"As a Client Developer, I want to have a single API key that I use across all Wikimedia projects and language versions, so I have one relationship to manage with the organization."
Description
Description
Details
Details
Related Changes in Gerrit:
Customize query in gerrit
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | • eprodromou | T235270 Wikimedia API Gateway | |||
| Resolved | • eprodromou | T255030 Wikimedia API Gateway MVP | |||
| Resolved | hnowlan | T235277 Client Developer uses OAuth 2.0 for authorization | |||
| Resolved | • Pchelolo | T261428 Add support for iss claim in OAuth2 access tokens | |||
| Resolved | • Pchelolo | T261986 Upload WMF fork of oauth2-server to packagist and vendor it |
Event Timeline
Comment Actions
@hnowlan I don't believe there's anything you have to do for Envoy here. We're going to be using bearer tokens for OAuth 2.0 which come in as HTTP headers. As long as we're not doing something crazy like stripping all HTTP headers (!?!), this should just work.
Comment Actions
@hnowlan assigning to you since you're configuring Envoy. I don't think there's a lot of work here, but it's important that we make sure it works.
Comment Actions
I don't think the user story matches with my work on the API gateway beyond the basics - staging testing has indicated that we're not mangling any headers specific to authorisation. What would constitute done for this task?
Comment Actions
nosmo@ocasey ~ $ curl -H "Authorization: Bearer BAD_TOKEN" https://api.wikimedia.org/core/v1/wikipedia/zh/foo/abc && echo Jwt is not in the form of Header.Payload.Signature with two dots and 3 sections
This demonstrates that the headers are being passed properly and not mangled by envoy before being checked.
Comment Actions
This isn't working for me.
Here's what I do:
Evans-MBP:~ eprodromou$ export TOKEN=`<wikimedia.token` # JWT is in this file
Evans-MBP:~ eprodromou$ curl -H "Authorization: Bearer $TOKEN" https://api.wikimedia.org/core/v1/wikipedia/en/search/page?q=pizza
{"httpCode":401,"httpReason":"Jwt issuer is not configured"}
Evans-MBP:~ eprodromou$ curl -H "Authorization: Bearer $TOKEN" https://en.wikipedia.org/w/rest.php/v1/search/page?q=pizza
# Lots of dataComment Actions
Change 622794 had a related patch set uploaded (by Hnowlan; owner: Hnowlan):
[operations/deployment-charts@master] api-gateway: Make JWT issuer configurable.
Comment Actions
Change 622799 had a related patch set uploaded (by Hnowlan; owner: Hnowlan):
[operations/deployment-charts@master] api-gateway: Make JWT issuer configurable.
Comment Actions
Change 622794 merged by jenkins-bot:
[operations/deployment-charts@master] api-gateway: Make JWT issuer configurable.
Comment Actions
Our OAuth2 tokens do not specify issuer. This isn't a violation of the standard but Envoy 1.15 insists on having this specified - there is a fix in Envoy 1.16 . I think I can hack around this short-term, but until that's done we can't use Mediawiki's tokens with Envoy.
Comment Actions
Change 625942 had a related patch set uploaded (by Hnowlan; owner: Hnowlan):
[operations/deployment-charts@master] api-proxy: Set password for ratelimit
Comment Actions
Change 625942 merged by jenkins-bot:
[operations/deployment-charts@master] api-proxy: Set password for ratelimit
Comment Actions
I'm still seeing an error here. If I check my token on jwt.io, it shows the "iss" property, but I still get {"httpCode":401,"httpReason":"Jwt issuer is not configured"}
Comment Actions
Change 626342 had a related patch set uploaded (by Hnowlan; owner: Hnowlan):
[operations/deployment-charts@master] api-gateway: Fix isser to match one used by meta
Comment Actions
Change 626342 merged by jenkins-bot:
[operations/deployment-charts@master] api-gateway: Fix isser to match one used by meta
Comment Actions
Change 622799 abandoned by Hnowlan:
[operations/deployment-charts@master] api-gateway: Make JWT issuer configurable.
Reason: