Initial Setup with Dex and Cognito

[jsidney]

Hi guys. i am trying to get a POC version of terrakube running in AWS EKS using a Cognito User Pool for authentication. For some reason, even though my user in cognito is a part of the TERRAKUBE_ADMIN group, when I log in, I am unable to create an Org. I don't know which repo specifically in this project to post the question (hence the discussion), but has anyone got some wisdom to share?
my config for helm looks like this:

name: "terrakube"

## Azure Active Directory Security
security:
  adminGroup: "TERRAKUBE_ADMIN"
  patSecret: "XXXXXXXXXXXXXXX"
  internalSecret: "XXXXXXXXXXXX"
  dexClientId: "cognito"
  dexClientScope: "email openid profile offline_access groups"
  dexIssuerUri: "https://terrakube-api.XXXXXXXX/dex"

## Dex
dex:
  config:
      issuer: https://terrakube-api.tooling.XXXXXXX/dex
      storage:
        type: memory
      oauth2:
        responseTypes: ["code", "token", "id_token"] 
        skipApprovalScreen: true
      web:
        allowedOrigins: ["*"]
      staticClients:
      - id: cognito
        redirectURIs:
        - 'https://terrakube-ui.XXXXXXXXX' #<<CHANGE_THIS>>
        - 'http://localhost:3000'
        - 'http://localhost:10001/login'
        - 'http://localhost:10000/login'
        - '/device/callback'
        name: 'cognito'
        public: true

      connectors:
      - type: oidc
        id: cognito
        name: cognito
        config:
          issuer: "https://cognito-idp.XXXXX.amazonaws.com/XXXXXXX"
          clientID: "XXXXXXXXXX"
          clientSecret: "XXXXXXXXX"
          redirectURI: "https://terrakube-api.XXXXXX/dex/callback" #<<CHANGE_THIS>>
          scopes:
            - openid
            - email
            - profile
          insecureSkipEmailVerified: true
          insecureEnableGroups: true
          userNameKey: "cognito:username"
          claimMapping: 
            groups: "cognito:groups"
....
api:
  existingSecret: false
  enabled: true
  version: "2.14.0"
  replicaCount: "1"
  serviceType: "ClusterIP"
  serviceAccountName: ""
  resources: {}
  defaultDatabase: true
  loadSampleData: false
  terraformReleasesUrl: "https://releases.hashicorp.com/terraform/index.json"
  properties:
    databaseType: "POSTGRESQL"
    databaseHostname: ""
    databaseName: ""
    databaseUser: ""
    databasePassword: ""
    databaseSslMode: "disable"
.....

[jsidney]

for completeness, this is the error message that I get in the API's logs:

java.lang.NullPointerException: Cannot invoke "org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationToken.getTokenAttributes()" because the return value of "org.terrakube.api.plugin.security.user.dex.DexAuthenticatedUserImpl.getSecurityPrincipal(com.yahoo.elide.core.security.User)" is null

[jsidney]

so i did get a correct response to the port-forwarding.... for a GET
for the POST I still get a 403:

curl -H "Authorization: Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6IjdiNDExM2Q3NmZiYzQ1YTJhNWFmODVhZTY1YzViMmMzYmE1N2E1N2YifQ.eyJpc3MiOiJodHRwczovL3RlcnJha3ViZS1hcGkudG9vbGluZy5zeW50aGVzaXplLmNvLnphL2RleCIsInN1YiI6IkNpUmlZVE5qTXprMk1DMHpaamszTFRSbFlXUXRZbVEwT0MwMk5qQXdOemsxTWpoa1pHTVNCMk52WjI1cGRHOCIsImF1ZCI6ImNvZ25pdG8iLCJleHAiOjE2OTUzMDY5NzMsImlhdCI6MTY5NTIyMDU3MywiYXRfaGFzaCI6InNYTlhwN05wbEZmQzVZOUl0ZkhrdUEiLCJlbWFpbCI6ImpvbmF0aGFuQHN5bnRoZXNpcy5jby56YSIsImVtYWlsX3ZlcmlmaWVkIjp0cnVlLCJncm91cHMiOlsiVEVSUkFLVUJFX0FETUlOIl0sIm5hbWUiOiJqc2lkbmV5In0.BrW9rUo0O2pVXkqpzXp5dj6KbVRqfU7N15QvqNzqcJrR4HSvh1BtYK0fP2lKBsurem2eUk7E_ufTrAPirstzi0nFxZur-khAL7AkqQFup6Xwo0sn27R5YIU1XrYGkF1LmDfrFBfzzXezbZNtgusp0zR6yzXUAmmDPEYBf0bDP1fp7vX9zFA6ye9b7lmieBz9ha69vfQDREaoAiNU2_9Dxshksjhmtv6v0TmD_S82mutwwj-HqwRego_lrHw1AdMD2ADhm4rspwcP1pwbCVbC2Z7L7StNB2n-f0pZyxLiFM4f3JiNL35KBFmLXK0SijbcgM7R13yqVyArQV1u35-P-wv Content-Type: application/json" -d '
{"data":{"type":"organization","attributes":{"name":"test"}}}' -X POST http://localhost:8080/api/v1/organization
{"timestamp":"2023-09-20T14:59:15.791+00:00","status":403,"error":"Forbidden","path":"/api/v1/organization"}%

[alfespa17]

You can only create organizations if you are a member of the ADMIN group, earlier you mentioned that you change the admin group to TERRAKUBE_DEVELOPERS and in your token groups you only have "TERRAKUBE_ADMIN" that is the reason you get 403, you will need to change the ADMIN group and restart the API pod

[alfespa17]

From what I understand now is that the API is working as expected you main issue is that when you are calling the API throught your ingress the ingress is not forwarding the "http authorization header" and for that you will have to check your ingress config maybe adding some annotation for the http header authorization or do some specific configuration.

[alfespa17]

By the way the content type should be "application/vnd.api+json" not "application/json"

[jsidney]

thanks @alfespa17 - it definitely looks like its got to do with the ingress configuration. hopefully will be able to find the issue :)

[alfespa17]

I think you have an identetation error in dex config part or maybe is an issue when you copy paste the values in the discussion.

There is one example of that configuration here

https://github.com/AzBuilder/terrakube-helm-chart/blob/main/examples/CognitoAuthentication-Example1.md

By the way delete the API.vesion so it can use the default value from the helm chart

[jsidney]

So the problem was on the config of our ingress via Istio. we have managed to get it sorted and we are now able to log in 👍

[alfespa17]

Nice to hear that is working for you now, feel free to open a new discussion or issue if you have any feedback or any problem.