Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unable to use /run endpoint with token authentication #56168

Open
maxfactor1 opened this issue Feb 14, 2020 · 0 comments
Open

Unable to use /run endpoint with token authentication #56168

maxfactor1 opened this issue Feb 14, 2020 · 0 comments
Labels
Bug broken, incorrect, or confusing behavior Salt-API severity-medium 3rd level, incorrect or bad functionality, confusing and lacks a work around
Milestone

Comments

@maxfactor1
Copy link

maxfactor1 commented Feb 14, 2020

Description of Issue

Reading the docs on how to use the salt-api /run endpoint tells me that the following should work:

curl -sS localhost:8000/run \
    -H 'Accept: application/x-yaml' \
    -H 'Content-type: application/json' \
    -d '[{
        "client": "local",
        "tgt": "*",
        "fun": "test.ping",
        "token": "<salt eauth token here>"
    }]'

I have created a token and ran the code above, and I am receiving a 401 error:
2020-02-14T16:29:08Z [salt.auth][WARNING] Authentication failure of type "token" occurred.
2020-02-14T16:29:08Z [salt.master][WARNING] Authentication failure of type "token" occurred.

Setup

My salt eauth setup, I am using an ldap service account for this named 'automation_user'. That account can create a token, and use that same token against other endpoints. It appears to only have issues with endpoints where the token is included in the data. If the token is part of the header there is no issue.

auth.ldap.accountattributename: sAMAccountName
auth.ldap.activedirectory: true
auth.ldap.anonymous: false
auth.ldap.auth_by_group_membership_only: false
auth.ldap.basedn: DC=example,DC=com
auth.ldap.filter: sAMAccountName={{ username }}
auth.ldap.groupclass: group
auth.ldap.no_verify: true
auth.ldap.persontype: person
auth.ldap.port: 636
auth.ldap.scope: 2
auth.ldap.server: ldap.example.com
auth.ldap.tls: true
external_auth:
  ldap:
    ldap_admin_group%:
    - .*
    - '@wheel'
    - '@runner'
    automation_user:
    - .*
    - '@runner'
fileserver_backend:
- gitfs
- roots
gitfs_base: develop
gitfs_provider: pygit2
gitfs_saltenv_whitelist:
- base
id: salt-master-0-staging.example.com
log_datefmt: '%Y-%m-%dT%H:%M:%SZ'
log_datefmt_logfile: '%Y-%m-%dT%H:%M:%SZ'
log_fmt_console: '%(asctime)s [%(name)s][%(levelname)s]%(jid)s %(message)s'
log_fmt_logfile: '%(asctime)s [%(name)s][%(levelname)s]%(jid)s %(message)s'
log_level_console: info
log_level_logfile: info
presence_events: true
top_file_merging_strategy: same

Steps to Reproduce Issue

Create Token as automation_user,
Use token in example code to run a test.ping on the /run endpoint
Receive 401 error from salt-api: "No permission -- see authorization schemes"
salt-master container also generates two errors:
"2020-02-14T16:29:08Z [salt.auth][WARNING] Authentication failure of type "token" occurred.
2020-02-14T16:29:08Z [salt.master][WARNING] Authentication failure of type "token" occurred."

Versions Report

Salt Version:
           Salt: 2019.2.3

Dependency Versions:
           cffi: Not Installed
       cherrypy: unknown
       dateutil: 2.6.1
      docker-py: Not Installed
          gitdb: Not Installed
      gitpython: Not Installed
          ioflo: Not Installed
         Jinja2: 2.10
        libgit2: 0.26.0
        libnacl: Not Installed
       M2Crypto: Not Installed
           Mako: Not Installed
   msgpack-pure: Not Installed
 msgpack-python: 0.5.6
   mysql-python: Not Installed
      pycparser: Not Installed
       pycrypto: 2.6.1
   pycryptodome: Not Installed
         pygit2: 0.26.2
         Python: 3.6.9 (default, Nov  7 2019, 10:44:02)
   python-gnupg: 0.4.1
         PyYAML: 3.12
          PyZMQ: 16.0.2
           RAET: Not Installed
          smmap: Not Installed
        timelib: Not Installed
        Tornado: 4.5.3
            ZMQ: 4.2.5

System Versions:
           dist: Ubuntu 18.04 bionic
         locale: ANSI_X3.4-1968
        machine: x86_64
        release: 4.15.0-1064-azure
         system: Linux
        version: Ubuntu 18.04 bionic
@DmitryKuzmenko DmitryKuzmenko added Bug broken, incorrect, or confusing behavior severity-medium 3rd level, incorrect or bad functionality, confusing and lacks a work around P4 Priority 4 Salt-API labels Feb 14, 2020
@DmitryKuzmenko DmitryKuzmenko added this to the Approved milestone Feb 14, 2020
@sagetherage sagetherage removed the P4 Priority 4 label Jun 3, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Bug broken, incorrect, or confusing behavior Salt-API severity-medium 3rd level, incorrect or bad functionality, confusing and lacks a work around
Projects
None yet
Development

No branches or pull requests

3 participants