SSO Auth Doesn't Work for Endpoints

[thomasmitchell]

Stratos Version

4.2.0

Frontend Deployment type

• Cloud Foundry Application (cf push)
• Kubernetes, using a helm chart
• Docker, single container deploying all components
• npm run start
• Other (please specify below)

Backend (Jet Stream) Deployment type

• Cloud Foundry Application (cf push)
• Kubernetes, using a helm chart
• Docker, single container deploying all components
• Other (please specify below)

Expected behaviour

Performing SSO auth to a CF endpoint should redirect to the SSO token page.

Actual behaviour

The frontend returns a 405 Method Not Allowed.

Steps to reproduce the behavior

1. Configure an SSO login with Stratos for a Cloud Foundry endpoint.
2. Attempt to connect to the endpoint using SSO

Log output covering before error and any error statements

Insert log hereCopy

Additional notes

Jetstream listens for SSO auth as of the latest version at GET /pp/v1/auth/tokens, but the frontend attempts to reach it on GET /api/v1/tokens. This gets picked up by the non-SSO auth handler, which only responds to POST methods, hence the 405 error code response from the routing library. Unsure if by design that the backend or frontend path is correct, so I've held off on a PR, but the fix depends on the two agreeing on the path.

[richard-cox]

Hi @thomasmitchell , was just trying to give this a test but hit some environment issues. Could I confirm you're seeing this after checking out the 4.2.0 or stable?

[thomasmitchell]

yes, 4.2.0.

It looks like it happened in #4555

In the interim, we've manually patched our compilation of the frontend for this line:

stratos/src/frontend/packages/store/src/effects/endpoint.effects.ts

Line 110 in 3ac276a

const ssoUrl = '/api/v1/tokens?guid=' + action.guid + '&state=' + encodeURIComponent(loc);

to reference /pp/v1/auth/tokens instead, and we're able to auth with SSO again.

[richard-cox]

Odd, the token endpoint in 4.2.0 should come from /api. Is it possible your frontend is pointing to an older backend, I think we can do this with the CF_API_URL env var?

[thomasmitchell]

stratos/src/jetstream/main.go

Line 1027 in 86b6633

sessionAuthGroup.GET("/tokens", p.ssoLoginToCNSI)

Notably, the SSO endpoint is nested into the sessionAuthGroup (/pp/v1/auth/), not the stableAPIGroup (/api/v1/)

[richard-cox]

Please accept my apologies, serious case of read the issue. I was confusing the POST with GET, and you clearly stated GET at start. Understand the issue now, we'll look at fixing this in a patch release

[thomasmitchell]

thank you very much :)

[richard-cox]

Fixed via #4719. This will be in the 4.2.1 release which should be out this week.

[richard-cox]

4.2.1 has now been released