-
Bug
-
Resolution: Done
-
Major
-
None
-
None
-
3
-
False
-
-
False
-
With the recent changes to service to service auth for Backstage plugin communication, if a plugin does not exist or there are errors generating a token for the plugin, it breaks our permission metadata retrieval for all plugins. This has now been fixed
-
-
-
RHDH Plugins 3259
Description of problem: **
Getting 500 on APIs (/api/permission/plugins/policies and /api/permission/plugins/condition-rules)if there is typo/wrong entry for below config
permission:
enabled: true
rbac:
policies-csv-file: /Users/jakumar/Workspaces/backstage-plugins/rbac-policy.csv
pluginsWithPermission:
- catalog
- permission
- scaffolder
- kubernetes34
error can be seen below
{
"error": {
"name": "Error",
"message": "Unable to generate legacy token for communication with the 'kubernetes34' plugin. You will typically encounter this error when attempting to call a plugin that does not exist, or is deployed with an old version of Backstage; caused by Error: Unable to generate legacy token, no legacy keys are configured in 'backend.auth.keys' or 'backend.auth.externalAccess'",
"cause":
,
"stack": "Error: Unable to generate legacy token for communication with the 'kubernetes34' plugin. You will typically encounter this error when attempting to call a plugin that does not exist, or is deployed with an old version of Backstage; caused by Error: Unable to generate legacy token, no legacy keys are configured in 'backend.auth.keys' or 'backend.auth.externalAccess'\n at <anonymous> (/Users/jakumar/Workspaces/backstage-plugins/node_modules/@backstage/backend-app-api/src/services/implementations/auth/DefaultAuthService.ts:155:17)\n at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
},
"request":
,
"response":
}
Prerequisites (if any, like setup, operators/versions):
Steps to Reproduce
- Configure RBAC fronted / backend plugin
- Add config as suggested above
- try the endpoint using CURL or UI
Actual results:
API return 500 with above error
Expected results:
The data should be returned for the valid plugin / or for those permission policies exist should be shown
Reproducibility (Always/Intermittent/Only Once): Always
Build Details:
Additional info (Such as Logs, Screenshots, etc):