OAuth2ClientCredentialsAuthPlugin: fatal error: concurrent map writes

[eubaranov]

Short description

Golang version: 1.19
Lib versions the issue detected: v0.53.1, v0.59.0
Occurance: floating (rare and random)

In all occurrences, the last running goroutine stack pointed to the same place - createAuthJWT
Stack trace example report for the v0.53.1 (the trace for v0.59.0 is the same):

goroutine 298 [running]:
github.com/open-policy-agent/opa/plugins/rest.(*oauth2ClientCredentialsAuthPlugin).createAuthJWT(0xc0030eec30, 0xc002ea1890, {0x161e140, 0xc002457560})
/go/pkg/mod/github.com/open-policy-agent/opa@v0.53.1/plugins/rest/auth.go:221 +0x43d
github.com/open-policy-agent/opa/plugins/rest.(*oauth2ClientCredentialsAuthPlugin).requestToken(0xc0030eec30, {0x1cbc420, 0xc0031e4e40})
/go/pkg/mod/github.com/open-policy-agent/opa@v0.53.1/plugins/rest/auth.go:333 +0x385
github.com/open-policy-agent/opa/plugins/rest.(*oauth2ClientCredentialsAuthPlugin).Prepare(0xc0030eec30, 0xc0050b1600)
/go/pkg/mod/github.com/open-policy-agent/opa@v0.53.1/plugins/rest/auth.go:403 +0x187
github.com/open-policy-agent/opa/plugins/rest.(*Config).authPrepare(0xc002accee0?, 0x0?, 0x1722757?)
/go/pkg/mod/github.com/open-policy-agent/opa@v0.53.1/plugins/rest/rest.go:122 +0x48
github.com/open-policy-agent/opa/plugins/rest.Client.Do({0x0, 0x0, {{0xc000cd7020, 0x4}, {0xc0012c4360, 0x1b}, 0x0, 0x0, 0xc000cd7068, 0x0, ...}, ...}, ...)
/go/pkg/mod/github.com/open-policy-agent/opa@v0.53.1/plugins/rest/rest.go:303 +0x745
github.com/open-policy-agent/opa/download.(*Downloader).download(0xc00140e820, {0x1cbc420, 0xc0031e4e40}, {0x1cc2170?, 0xc004814040})
/go/pkg/mod/github.com/open-policy-agent/opa@v0.53.1/download/download.go:301 +0x837
github.com/open-policy-agent/opa/download.(*Downloader).oneShot(0xc00140e820, {0x1cbc420, 0xc0031e4e40})
/go/pkg/mod/github.com/open-policy-agent/opa@v0.53.1/download/download.go:256 +0x85
github.com/open-policy-agent/opa/download.(*Downloader).loop(0xc00140e820, {0x1cbc420, 0xc0031e4e40})
/go/pkg/mod/github.com/open-policy-agent/opa@v0.53.1/download/download.go:219 +0xc9
created by github.com/open-policy-agent/opa/download.(*Downloader).doStart
/go/pkg/mod/github.com/open-policy-agent/opa@v0.53.1/download/download.go:183 +0xca

Steps To Reproduce

N/A - The problem is floating

Expected behavior

oauth2ClientCredentialsAuthPlugin.Claims map protected with some kind of synchronization

Additional context

[srenatus]

createAuthJWT that method looks suspicious in its handling of the claims function argument. Looks like it could be a low-hanging fruit, though, would you be up to contribute a fix? 😃

[eubaranov]

yep, sure