Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Migrate lua-resty-session to 4.0.3 [tested, works] #489

Merged
merged 5 commits into from
Sep 9, 2024

Conversation

oldium
Copy link
Collaborator

@oldium oldium commented Aug 11, 2023

Complete rework of #478, all issues of #478 should be addressed. Uses session:set and session:get to manipulate the session variables.

Tested by unit tests and on real-world project.

@lordgreg
Copy link

lordgreg commented Oct 9, 2023

Hi. Will this get merged? @bodewig

@ja-softdevel
Copy link

@bodewig
Hello, is there an ETA on this merge?
It seems this is causing issues downstream with kong oidc.

@oldium
Copy link
Collaborator Author

oldium commented Oct 12, 2023

Adding a cute kitten usually helps speed things up 😅
KittyKittenGIF

@ja-softdevel
Copy link

@oldium Hello, I git cloned your branch and built it in a Dockerfile along with kong-oidc. I was hoping your changes would resolve the error I keep getting.

using Docker:
Kong Gateway (OSS)
service: https://cat-fact.herokuapp.com/facts
route: /cats
plugin: kong-oidc
Keycloak for auth

The route is set to redirect to Keycloak for testing auth. But I get the following error in the Kong logs when Keycloak redirects back to the route.

[error] 1264#0: *2785 [lua] openidc.lua:1484: authenticate(): request to the redirect_uri path but there's no session state found, client: 172.25.17.1, server: kong, request: "GET /cats?state=41b59f8cd04f7404a603ba9908d18930&session_state=ba1bf1a8-cf0f-4563-8028-fcf3ddd9e0b1&code=16da05eb-78ea-4323-a742-bdbf2b8362c1.ba1bf1a8-cf0f-4563-8028-fcf3ddd9e0b1.9406568b-bc51-4841-a8ae-99a3fdb381c2 HTTP/1.1", host: "localhost"

What am I missing? The session_state object is clearly there.

Thanks.

@lordgreg
Copy link

@ja-softdevel - can you list which luarocks plugins you have installed?

usually, its lua-resty-session, which appears twice and causes the exact problem you are having.

@ja-softdevel
Copy link

@ja-softdevel - can you list which luarocks plugins you have installed?

usually, its lua-resty-session, which appears twice and causes the exact problem you are having.

FYI: I haven't had much experience with lua. C++, Python but not lua. So still figuring out how it does things.

Looks like lua-resty-session is appearing twice and lua-resty-openidc in the list:

$ luarocks list resty
Rocks installed for Lua 5.1
---------------------------
lua-resty-acme
   0.11.0-1 (installed) - /usr/local/lib/luarocks/rocks-5.1
lua-resty-counter
   0.2.1-1 (installed) - /usr/local/lib/luarocks/rocks-5.1
lua-resty-healthcheck
   1.6.2-1 (installed) - /usr/local/lib/luarocks/rocks-5.1
lua-resty-http
   0.17.1-0 (installed) - /usr/local/lib/luarocks/rocks-5.1
lua-resty-ipmatcher
   0.6.1-0 (installed) - /usr/local/lib/luarocks/rocks-5.1
lua-resty-jit-uuid
   0.0.7-2 (installed) - /usr/local/lib/luarocks/rocks-5.1
lua-resty-jwt
   0.2.3-0 (installed) - /usr/local/lib/luarocks/rocks-5.1
lua-resty-openidc
   1.7.6-3 (installed) - /usr/local/lib/luarocks/rocks-5.1
   1.6.0-1 (installed) - /usr/local/lib/luarocks/rocks-5.1
lua-resty-openssl
   0.8.23-1 (installed) - /usr/local/lib/luarocks/rocks-5.1
lua-resty-session
   4.0.4-1 (installed) - /usr/local/lib/luarocks/rocks-5.1
   3.10-1 (installed) - /usr/local/lib/luarocks/rocks-5.1
lua-resty-timer
   1.1.0-1 (installed) - /usr/local/lib/luarocks/rocks-5.1
lua-resty-timer-ng
   0.2.5-1 (installed) - /usr/local/lib/luarocks/rocks-5.1

In the Dockerfile, I'm installing 3 lua packages.:

git clone --branch resty-session-4.x https://github.com/oldium/lua-resty-openidc.git
git clone --branch v1.4.0-1 https://github.com/revomatico/kong-oidc.git
git clone --branch v1.1.0 https://github.com/dkoltsuk/kong-plugin-jwt-keycloak.git

Should I first uninstall lua-resty-openidc and lua-resty-session packages before doing the git clones?
Thanks.

@lordgreg
Copy link

How did you install the plugins? You've added the git clone commands, but do you made any luarocks make *.spec?

Anyways,

luarocks uninstall lua-resty-session 4.0.4-1 --force will fix your issue. The 3.10.1 gets installed using kong-oidc > lua-resty-openidc > lua-resty-session dependency hell :)

Which is why we are talking merging this PR into the master. :)

@oldium
Copy link
Collaborator Author

oldium commented Oct 13, 2023

Newest Kong GW images use lua-resty-session 4, so I think that would not work. I guess you have this for Kong GW, right?

@ja-softdevel
Copy link

Alrighty!

So I added this line to the Dockerfile just after my apt updates but before doing the git clones which removed 4.0.4-1.

RUN luarocks remove lua-resty-session --force

After I clone @oldium 's fork and set to the resty-session-4.x branch, that repo will cause lua-resty-session 4.0.5-1 to get installed.

Then starting docker-compose and letting decK complete, I added the kong-oidc plugin to the (oh so lovely) '/cats' route. Only items set on the plugin were:
client id, client secret, discovery uri, and I changed the realm to match the one I set in keycloak.

I have deleted the image and rebuilt it. Then ran docker up/down to ensure this worked.

Thank you so much @lordgreg and @oldium for the assistance. Hopefully, @bodewig can get this merged and maybe add you two as maintainers to help prevent development stall out.

@Dark3clipse
Copy link

I've tested it and it seems to works for me too.

@zaygraveyard
Copy link

I get the following error when trying to logout a user that happens to not be logged-in, which used to work:

lua entry thread aborted: runtime error: /.../lualib/resty/session.lua:2077: unable to destroy nonexistent or closed session
stack traceback:
coroutine 0:
	[C]: in function 'assert'
	/.../lualib/resty/session.lua:2077: in function 'destroy'
	/.../lualib/resty/openidc.lua:1298: in function 'openidc_logout'
	/.../lualib/resty/openidc.lua:1508: in function 'authenticate'

Replacing

session:destroy()
with the following fixes the issue:

  if next(session:get_data()) ~= nil then
    session:destroy()
  end

@mrcjkb mrcjkb mentioned this pull request Dec 7, 2023
13 tasks
@oldium
Copy link
Collaborator Author

oldium commented Dec 11, 2023

Thanks, I will check it

@giafar
Copy link

giafar commented Dec 27, 2023

Hi. Will this get merged? @bodewig

@bodewig
Copy link
Collaborator

bodewig commented Dec 27, 2023

So people don't need to keep asking: I can not foresee when (or even if) I will find to properly review this or #478 myself.

It is my impression that lua-resty-session has also changed semantics so changing the code in way that Lua is happy will not be enough. Reports by people who have tried the patches in both PRs confirm this is not a simple "apply and all is well" fix. I do not have the cycles to understand what has changed between 3.x and 4.x over in lua-resty-session. lua-resty-openidc lacks any tests that would make use of sessions and personally I don't run any environment using lua-resty-openidc at all right now so wouldn't be able to properly test things myself.

@bodewig bodewig removed their assignment Dec 27, 2023
@oldium oldium force-pushed the resty-session-4.x branch 2 times, most recently from 6250ab9 to 95d6fae Compare December 28, 2023 22:43
@oldium
Copy link
Collaborator Author

oldium commented Dec 28, 2023

I get the following error when trying to logout a user that happens to not be logged-in, which used to work:

lua entry thread aborted: runtime error: /.../lualib/resty/session.lua:2077: unable to destroy nonexistent or closed session
stack traceback:
coroutine 0:
	[C]: in function 'assert'
	/.../lualib/resty/session.lua:2077: in function 'destroy'
	/.../lualib/resty/openidc.lua:1298: in function 'openidc_logout'
	/.../lualib/resty/openidc.lua:1508: in function 'authenticate'

Replacing

session:destroy()

with the following fixes the issue:

  if next(session:get_data()) ~= nil then
    session:destroy()
  end

I checked it and it seems this is a problem of lua-resty-session, so I reported a bug there. I also added the suggested workaround to lua-resty-openidc and a test case until this is fixed.

@oldium oldium changed the title Migrate lua-resty-session to 4.0.3 Migrate lua-resty-session to 4.0.3 [tested, works] Dec 28, 2023
@oldium
Copy link
Collaborator Author

oldium commented Dec 28, 2023

I have renamed the Pull Request to indicate this is more up-to-date than the second (unmaintained) one.

Anyway, enjoy 🚀😁

@oldium
Copy link
Collaborator Author

oldium commented Dec 28, 2023

Just for info: We are using the code from this Pull Request in our project in Dockerfile in the following way:

ARG KONG_GW_FLAVOR="kong/kong-gateway"
ARG KONG_GW_VERSION="3.4.3.2-ubuntu"

FROM docker.io/${KONG_GW_FLAVOR}:${KONG_GW_VERSION}
...
# Download with https://codeload.github.com/zmartzone/lua-resty-openidc/legacy.tar.gz/pull/489/head
# See https://github.com/zmartzone/lua-resty-openidc/pull/489
ADD zmartzone-lua-resty-openidc-v1.7.6-21-g1553a39.tar.gz /install

RUN ls -l /install; cd /install/zmartzone-lua-resty-openidc-1553a39 \
    && find -name *.rockspec -exec luarocks make {} \;
...

@oldium
Copy link
Collaborator Author

oldium commented Dec 29, 2023

It looks like the tests fail randomly - may be because of timing of flushing the nginx logs to disk? EDIT: This was caused by non-padded Base64 decoding

@oldium
Copy link
Collaborator Author

oldium commented Dec 29, 2023

Fixed decoding of Base64Url in tests (old issue), so they should pass now.

@oldium
Copy link
Collaborator Author

oldium commented Jan 23, 2024

I have to say that ChatGPT recommended the Base64 fix and it really worked...

@lukeyeager
Copy link

Tested working for me

@GitDemis
Copy link

amazing work, thanks!

@justin-octo
Copy link

@bodewig just curious if there is someone else you trust that can review lua-resty-session and how it impacts lua-resty-openidc if you are unable at the moment.

I am sensitive to supply chain attacks and people trying to force/manipulate maintainers to approve things, especially an identity tools like this. So, not trying to pressure you. Just don't want to see this project get stalled, and if there is someone you trust to review this for you...

@piotrgasior
Copy link

Hi,
Are there any plans to merge this branch to master and make official release?

@justin-octo
Copy link

@bodewig this seems to be stalled because it's not a priority for you. How can the community help get this over the line?

Perhaps someone who worked on the changes from lua-resty-session could assist? Along with someone who uses lua-resty-openidc more frequently?

Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>
Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>
Bug in lua-resty-session does not permit calling session:destroy() on
freshly started session with unset "audience" feature, so check for empty
session before trying to destroy it.

Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>
Address range 192.0.2.0/24 is reserved for documentation according to RFC
5737. The recommendation is to reject routing of this address range on
routers, but as this is not mandatory, it might happen that the address
is really routed. The tests on Docker on Windows fail because of this it,
the fail reason is different to the expected one.

Fix this by configuring Nginx to listen on 127.0.0.1:80 (and not
0.0.0.0:80) and connecting to 127.1.2.3 instead of 192.0.2.1.

Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>
The mime module expects padded Base64 value, so add missing padding.

Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>
@oldium
Copy link
Collaborator Author

oldium commented Sep 7, 2024

Rebased on top of master

@zandbelt
Copy link
Contributor

zandbelt commented Sep 8, 2024

I believe that by now we should really merge this, as to be compliant with lua-resty-session 4.x moving forward. But we can only do so if someone can take responsibility for fixing stuff that may arise after releasing it, most probably in a v2.0.0. It appears that neither @bodewig or me are able to do that so @oldium if we could add you as a maintainer I believe we can move forward with this assuming @bodewig agrees as well. Both, please confirm.

@oldium
Copy link
Collaborator Author

oldium commented Sep 8, 2024

I can do bugfixing after release same as I did in this thread, so no problem for me.

@bodewig
Copy link
Collaborator

bodewig commented Sep 8, 2024

It is a lack of time and energy, not "not a priority", but the result is the same. I'm totally fine with adding @oldium

I have glanced over the code in the past and did the same just now. I am not sure this patch is going to create a new session cookie as it no longer calls regenerate when the token has been refreshed - so the result might be prone to the race condition we tried to make less likely by regenerating (see #190 ). I'm not sure what lua-resty-session 4 does under the covers and not whether it would even be possible to force a new cookie - and this is where I've always run out of steam in the past.

In less words this patch may bring back #190 or not, I don't really know.

@zandbelt
Copy link
Contributor

zandbelt commented Sep 9, 2024

@oldium you've been invited as a collaborator on this project with write access; if you could address @bodewig 's comment and merge to master, we'll release whenever you think it is ready

@zandbelt zandbelt merged commit 0a2aa18 into zmartzone:master Sep 9, 2024
1 check passed
zandbelt added a commit that referenced this pull request Sep 9, 2024
closes #464 #480 #503; thanks @oldium @balajiv113

Signed-off-by: Hans Zandbelt <hans.zandbelt@openidc.com>
@justin-octo
Copy link

Hello @bodewig, I just meant you had other things in your life with higher priority. Which is totally understandable. I did NOT mean to imply that you didn't care. You obviously have put a lot of time and effort into this, and it is appreciated by many.

@bodewig
Copy link
Collaborator

bodewig commented Sep 9, 2024

Hello @bodewig, I just meant you had other things in your life with higher priority. Which is totally understandable. I did NOT mean to imply that you didn't care. You obviously have put a lot of time and effort into this, and it is appreciated by many.

Don't worry @justin-octo , there are no hard feelings and I didn't take it as an insult. Just wanted to explain my situation a bit.

Thank you for your kind words.

@bodewig
Copy link
Collaborator

bodewig commented Sep 9, 2024

In less words this patch may bring back #190 or not, I don't really know.

The new code invokes session:save and the docs seem to say this will result in a new session cookie with a new session id, so things should work more or less like the old regenerate path did. I haven't verified it, though.

@oldium
Copy link
Collaborator Author

oldium commented Sep 10, 2024

In less words this patch may bring back #190 or not, I don't really know.

The new code invokes session:save and the docs seem to say this will result in a new session cookie with a new session id, so things should work more or less like the old regenerate path did. I haven't verified it, though.

I remember investigating this and using save at the end. The code really generates new sid on every call to save, which is then encoded into the cookie itself (stored into internal cookie's header part and used to derive an AES encryption key) and used by the storage backend as a data key (optionally hashed). So race condition should be handled fine, the first cookie should still work.

image

@oldium
Copy link
Collaborator Author

oldium commented Sep 10, 2024

The only problem could arise when multiple use of a refresh token is being prevented (when a refresh issues a new refresh token and invalidates the token used), but since a failed refresh does not update the cookie, this should only occur once when multiple requests are issued in parallel with an expired access token.

@bodewig
Copy link
Collaborator

bodewig commented Sep 10, 2024

right - and this is a situation that we also could not prevent with the regenerate "solution" of 1.7.0.

@zandbelt
Copy link
Contributor

@bodewig @oldium it seems we have feature/known-issue parity with 1.7.6 then? ; @oldium just let me know when you think we should cut a new release 1.8.0, perhaps after receiving feedback from @markbanierink in #526 (comment) ?

@oldium
Copy link
Collaborator Author

oldium commented Sep 13, 2024

The tenant-specific usage worked, so I think we can cut a new release 😊

@zandbelt
Copy link
Contributor

https://github.com/zmartzone/lua-resty-openidc/releases/tag/v1.8.0

@Dark3clipse
Copy link

Great news! Thanks everyone for all the hard work

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.