Uploaded image for project: 'Project Quay'
  1. Project Quay
  2. PROJQUAY-7217

CLI login on AAD fails due to missing parameter

XMLWordPrintable

    • Incidents & Support
    • False
    • Hide

      None

      Show
      None
    • False
    • Quay Enterprise
    • Customer Escalated

      When Azure AD is used, CLI login fails because of a missing parameter:

      ...
      2024-05-16T15:39:43.301167401Z gunicorn-registry stdout | 2024-05-16 15:39:43,300 [242] [DEBUG] [auth.basic] Attempt to process basic auth header
      
      2024-05-16T15:39:43.395617601Z gunicorn-registry stdout | 2024-05-16 15:39:43,394 [242] [DEBUG] [urllib3.connectionpool] https://login.windows.net:443 "POST /d1e.../oauth2/token HTTP/1.1" 400 484
      
      2024-05-16T15:39:43.396353826Z gunicorn-registry stdout | 2024-05-16 15:39:43,395 [242] [DEBUG] [oauth.oidc] Got get_access_token response {"error":"invalid_request"
      ,"error_description":"AADSTS900144: The request body must contain the following parameter: 'resource'. Trace ID: 109b... Correlation ID:
       bc... Timestamp: 2024-05-16 15:39:43Z","error_codes":[900144],"timestamp":"2024-05-1615:39:43Z","trace_id":"109b3...","correlation_id":"bc64...","error_uri":"https://login.windows.net/error?code=900144"}
      
      2024-05-16T15:39:43.396645338Z gunicorn-registry stdout | 2024-05-16 15:39:43,395 [242] [ERROR] [data.users.externaloidc] External OIDC Group Sync: Exception while v
      erifying credentials: Got 400 response for code exchange: {"error":"invalid_request",...
      
      2024-05-16T15:39:43.396645338Z gunicorn-registry stdout |   File "/quay-registry/data/users/externaloidc.py", line 52, in verify_credentials
      2024-05-16T15:39:43.396645338Z gunicorn-registry stdout |     response = service.password_grant_for_login(username_or_email, password)
      2024-05-16T15:39:43.396645338Z gunicorn-registry stdout |   File "/quay-registry/oauth/oidc.py", line 355, in password_grant_for_login
      2024-05-16T15:39:43.396645338Z gunicorn-registry stdout |     raise PasswordGrantException(
      2024-05-16T15:39:43.396645338Z gunicorn-registry stdout | oauth.oidc.PasswordGrantException: Got 400 response for code exchange: {"error":"invalid_request",...
      
      2024-05-16T15:39:43.396645338Z gunicorn-registry stdout | 2024-05-16 15:39:43,396 [242] [WARNING] [auth.credentials] Failed to validate credentials for user XXXXXX: Got 400 response for code exchange: {"error":"invalid_request",...
      2024-05-16T15:39:43.396915713Z gunicorn-registry stdout | 2024-05-16 15:39:43,396 [242] [ERROR] [util.http] Error 401: Anonymous access is not allowed; Arguments: {'url': 'https://QUAY_ENDPOINT/v2/auth?service=QUAY_ENDPOINT', 'status_code': 401, 'message': 'Anonymous access is not allowed'}
      
      2024-05-16T15:39:43.397544520Z gunicorn-registry stdout | 2024-05-16 15:39:43,397 [242] [DEBUG] [app] Ending request: urn:request:c81c36e7-d5ab-4ed0-b58f-f4e8ff7b8890 (/v2/auth) {'endpoint': 'v2.generate_registry_jwt', 'request_id': 'urn:request:c81c36e7-d5ab-4ed0-b58f-f4e8ff7b8890', 'remote_addr': '10.72.30.16', 'http_method': 'GET', 'original_url': 'https:/QUAY_ENDPOINT/v2/auth?service=QUAY_ENDPOINT', 'path': '/v2/auth', 'parameters': {'service': 'QUAY_ENDPOINT'}, 'json_body': None, 'confsha': '7299b7e7', 'user-agent': 'Go-http-client/1.1'}
      
      2024-05-16T15:39:43.398136054Z gunicorn-registry stdout | 2024-05-16 15:39:43,397 [242] [INFO] [gunicorn.access] 10.72.30.16 - XXXXXXXX [16/May/2024:15:39:43 +0000] "GET /v2/auth?service=QUAY_ENDPOINT HTTP/1.1" 401 44 "-" "Go-http-client/1.1"
      

      Seems that Azure AD requires the resource parameter for the login to be successful.

              rh-ee-shudeshp Shubhra Jayant Deshpande
              rhn-support-ibazulic Ivan Bazulic
              Votes:
              0 Vote for this issue
              Watchers:
              11 Start watching this issue

                Created:
                Updated:

                  Estimated:
                  Original Estimate - 1 week
                  1w
                  Remaining:
                  Remaining Estimate - 1 week
                  1w
                  Logged:
                  Time Spent - Not Specified
                  Not Specified