"bearertokenauth" extension Always return "401 Unauthorized" via HTTP connection #24656

tangx · 2023-07-28T11:14:25Z

Component(s)

extension/bearertokenauth

What happened?

Description

When set bearertokenauth

it always returns "401 Unauthorized" via HTTP(S) Connection.

HOSTNAME=localhost.with-token.http SERVER_INFO=http://127.0.0.1:55681 go run .
2023/07/28 18:16:48 Waiting for connection...
2023/07/28 18:16:48 Doing really hard work (1 / 10)
2023/07/28 18:16:49 Doing really hard work (2 / 10)
2023/07/28 18:16:50 Doing really hard work (3 / 10)
2023/07/28 18:16:51 Doing really hard work (4 / 10)
2023/07/28 18:16:52 Doing really hard work (5 / 10)
2023/07/28 18:16:53 Doing really hard work (6 / 10)
2023/07/28 18:16:53 traces export: failed to send to http://127.0.0.1:55681/v1/traces: 401 Unauthorized
2023/07/28 18:16:54 Doing really hard work (7 / 10)
2023/07/28 18:16:55 Doing really hard work (8 / 10)
2023/07/28 18:16:56 Doing really hard work (9 / 10)
2023/07/28 18:16:57 Doing really hard work (10 / 10)
2023/07/28 18:16:58 Done!
2023/07/28 18:16:58 traces export: failed to send to http://127.0.0.1:55681/v1/traces: 401 Unauthorized
2023/07/28 18:16:58 traces export: failed to send to http://127.0.0.1:55681/v1/traces: 401 Unauthorized

but it works via gRPC Connection

HOSTNAME=localhost.with-token.grpc SERVER_INFO=grpc://127.0.0.1:55680 go run .
2023/07/28 18:14:55 Waiting for connection...
2023/07/28 18:14:55 Doing really hard work (1 / 10)
2023/07/28 18:14:56 Doing really hard work (2 / 10)
2023/07/28 18:14:57 Doing really hard work (3 / 10)
2023/07/28 18:14:58 Doing really hard work (4 / 10)
2023/07/28 18:14:59 Doing really hard work (5 / 10)
2023/07/28 18:15:00 Doing really hard work (6 / 10)
2023/07/28 18:15:01 Doing really hard work (7 / 10)
2023/07/28 18:15:02 Doing really hard work (8 / 10)
2023/07/28 18:15:03 Doing really hard work (9 / 10)
2023/07/28 18:15:04 Doing really hard work (10 / 10)
2023/07/28 18:15:05 Done!

Steps to Reproduce

OTel-Collector-Contrib Config

My Go file

// 创建 OTEL 的 GRPC 连接器
func grpcExpoter(ctx context.Context, SERVER_ADDR string) (*otlptrace.Exporter, error) {
	addr := strings.TrimLeft(SERVER_ADDR, "grpc://")

	conn, err := grpc.DialContext(ctx, addr,
		// Note the use of insecure transport here. TLS is recommended in production.
		grpc.WithTransportCredentials(insecure.NewCredentials()),
		grpc.WithBlock(),
		// grpc.WithTimeout(5*time.Second),
	)

	if err != nil {
		return nil, fmt.Errorf("failed to create gRPC connection to collector: %w", err)
	}

	// Set up a trace exporter
	traceExporter, err := otlptracegrpc.New(
		ctx,
		otlptracegrpc.WithGRPCConn(conn),
		otlptracegrpc.WithHeaders(
			map[string]string{
				"authorization": `Bearer vyAQ21d5NCfUIXe`,
				"Authorization": `Bearer vyAQ21d5NCfUIXe`,
			},
		),
	)
	if err != nil {
		return nil, fmt.Errorf("failed to create trace exporter: %w", err)
	}
	return traceExporter, nil
}

func httpExporter(ctx context.Context, SERVER_ADDR string) (*otlptrace.Exporter, error) {

	SERVER_ADDR = strings.TrimPrefix(SERVER_ADDR, "https://")
	SERVER_ADDR = strings.TrimPrefix(SERVER_ADDR, "http://")

	opts := []otlptracehttp.Option{
		otlptracehttp.WithTimeout(5 * time.Second),
		otlptracehttp.WithEndpoint(SERVER_ADDR),
		otlptracehttp.WithInsecure(),
		otlptracehttp.WithHeaders(
			map[string]string{
				"authorization": `Bearer vyAQ21d5NCfUIXe`,
				"Authorization": `Bearer vyAQ21d5NCfUIXe`,
			},
		),
	}

	trace, err := otlptracehttp.New(ctx, opts...)

	return trace, err
}

Expected Result

Success

Actual Result

401 Unauthorized

Collector version

v0.81.0

Environment information

Environment

OS: (e.g., "Ubuntu 20.04")
Compiler(if manually compiled): (e.g., "go 14.2")

OpenTelemetry Collector configuration

extensions:
  basicauth/server:
    htpasswd: 
      # file: .htpasswd
      inline: |
        auth_user:auth_pass_123
  bearertokenauth/withscheme:
    scheme: Bearer
    token: vyAQ21d5NCfUIXe

receivers:
  otlp:
    protocols:
      grpc:
        endpoint: "0.0.0.0:55680"
        auth:
          # authenticator: basicauth/server
          authenticator: bearertokenauth/withscheme
      http:
        endpoint: "0.0.0.0:55681"
        auth:
          # authenticator: basicauth/server
          authenticator: bearertokenauth/withscheme

exporters:
  logging/detail:
    loglevel: debug
  alibabacloud_logservice/traces:
    endpoint: "cn-beijing.log.aliyuncs.com"
    project: "my-sls-project"
    logstore: "my-sls-logstore-traces"
    access_key_id: "xxxxxx"
    access_key_secret: "yyyyyy"
  alibabacloud_logservice/metrics:
    endpoint: "cn-beijing.log.aliyuncs.com"
    project: "my-sls-project"
    logstore: "my-sls-logstore-metrics"
    access_key_id: "xxxxxx"
    access_key_secret: "yyyyyy"
  alibabacloud_logservice/logs:
    endpoint: "cn-beijing.log.aliyuncs.com"
    project: "my-sls-project"
    logstore: "my-sls-logstore-logs"
    access_key_id: "xxxxxx"
    access_key_secret: "yyyyyy"

service:
  telemetry:
    logs:
      level: "debug"
  extensions: [basicauth/server, bearertokenauth/withscheme]
  pipelines:
    traces:
      receivers: [otlp]           #接收端配置为otlp。
      exporters: [alibabacloud_logservice/traces]   #发送端配置为alibabacloud_logservice/traces。
      # for debug
      # exporters: [logging/detail,alibabacloud_logservice/traces]
    metrics:
      receivers: [otlp]
      exporters: [alibabacloud_logservice/metrics]
    logs:
      receivers: [otlp]
      exporters: [alibabacloud_logservice/logs]

Log output

HOSTNAME=localhost.with-token.http SERVER_INFO=http://127.0.0.1:55681 go run .
2023/07/28 18:16:48 Waiting for connection...
2023/07/28 18:16:48 Doing really hard work (1 / 10)
2023/07/28 18:16:49 Doing really hard work (2 / 10)
2023/07/28 18:16:50 Doing really hard work (3 / 10)
2023/07/28 18:16:51 Doing really hard work (4 / 10)
2023/07/28 18:16:52 Doing really hard work (5 / 10)
2023/07/28 18:16:53 Doing really hard work (6 / 10)
2023/07/28 18:16:53 traces export: failed to send to http://127.0.0.1:55681/v1/traces: 401 Unauthorized
2023/07/28 18:16:54 Doing really hard work (7 / 10)
2023/07/28 18:16:55 Doing really hard work (8 / 10)
2023/07/28 18:16:56 Doing really hard work (9 / 10)
2023/07/28 18:16:57 Doing really hard work (10 / 10)
2023/07/28 18:16:58 Done!
2023/07/28 18:16:58 traces export: failed to send to http://127.0.0.1:55681/v1/traces: 401 Unauthorized
2023/07/28 18:16:58 traces export: failed to send to http://127.0.0.1:55681/v1/traces: 401 Unauthorized

Additional context

No response

The text was updated successfully, but these errors were encountered:

github-actions · 2023-07-28T11:14:44Z

Pinging code owners:

extension/bearertokenauth: @jpkrohling @pavankrish123 @frzifus

See Adding Labels via Comments if you do not have permissions to add labels yourself.

jpkrohling · 2023-07-28T13:32:16Z

@pavankrish123 @frzifus, are you able to take a look?

tangx · 2023-07-31T03:32:51Z

@jpkrohling,

Don't go into the extension via HTTP

It doesn't trigger the token comparing while the Token isn't matching.

make run.localhost.http
HOSTNAME=localhost.with-token.http SERVER_INFO=http://127.0.0.1:55681 go run .
2023/07/31 11:26:13 Waiting for connection...
2023/07/31 11:26:13 Doing really hard work (1 / 10)
2023/07/31 11:26:14 Doing really hard work (2 / 10)
2023/07/31 11:26:15 Doing really hard work (3 / 10)
2023/07/31 11:26:16 Doing really hard work (4 / 10)
2023/07/31 11:26:17 Doing really hard work (5 / 10)
2023/07/31 11:26:18 Doing really hard work (6 / 10)
2023/07/31 11:26:18 traces export: failed to send to http://127.0.0.1:55681/v1/traces: 401 Unauthorized
2023/07/31 11:26:19 Doing really hard work (7 / 10)
2023/07/31 11:26:20 Doing really hard work (8 / 10)
2023/07/31 11:26:21 Doing really hard work (9 / 10)
2023/07/31 11:26:22 Doing really hard work (10 / 10)
2023/07/31 11:26:23 traces export: failed to send to http://127.0.0.1:55681/v1/traces: 401 Unauthorized
2023/07/31 11:26:23 Done!
2023/07/31 11:26:23 traces export: failed to send to http://127.0.0.1:55681/v1/traces: 401 Unauthorized

everything goes as expect via gRPC.

make run.localhost.grpc
HOSTNAME=localhost.with-token.grpc SERVER_INFO=grpc://127.0.0.1:55680 go run .

2023/07/31 11:25:58 Waiting for connection...
2023/07/31 11:25:58 Doing really hard work (1 / 10)
2023/07/31 11:25:59 Doing really hard work (2 / 10)
2023/07/31 11:26:00 Doing really hard work (3 / 10)
2023/07/31 11:26:01 Doing really hard work (4 / 10)
2023/07/31 11:26:02 Doing really hard work (5 / 10)
2023/07/31 11:26:03 Doing really hard work (6 / 10)
2023/07/31 11:26:03 traces export: rpc error: code = Unknown desc = scheme or token does not match: Bearer vyAQ21d5NCfUIXe_____
2023/07/31 11:26:04 Doing really hard work (7 / 10)
2023/07/31 11:26:05 Doing really hard work (8 / 10)
2023/07/31 11:26:06 Doing really hard work (9 / 10)
2023/07/31 11:26:07 Doing really hard work (10 / 10)
2023/07/31 11:26:08 Done!
2023/07/31 11:26:08 traces export: rpc error: code = Unknown desc = scheme or token does not match: Bearer vyAQ21d5NCfUIXe_____
2023/07/31 11:26:08 traces export: rpc error: code = Unknown desc = scheme or token does not match: Bearer vyAQ21d5NCfUIXe_____

github-actions · 2023-10-02T03:29:09Z

This issue has been inactive for 60 days. It will be closed in 60 days if there is no activity. To ping code owners by adding a component label, see Adding Labels via Comments, or if you are unsure of which component this issue relates to, please ping @open-telemetry/collector-contrib-triagers. If this issue is still relevant, please ping the code owners or leave a comment explaining why it is still relevant. Otherwise, please close it.

Pinging code owners:

extension/bearertokenauth: @jpkrohling @pavankrish123 @frzifus
needs: Github issue template generation code needs this to generate the corresponding labels.

See Adding Labels via Comments if you do not have permissions to add labels yourself.

jpkrohling · 2023-10-23T15:18:52Z

Sorry for taking so long to take a look at this, I've added this to my queue.

pollosp · 2023-11-27T11:12:12Z

Same problem here with HTTP receiver as @tangx

nagashan · 2023-12-17T12:04:47Z

Same problem here with HTTP receiver.

Its because of We are always trying to get the authorization with the lower case from headers, But The headers from Http is received as Authorization even-though we sent in lower case.

nagashan · 2023-12-17T13:10:47Z

#29992

…"401 Unauthorized" via HTTP connection #24656 (#29992) Fix for extension Always return "401 Unauthorized" via HTTP connection #24656 **Description:** We are always trying to get the `authorization` with the lower case from headers, But The headers from Http is received as `Authorization` capitalcase even-though we sent in lower case. **Link to tracking Issue:** <[24656](#24656)> **Testing:** Tested in the local <img width="1060" alt="Screenshot 2023-12-17 at 5 28 26 PM" src="https://github.com/open-telemetry/opentelemetry-collector-contrib/assets/94837505/a7401d32-9ce2-4ac5-b4a4-94b43d1efcc8"> <img width="919" alt="Screenshot 2023-12-17 at 5 32 11 PM" src="https://github.com/open-telemetry/opentelemetry-collector-contrib/assets/94837505/b7778fc1-1dee-487a-8458-669b8bf5ec2e"> <img width="890" alt="Screenshot 2023-12-17 at 5 34 12 PM" src="https://github.com/open-telemetry/opentelemetry-collector-contrib/assets/94837505/369577d3-7ddf-45e9-be25-81e699e56e2a"> --------- Co-authored-by: Curtis Robert <crobert@splunk.com>

…"401 Unauthorized" via HTTP connection open-telemetry#24656 (open-telemetry#29992) Fix for extension Always return "401 Unauthorized" via HTTP connection open-telemetry#24656 **Description:** We are always trying to get the `authorization` with the lower case from headers, But The headers from Http is received as `Authorization` capitalcase even-though we sent in lower case. **Link to tracking Issue:** <[24656](open-telemetry#24656)> **Testing:** Tested in the local <img width="1060" alt="Screenshot 2023-12-17 at 5 28 26 PM" src="https://github.com/open-telemetry/opentelemetry-collector-contrib/assets/94837505/a7401d32-9ce2-4ac5-b4a4-94b43d1efcc8"> <img width="919" alt="Screenshot 2023-12-17 at 5 32 11 PM" src="https://github.com/open-telemetry/opentelemetry-collector-contrib/assets/94837505/b7778fc1-1dee-487a-8458-669b8bf5ec2e"> <img width="890" alt="Screenshot 2023-12-17 at 5 34 12 PM" src="https://github.com/open-telemetry/opentelemetry-collector-contrib/assets/94837505/369577d3-7ddf-45e9-be25-81e699e56e2a"> --------- Co-authored-by: Curtis Robert <crobert@splunk.com>

tangx added bug Something isn't working needs triage New item requiring triage labels Jul 28, 2023

github-actions bot added the extension/bearertokenauth label Jul 28, 2023

This was referenced Sep 3, 2023

Weekly Report: 2023-08-27 - 2023-09-03 kevinslin/opentelemetry-collector-contrib#20

Open

Weekly Report: 2023-08-27 - 2023-09-03 kevinslin/opentelemetry-collector-contrib#21

Open

This was referenced Sep 6, 2023

Weekly Report: 2023-08-30 - 2023-09-06 kevinslin/opentelemetry-collector-contrib#22

Open

Weekly Report: 2023-09-05 - 2023-09-12 kevinslin/opentelemetry-collector-contrib#23

Open

This was referenced Sep 12, 2023

Weekly Report: 2023-09-05 - 2023-09-12 kevinslin/opentelemetry-collector-contrib#24

Open

Weekly Report: 2023-09-05 - 2023-09-12 kevinslin/opentelemetry-collector-contrib#25

Open

This was referenced Sep 19, 2023

Weekly Report: 2023-09-12 - 2023-09-19 kevinslin/opentelemetry-collector-contrib#26

Open

Weekly Report: 2023-09-19 - 2023-09-26 kevinslin/opentelemetry-collector-contrib#27

Open

github-actions bot added the Stale label Oct 2, 2023

This was referenced Oct 3, 2023

Weekly Report: 2023-09-26 - 2023-10-03 #27402

Closed

Weekly Report: 2023-09-26 - 2023-10-03 kevinslin/opentelemetry-collector-contrib#28

Open

Weekly Report: 2023-10-03 - 2023-10-10 #27574

Closed

github-actions bot mentioned this issue Oct 17, 2023

Weekly Report: 2023-10-10 - 2023-10-17 #27791

Closed

jpkrohling self-assigned this Oct 23, 2023

jpkrohling removed Stale needs triage New item requiring triage labels Oct 23, 2023

nagashan mentioned this issue Dec 17, 2023

[extension/bearertokenauthextension] Fix for extension Always return "401 Unauthorized" via HTTP connection #24656 #29992

Merged

jpkrohling closed this as completed Jan 25, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

"bearertokenauth" extension Always return "401 Unauthorized" via HTTP connection #24656

"bearertokenauth" extension Always return "401 Unauthorized" via HTTP connection #24656

tangx commented Jul 28, 2023

github-actions bot commented Jul 28, 2023

jpkrohling commented Jul 28, 2023

tangx commented Jul 31, 2023

github-actions bot commented Oct 2, 2023

jpkrohling commented Oct 23, 2023

pollosp commented Nov 27, 2023

nagashan commented Dec 17, 2023

nagashan commented Dec 17, 2023