid=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx unit=mgm@sciencebox-mgm-0.sciencebox-mgm.default.svc.cluster.local:1094 tid=00007f1deb5f6700 source=XrdMgmOfs:1207 tident=<single-exec> sec= uid=0 gid=0 name= geo="" Unable to give access - user access restricted - unauthorized identity used ; Permission denied
52+
```
53+
54+
55+
### Debugging from the fuse client
56+
The fuse client helps troubleshooting by manually attempting to connect to the EOS MGM.
57+
58+
In what follows, the fuse client was installed in the singleuser image used to spawn containers for users sessions.
59+
All the environment variables and paths refer to the singleuser environment
60+
- Validation of oAuth token:
61+
```
62+
curl -L -H "Authorization: Bearer $ACCESS_TOKEN" $OAUTH_INSPECTION_ENDPOINT
63+
{
64+
"email_verified": false,
65+
"family_name": "reva",
66+
"name": "reva",
67+
"preferred_username": "reva",
68+
"sub": "bWMsy-xSN7EHs8qz-zqLreSI3tXZlPc_zM9DukTpcTPHVJXFW6G-7nLggvQt4UvNKrwUtPI78jkON9RkziN2dA@konnect"
69+
}
70+
```
71+
- Preparation of the OAUTH2 file used by EOS client:
72+
```sh
73+
export OAUTH2_FILE=/tmp/eos_oauth.token
74+
export OAUTH2_TOKEN="FILE:$OAUTH2_FILE"
75+
echo -n oauth2:$ACCESS_TOKEN:$OAUTH_INSPECTION_ENDPOINT >& $OAUTH2_FILE
76+
chown -R $USER:$USER $OAUTH2_FILE
77+
chmod 600 $OAUTH2_FILE
78+
```
79+
- Output of working `eos reconnect`
80+
```
81+
$ eosxd get eos.reconnect /eos
82+
===== Retrieve process snapshot for pid=3723331, uid=1000, gid=1000, reconnect=1 =====
83+
-- /proc/3723331/root lookup
84+
jail identifier: st_dev=1048653, ino=76891320 -- DIFFERENT jail than eosxd!
85+
Found cached entry in ProcessCache (AAAAAAAQ - 4), but reconnecting as requested
86+
execveAlarm = 0, PF_FORKNOEXEC = 0, checkParentFirst = 0
87+
-- Attempting to discover bound identity based on environment variables
88+
-- Attempting to produce BoundIdentity out of process environment, pid=3723331
89+
Succeeded in retrieving environment variables for pid=3723331
90+
Found OAUTH2_TOKEN: /tmp/eos_oauth.token, need to validate
91+
-- Attempt to translate UserCredentials -> BoundIdentity
92+
Cache entry UserCredentials -> BoundIdentity already exists (AAAAAAAQ - 4) - invalidating
93+
Credential file must be copied - path: /var/cache/eos/fusex/credential-store/eos/eos-fusex-uuid-store-14c57ed9-0ec5-4cb3-84ca-88ab383c5d1a
94+
UserCredentials registerSSS (AAAAAAAU)
95+
Endorsement (oauth2:eyJhbGciOiJQUzI1NiIsImtpZCI6IiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJzd2FuIiwiZXhwIjoxNjQ4MDcxOTIzLCJqdGkiOiJfdnFhVUcyazJNOGpld1BtZC04OXRDdi05Z01HMWhPZyIsImlhdCI6MTY0ODA0MzEyMywiaXNzIjoiaHR0cHM6Ly9zY2llbmNlYm94LmNlcm5ib3guY2Vybi5jaCIsInN1YiI6Ilh0U2lfbWl5V1NCLXBrdkdueFBvQzVBNGZsaWgwVUNMZ3ZVN2NMd2ptakNLWDdGWW4ySFdrNnJSQ0V1eTJHNXFBeV95TVFjX0ZLOWFORmhVTXJYMnBRQGtvbm5lY3QiLCJrYy5pc0FjY2Vzc1Rva2VuIjp0cnVlLCJrYy5hdXRob3JpemVkU2NvcGVzIjpbInByb2ZpbGUiLCJvZmZsaW5lX2FjY2VzcyIsIm9wZW5pZCIsImVtYWlsIl0sImtjLmlkZW50aXR5Ijp7ImtjLmkuZG4iOiJlaW5zdGVpbiIsImtjLmkuaWQiOiJjbj1laW5zdGVpbixvdT11c2VycyxkYz1leGFtcGxlLGRjPW9yZyIsImtjLmkudW4iOiJlaW5zdGVpbiJ9LCJrYy5wcm92aWRlciI6ImlkZW50aWZpZXItbGRhcCJ9.aWn-w4PdYBCWaDxnYZ_oKbOD_P39B1PnSiIh53XxrTVWILJSLiqYM6OG6SKrppPcXQrxDBdfcOFKALV7-3XNMPmNJkCz0395T7iNNvU3hARbwfndvtbl9_OrHLFwl39F6sqYUYwzNbslxYhJRtGPFK6dge9sUVKAeqq-k3vZXv2xmnF0GeoVumknBPrV5yKzfU8hUqxXGAp4rivA5H9MakAbIAbj1qhkyUgKc3EScgEB-3byMcUtB21WoHBbRQ_sKOqtZJFQglk9SyR0M-G5neAydu87kngpys9BDa6MXLS2UemJ9HJ4Zcg71CilB0hKs3q6RPkhL931Yevt0sxKSw:sciencebox.cernbox.cern.ch/konnect/v1/userinfo)
96+
97+
===== BOUND IDENTITY: =====
98+
Login identifier: AAAAAAAU - 5
99+
oauth2: /tmp/eos_oauth.token for uid=1000, gid=1000, under jail identifier: st_dev=1048653, ino=76891320
100+
mtime: 1648043262.149861432
101+
intercepted path: /var/cache/eos/fusex/credential-store/eos/eos-fusex-uuid-store-14c57ed9-0ec5-4cb3-84ca
102+
```
103+
- The content of files `/tmp/eos_oauth.token` in the singeuser container and `/var/cache/eos/fusex/credential-store/eos/eos-fusex-uuid-store-14c57ed9-0ec5-4cb3-84ca` (or whatever uuid store) in the fusex container must match.
104+
105+
106+
### Fixing username mapping in EOS
107+
Since version `4.8.68`, the EOS username can be mapped to an arbitrary fields of the IDP response with the environment variable `EOS_MGM_OIDC_MAP_FIELD` (see [EOS-5013](https://its.cern.ch/jira/browse/EOS-5013)).
108+
Currently, in ScienceBox with the ocis IDP and self-signed certificates, we use:
109+
- `EOS_MGM_OIDC_INSECURE=true` to accept bad certificates
110+
- `EOS_MGM_OIDC_MAP_FIELD="preferred_username"` to maps EOS username to the `preferred_username` of the IDP response
111+
112+
...ultimately fixing the authentication problem with oAuth
113+
- BAD:
114+
```
115+
220323 12:50:58 INFO OAuth:106 token='eyJhbGciOiJQUzI1NiIs...' claims=[ kc.provider="identifier-ldap" kc.isAccessToken=true kc.identity={"kc.i.dn":"reva","kc.i.id":"cn=reva,ou=users,dc=example,dc=org","kc.i.un":"reva"} aud="swan" jti="4oIkT103IOiKu0B-AH8PVfw6pJUTTiJz" exp=1648068618 iat=1648039818 sub="bWMsy-xSN7EHs8qz-zqLreSI3tXZlPc_zM9DukTpcTPHVJXFW6G-7nLggvQt4UvNKrwUtPI78jkON9RkziN2dA@konnect" kc.authorizedScopes=["openid","email","profile","offline_access"] iss="https:\/\/sciencebox.cernbox.cern.ch" ]
116+
220323 12:50:58 INFO OAuth:253 username='bWMsy-xSN7EHs8qz-zqLreSI3tXZlPc_zM9DukTpcTPHVJXFW6G-7nLggvQt4UvNKrwUtPI78jkON9RkziN2dA@konnect' name='reva' federation='' email='' expires=1648068618
117+
```
118+
- GOOD:
119+
```
120+
220323 14:50:54 INFO OAuth:106 token='eyJhbGciOiJQUzI1NiIs...' claims=[ kc.provider="identifier-ldap" kc.isAccessToken=true kc.identity={"kc.i.dn":"reva","kc.i.id":"cn=reva,ou=users,dc=example,dc=org","kc.i.un":"reva"} aud="swan" jti="cw8R6sCtSfJeIJzX7dy1gyjcmpDKjwfb" exp=1648075770 iat=1648046970 sub="XtSi_miyWSB-pkvGnxPoC5A4flih0UCLgvU7cLwjmjCKX7FYn2HWk6rRCEuy2G5qAy_yMQc_FK9aNFhUMrX2pQ@konnect" kc.authorizedScopes=["offline_access","openid","email","profile"] iss="https:\/\/sciencebox.cernbox.cern.ch" ]
121+
220323 14:50:54 INFO OAuth:258 username='reva' name='reva' federation='' email='' expires=1648075770
122+
```

0 commit comments

Comments
 (0)