GRPC Gateway authentication fails on version v3.4.*

[Revolution1]

I followed the doc here https://github.com/etcd-io/etcd/blob/v3.4.3/Documentation/dev-guide/api_grpc_gateway.md

Run this exact script from the doc:

# create root user
curl -L http://localhost:2379/v3/auth/user/add \
  -X POST -d '{"name": "root", "password": "pass"}'
# {"header":{"cluster_id":"14841639068965178418","member_id":"10276657743932975437","revision":"1","raft_term":"2"}}

# create root role
curl -L http://localhost:2379/v3/auth/role/add \
  -X POST -d '{"name": "root"}'
# {"header":{"cluster_id":"14841639068965178418","member_id":"10276657743932975437","revision":"1","raft_term":"2"}}

# grant root role
curl -L http://localhost:2379/v3/auth/user/grant \
  -X POST -d '{"user": "root", "role": "root"}'
# {"header":{"cluster_id":"14841639068965178418","member_id":"10276657743932975437","revision":"1","raft_term":"2"}}

# enable auth
curl -L http://localhost:2379/v3/auth/enable -X POST -d '{}'
# {"header":{"cluster_id":"14841639068965178418","member_id":"10276657743932975437","revision":"1","raft_term":"2"}}

# get the auth token for the root user
curl -L http://localhost:2379/v3/auth/authenticate \
  -X POST -d '{"name": "root", "password": "pass"}'
# {"header":{"cluster_id":"14841639068965178418","member_id":"10276657743932975437","revision":"1","raft_term":"2"},"token":"sssvIpwfnLAcWAQH.9"}

And I get these result

{"header":{"cluster_id":"11588568905070377092","member_id":"128088275939295631","revision":"1","raft_term":"2"}}{"header":{"cluster_id":"11588568905070377092","member_id":"128088275939295631","revision":"1","raft_term":"2"}}{"header":{"cluster_id":"11588568905070377092","member_id":"128088275939295631","revision":"1","raft_term":"2"}}{"header":{"cluster_id":"11588568905070377092","member_id":"128088275939295631","revision":"1","raft_term":"2"}}{"error":"etcdserver: authentication failed, invalid user ID or password","message":"etcdserver: authentication failed, invalid user ID or password","code":3}

Somehow I cannot add user using grpc gayway.

And:

• Only happens with version >= v3.4.0
• If I add user using etcdctl, the auth (gen token) api through grpc gatway works well

[jingyih]

Probably a bug in

etcd/auth/store.go

Line 391 in d1139d3

if r.Options != nil && !r.Options.NoPassword {

If the request does not have Option field, we should not end up storing empty byte slice hashed as password.

[jingyih]

@YoyinZyc PTAL