[$60] [config] M2M token should be allowed to create v5 users #81
Comments
|
I think it is related the AUTH0 audience being used to create m2m token. Initially AUTH0 audience configuration was export AUTH0_AUDIENCE=https://u-bahn.topcoder.com
export AUTH0_AUDIENCE_FOR_BUS_API=https://m2m.topcoder-dev.com/Recently it got changed to export AUTH0_AUDIENCE=https://m2m.topcoder-dev.com/
export AUTH0_AUDIENCE_FOR_BUS_API=https://m2m.topcoder-dev.com/To revert the configuration is a good way to go, but it would break some recent changes like in #73. We should fix them as well. By the way I think it could be better to use some more meaningful names for the audience configuration. Like export AUTH0_UBAHN_AUDIENCE=https://u-bahn.topcoder.com
export AUTH0_M2M_AUDIENCE=https://m2m.topcoder-dev.com/ |
|
Thank you for your input @imcaizheng. Agree, on renaming. So do you think we can fix this issue by using m2m token with |
|
@maxceem to Otherwise I would get the following error: (node:955658) UnhandledPromiseRejectionWarning: Error: Unknown Error
at Request._callback (/home/caizheng/my_projects/topcoder-taas-apis-fix-permission-rules/taas-apis/node_modules/tc-core-library-js/lib/auth/m2m.js:70:24)
at Request.self.callback (/home/caizheng/my_projects/topcoder-taas-apis-fix-permission-rules/taas-apis/node_modules/request/request.js:185:22)
at Request.emit (events.js:314:20)
at Request.EventEmitter.emit (domain.js:483:12)
at Request.<anonymous> (/home/caizheng/my_projects/topcoder-taas-apis-fix-permission-rules/taas-apis/node_modules/request/request.js:1154:10)
at Request.emit (events.js:314:20)
at Request.EventEmitter.emit (domain.js:483:12)
at IncomingMessage.<anonymous> (/home/caizheng/my_projects/topcoder-taas-apis-fix-permission-rules/taas-apis/node_modules/request/request.js:1076:12)
at Object.onceWrapper (events.js:420:28)
at IncomingMessage.emit (events.js:326:22)Despite that, we can still carry out a solution by including both audiences with their corresponding credentials, like: It should work well. EDIT I think a better solution is requesting TC support for a new AUTH0 credential that can work with both audiences. |
|
Thank you @imcaizheng. Let's ask for @nkumar-topcoder input for this. |
|
@maxceem @imcaizheng I agree, the current Audience |
|
Here are the steps with which I could reproduce the issue. @nkumar-topcoder Please try with the steps to examine if current auth0 configuration works for you. Firstly, to help simplify the process, add the following code snippets to the end of getM2Mtoken().then(result => {
console.log(result)
})
So we have two different tokens after step 2 and step 3. Below is how the tokens were used to make requests to the v5/users api.
|
|
Thanks @imcaizheng. I've checked out the scope of tokens 2 and 3: Token 2{
"iss": "https://topcoder-dev.auth0.com/",
"sub": "gZ6jt50HYHLBf4vhxjUhXPZOR7Q5lk4k@clients",
"aud": "https://m2m.topcoder-dev.com/",
"iat": 1608902471,
"exp": 1608988871,
"azp": "gZ6jt50HYHLBf4vhxjUhXPZOR7Q5lk4k",
"scope": "read:user_idp_tokens read:challenges all:groups write:groups read:groups read:review_type read:review read:project read:bus_topics write:bus_api read:email_templates read:user_profiles read:roles read:preferences read:project-user read:project-permission read:lookups read:resources read:terms read:projects read:project-members read:achievement read:achievementsProvider read:attribute read:attributeGroup all:attributeGroup create:attributeGroup update:attributeGroup read:organization read:role read:skill read:skillsProvider read:userAttribute read:usersRole read:usersSkill read:group all:group update:group create:group read:user read:taas-teams read:taas-jobs all:taas-jobs read:taas-jobCandidates all:taas-jobCandidates all:taas-resourceBookings",
"gty": "client-credentials"
}Token 3{
"iss": "https://topcoder-dev.auth0.com/",
"sub": "LEyCiuOrHc7UAFoY0EAAhMulWSX7SrQ5@clients",
"aud": "https://u-bahn.topcoder.com",
"iat": 1608973789,
"exp": 1609060189,
"azp": "LEyCiuOrHc7UAFoY0EAAhMulWSX7SrQ5",
"scope": "read:user all:user create:user update:user delete:user all:achievement create:achievement update:achievement read:achievement delete:achievement read:achievementsProvider all:achievementsProvider update:achievementsProvider delete:achievementsProvider read:attribute all:attribute update:attribute delete:attribute read:attributeGroup all:attributeGroup create:attributeGroup update:attributeGroup delete:attributeGroup read:externalProfile all:externalProfile create:externalProfile delete:externalProfile read:organization all:organization create:organization delete:organization read:role all:role create:role update:role delete:role read:skill all:skill create:skill update:skill delete:skill read:skillsProvider all:skillsProvider create:skillsProvider update:skillsProvider delete:skillsProvider read:userAttribute all:userAttribute create:userAttribute update:userAttribute delete:userAttribute read:usersRole all:usersRole create:usersRole update:usersRole delete:usersRole read:usersSkill all:usersSkill create:usersSkill update:usersSkill delete:usersSkill read:group all:group update:group create:group delete:group update:externalProfile update:organization create:achievementsProvider create:upload update:upload all:upload create:template read:upload read:template all:template update:template delete:upload delete:template create:attribute",
"gty": "client-credentials"
}Token 3 has scopes like @nkumar-topcoder can we add these scopes to the m2m Auth config for |
|
@imcaizheng @maxceem all and delete user were missing and it's given now. Pls try. |
|
@nkumar-topcoder Are we supposed to get a new client id and client secret? If so, please send the info to my email. |
|
@imcaizheng No, it's same |
|
@nkumar-topcoder I tried it, with the This time I got the following token The scope inside the token are listed below: I compare the scopes of this new token to the scopes of the token generated before, and found they are the same. That's said, there are no changes. |
|
@imcaizheng I will connect with the team tomorrow for exact roles/scope access. |
|
@nkumar-topcoder We should at least add scopes |
|
@callmekatootie we have created taas app own m2m audience, it's same as u-bhan's scope wise. But we have issues creating v5/users. What are the prerequisite ubann @imcaizheng If I post a job which doesn't have v5/users it does create a v5/user, i tested this when m2m PR was merged. I will re-test this on monday. cc: @maxceem |
Can you let me know the error that you get Could you also provide a sample m2m token that is being generated / used... |
|
@nkumar-topcoder I've checked M2M token which is generated by Here is generated token: List of scopes of this token: |
|
Yep - I need to get back on this. Could not find time today - hope to get back asap before I call it a day today. Apologies for the delay |
|
No worries, this is not super urgent. |
|
I am not sure I follow the entire thread but scope needed to create the user in u-bahn is According to this post it looks like, using Step 3, you were able to generate the token with that scope - and you got a 400 status code asking you to pass the handle of the user to create... So, if you have the token with the mentioned scope, then just pass the handle, along with the first name and last name parameters during user creation and you should succeed. Let me know if you need any more info from me |
|
@callmekatootie That fact is that we already knew the token from Step 3 can access v5/users and just want the token from Step 2 to be able to access v5/users as well. What made us confused is that nkumar-topcoder said the token from Step 2 was already given scope |
|
Gotcha... So the only bit to do is add either the |
|
|
@nkumar-topcoder here is the new token generated by Scopes it has: |
|
When changing audience to |
|
@maxceem ok, i will check with team. Even though i have all access some how it's not picking the scopes. |
|
@nkumar-topcoder
|
|
@imcaizheng @maxceem
And, client Id remain same : gZ6jt50HY.... This is merged and deployed to |
|
|
Contest https://www.topcoder.com/challenges/30161163 has been updated - it has been assigned to aaron2017. |
|
PR created #91 |
|
@maxceem |
|
|
@maxceem , @imcaizheng thanks for all your timely help. @maxceem - i have updated dev config for |
|
Fix looks good to me, though I cannot verify it locally. When I'm trying to create a Job using a user that possibly doesn't exist in U-bahn, I get an error: {
"message": "Bad Request"
}The same time in log I see: If I try to call endpoint {
"message": "\"query.externalProfile.organizationId\" is not allowed"
}@nkumar-topcoder @imcaizheng Do you have any ideas about this? @callmekatootie maybe you could help us with this, why such a request could return |
|
@callmekatootie Looks like this issue happens for all users now, while it worked for them previously. For any user, such a request returns an error. |
|
@maxceem Thank you for bringing this to my attention. We are currently migrating our code base from qldb to pgsql database and we realized now that we have not copied over the GET /users query params. Logged it here - topcoder-archive/topcoder-platform-u-bahn-api#74. Will resolve this soon |
|
Hey, @callmekatootie do you know how soon it could be possibly fixed? Actually it's quite critical for us 😔, as we cannot test TaaS API now, while we have a scheduled release on Jan 15. |
|
I'll get back to you with an update later today |
|
@maxceem Can you try now. The issue is resolved |
|
@callmekatootie @maxceem I could verify the issue is resolved. All operations can be done without |
|
Great! Thank you, @callmekatootie. And thank you for verifying it @imcaizheng. |
|
I've tested with using a user not in V5 and it works good, I can see that member Though, if after this we are trying to find this user, it's not found. Then next URL But if we try to create the same user again, we get error {
"message": "Conflict"
}This is not connected with the current issue, and we would continue discussing this issue in #46. |
|
This ticket was not processed for payment. If you would like to process it for payment, please reopen it, add the |
|
Payment task has been updated: https://software.topcoder.com/review/actions/ViewProjectDetails?pid=30161163 |
When I used M2M token for DEV env locally. In the situations when user doesn't exists in V5 we create it by calling:
POST /v5/usersPOST /v5/users/${userId}/externalProfilesAt the moment the first request returns
Forbidden.We have to make sure that M2M config that we use on DEV and PROD allowing creating users in V5.
The text was updated successfully, but these errors were encountered: