Add proxy authentication to WebSocketPoolableConnectionFactory

[davenunn]

Please add a capability to set the proxy username and password by configuration in addition to the proxy server and port. I cannot run Predix micro-services locally because my corporate firewall requires authentication.

Within the WebSocketPoolableConnectionFactory.detectAndSetProxy method an additional call to the setCredentials method is required if a proxy username and password are specified. The proxy user and password would also need to be added to the IOauthRestConfig interface, etc. so they can be configured in the same manner as proxy server and port.

Thanks,

Dave

[turnerth]

I seem to recall they are set via a configuration file. Otherwise the test case would fail. Will take a look.

[turnerth]

e.g. like this in the config/application.properties
predix.oauth.proxyHost=ourproxy.crd.ge.com
predix.oauth.proxyPort=8080

I took a look at the detectAndSetProxy method and it gets those variables from here...
settings.setServer("http://" + this.config.getOauthProxyHost() + ":" + this.config.getOauthProxyPort());

Well, Spring populates those variables when the application context is spinning up. Like this...
https://github.com/PredixDev/predix-rest-client/blob/master/src/main/java/com/ge/predix/solsvc/restclient/config/DefaultOauthRestConfig.java#L183-L215

That method is a little crazy. The intent is to allow the developer to use a property file or use -D env params or use regular old env vars in the OS. This is based on some usability studies we saw and usage in the wild. This is all standard spring boot property stuff.

In any case, it's definitely using the proxy from the property files because when I remove them the tests start to fail.

[turnerth]

I checked the config/application.properties file. it says this.

#if you are behind a corporate proxy/firewall and want to access Predix Cloud
#predix.oauth.proxyHost =put.your.proxyHost.here
#predix.oauth.proxyPort=put.your.proxyPort.here

[davenunn]

Thanks for taking a look. I have got the proxy server and proxy port functionality set-up as you describe.

The issue is that within the WebSocketPoolableConnectionFactory there is no implementation to set the proxyUser and proxyPassword using the setCredentials method of the nv-websocket-client as described in the HttpProxy section here: https://github.com/TakahikoKawasaki/nv-websocket-client

My corporate proxy server requires authentication to access the Internet. There is no access without credentials being supplied. I have tried many combinations of environment variables and settings (both in the OS and Eclipse) to provide this information but without success.

[turnerth]

Hi Dave. I don't have a proxy server with a username/password to test with. I'm wondering if you could do me a favor. In predix-rest-client, right around line 172 you'll find this.

if (localProxyHost != null && !localProxyHost.equals("")) { //$NON-NLS-1$

Could you add this code? You could create some local vars with the proxyUser and proxyPassword.
if (proxyUser != null && !proxyPassword.equals("")) { //$NON-NLS-1$
CredentialsProvider credsProvider = new BasicCredentialsProvider();
credsProvider.setCredentials(new AuthScope(localProxyHost, Integer.valueOf(proxyPort)),
new UsernamePasswordCredentials(proxyUser, proxyPassword));
builder.setDefaultCredentialsProvider(credsProvider);
}

If it works for you let me know. I'll change the method to pass in the proxyUser and proxyPassword and then set up some Properties that can be read in and passed in.

[davenunn]

Thanks for the code.
Yes, I will try the code tomorrow and let you know.

[turnerth]

Looks like we also need to add this in the detectAndSetProxy() method.

if ( this.config.getProxyUser() != null )
settings.setId(this.config.getProxyUser());
if ( this.config.getProxyPassword() != null )
settings.setPassword(this.config.getProxyPassword());

Of course for you, you'll need to hard code it, since it's not in the config yet of the current production predix-rest-client.

Even though I can't test it like I'd want to, I believe we have the right set of additions to the code. This will go out with the next release.

In that release the spelling of predix.oauth.proxyHost will change to predix.rest.proxyHost. This is because it gets used for all REST calls not just the one to get the UAA token. Same for proxyPort variable.

There will be two new properties predix.rest.proxyUser and predix.rest.proxyPassword. This will be used for both predix-rest-client as well as the predix-websocket-client.

As I said, if you can test this out we'd be very appreciative. I tried it in our network and it works with a good proxy user and password and a fake proxy user and password, so it's essentially ignored by our proxy server. Unless we set up a mock proxy server it's hard to test. I found a mock one, but it didn't support user/password.

[turnerth]

To clarify, both changes are needed.

1. Predix-rest-client needs to set the HTTP proxy user/pass to get the UAA Token.
2. predix-websocket-client needs to set the WebSocket proxy user/pass to send the Time Series data.

[davenunn]

The code changes worked beautifully - thank you!

In predix-rest-client
I added the code as-supplied to the RestClientImpl.getHttpClient method, just after the existing proxy server setup (within the IF clause - immediately after the builder.setRoutePlanner call).

I added imports for:
org.apache.http.client.CredentialsProvider;
org.apache.http.auth.AuthScope;
org.apache.http.auth.UsernamePasswordCredentials;
org.apache.http.impl.client.BasicCredentialsProvider;

In predix-websocket-client
I added the code as-supplied to the WebSocketPoolableConnectionFactory.detectAndSetProxy method, just after the existing proxy server setup (within the IF clause - immediately after the settings.setServer call). This worked OK but can I suggest using the following instead (to require both username and password) in order to be consistent with the predix-rest-client:

        if ( proxyUser != null && proxyPass != null ) {
        	settings.setCredentials(proxyUser,proxyPass);
        }

This works as well...

Thanks for your help. Any idea when this change may be released?

Dave