Uploaded image for project: 'Red Hat Internal Developer Platform'
  1. Red Hat Internal Developer Platform
  2. RHIDP-2858

[RBAC] Getting 500 on APIs (/api/permission/plugins/policies and /api/permission/plugins/condition-rules)

Prepare for Y ReleasePrepare for Z ReleaseRemove QuarterXMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Major Major
    • 1.2
    • None
    • RBAC Plugin
    • None
    • 3
    • False
    • Hide

      None

      Show
      None
    • False
    • With the recent changes to service to service auth for Backstage plugin communication, if a plugin does not exist or there are errors generating a token for the plugin, it breaks our permission metadata retrieval for all plugins. This has now been fixed
    • RHDH Plugins 3259

      Description of problem:  **

      Getting 500 on APIs (/api/permission/plugins/policies and /api/permission/plugins/condition-rules)if there is typo/wrong entry for below config

      permission:
         enabled: true
         rbac:
           policies-csv-file: /Users/jakumar/Workspaces/backstage-plugins/rbac-policy.csv
           pluginsWithPermission:
             - catalog
             - permission
             - scaffolder
             - kubernetes34

      error can be seen below

      {
          "error": {
              "name": "Error",
              "message": "Unable to generate legacy token for communication with the 'kubernetes34' plugin. You will typically encounter this error when attempting to call a plugin that does not exist, or is deployed with an old version of Backstage; caused by Error: Unable to generate legacy token, no legacy keys are configured in 'backend.auth.keys' or 'backend.auth.externalAccess'",
              "cause":

      {             "name": "Error",             "message": "Unable to generate legacy token, no legacy keys are configured in 'backend.auth.keys' or 'backend.auth.externalAccess'",             "stack": "Error: Unable to generate legacy token, no legacy keys are configured in 'backend.auth.keys' or 'backend.auth.externalAccess'\n    at DisabledTokenManager.getToken (/Users/jakumar/Workspaces/backstage-plugins/node_modules/@backstage/backend-common/src/tokens/ServerTokenManager.ts:48:11)\n    at DefaultAuthService.getPluginRequestToken (/Users/jakumar/Workspaces/backstage-plugins/node_modules/@backstage/backend-app-api/src/services/implementations/auth/DefaultAuthService.ts:154:34)\n    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)\n    at PluginPermissionMetadataCollector.getPluginMetaData (/Users/jakumar/Workspaces/backstage-plugins/plugins/rbac-backend/src/service/plugin-endpoints.ts:101:25)\n    at PluginPermissionMetadataCollector.getPluginPolicies (/Users/jakumar/Workspaces/backstage-plugins/plugins/rbac-backend/src/service/plugin-endpoints.ts:77:28)\n    at <anonymous> (/Users/jakumar/Workspaces/backstage-plugins/plugins/rbac-backend/src/service/policies-rest-api.ts:767:20)"         }

      ,
              "stack": "Error: Unable to generate legacy token for communication with the 'kubernetes34' plugin. You will typically encounter this error when attempting to call a plugin that does not exist, or is deployed with an old version of Backstage; caused by Error: Unable to generate legacy token, no legacy keys are configured in 'backend.auth.keys' or 'backend.auth.externalAccess'\n    at <anonymous> (/Users/jakumar/Workspaces/backstage-plugins/node_modules/@backstage/backend-app-api/src/services/implementations/auth/DefaultAuthService.ts:155:17)\n    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
          },
          "request":

      {         "method": "GET",         "url": "/api/permission/plugins/policies"     }

      ,
          "response":

      {         "statusCode": 500     }

      }

      Prerequisites (if any, like setup, operators/versions):

      Steps to Reproduce

      1. Configure RBAC fronted / backend plugin
      2. Add config as suggested above
      3. try the endpoint using CURL or UI

      Actual results:

      API return 500 with above error

      Expected results:

      The data should be returned for the valid plugin / or for those permission policies exist should be shown

      Reproducibility (Always/Intermittent/Only Once): Always

      Build Details:

      Additional info (Such as Logs, Screenshots, etc):

       

              rh-ee-pknight Patrick Knight
              jakumar jaivardhan Kumar
              RHIDP - Plugins
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: