Bug 1879748 - elasticsearch-proxy hides 401 auth response from api server by always returning 500
Summary: elasticsearch-proxy hides 401 auth response from api server by always returni...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Logging
Version: 4.6
Hardware: Unspecified
OS: Unspecified
unspecified
medium
Target Milestone: ---
: 4.6.0
Assignee: Jeff Cantrill
QA Contact: Qiaoling Tang
URL:
Whiteboard:
Depends On:
Blocks: 1883663
TreeView+ depends on / blocked
 
Reported: 2020-09-16 21:17 UTC by Jeff Cantrill
Modified: 2020-10-27 15:13 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Cause: Auth failures were not evaluated for 401 responses Consequence: The proxy always returns 500 Fix: Return 401 from the api server Result: User's get a correct auth response in lieu of a server failure
Clone Of:
Environment:
Last Closed: 2020-10-27 15:12:50 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github openshift elasticsearch-proxy pull 47 0 None closed Bug 1879748: return 401 from api server 2021-02-08 20:04:06 UTC
Red Hat Product Errata RHBA-2020:4198 0 None None None 2020-10-27 15:13:15 UTC

Description Jeff Cantrill 2020-09-16 21:17:09 UTC 
Description of problem:

The proxy improperly evaluates responses when making requests against the API server.  If the request fails due to something like a 401, the proxy masks that error returning a 500

Version-Release number of selected component (if applicable):


How reproducible:
Always

Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:

Return the actual error
Comment 2 Qiaoling Tang 2020-09-24 07:11:30 UTC 
@Jeff, I can see the below errors, are these what the bug has fixed?

$ oc logs -c proxy elasticsearch-cdm-7no5abmu-3-6cddf49f9f-tpgzf 
time="2020-09-24T06:52:17Z" level=info msg="mapping path \"/\" => upstream \"https://localhost:9200/\""
time="2020-09-24T06:52:17Z" level=info msg="HTTPS: listening on [::]:60001"
time="2020-09-24T06:52:17Z" level=info msg="HTTPS: listening on [::]:60000"
time="2020-09-24T06:52:17Z" level=info msg="Error processing request in handler authorization: Unable to determine username"
time="2020-09-24T06:52:20Z" level=info msg="Error processing request in handler authorization: Unable to determine username"
time="2020-09-24T06:52:20Z" level=info msg="Error processing request in handler authorization: got 401 [invalid bearer token, token lookup failed]"

image: ose-elasticsearch-proxy/images/v4.6.0-202009231847.p0
Comment 3 Qiaoling Tang 2020-09-25 07:27:51 UTC 
From the Kibana console, I can see the error: Unauthorized xxxx.

Move to verified.
Comment 6 errata-xmlrpc 2020-10-27 15:12:50 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (OpenShift Container Platform 4.6.1 extras update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:4198
Note You need to log in before you can comment on or make changes to this bug.