Uploaded image for project: 'Red Hat 3scale API Management'
  1. Red Hat 3scale API Management
  2. THREESCALE-8276

backend usages endpoint fail when provider key is used

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Obsolete
    • Icon: Major Major
    • None
    • 2.11.1 GA
    • System
    • False
    • False
    • Not Started
    • Not Started
    • Not Started
    • Not Started
    • Not Started
    • Not Started
      • Generate an access token with read/write permissions on the Account Management
      • Create a new secret with the acccess token
      • Make references to that new secret from Product & Backend resources

      Backend Usages endpoint return `403 Forbidden` when token used is Provider Key instead of the Access Token.

      GET /admin/api/services/2555417723913/backend_usages.json HTTP/1.1
      Host: 3scale-supertest-admin.3scale.net:443
      User-Agent: Go-http-client/1.1
      Accept: application/xml
      Authorization: Basic XXXX
      Accept-Encoding: gzip
      
      2022/03/04 16:01:30 HTTP/1.1 403 Forbidden
      

       

      When an access token is used instead, the API works as expected. 

       

      This issue was introduced in 3scale 2.11. In 3scale 2.10 backend usages endpoint could be used using Provider Key

       

      This issue breaks 3scale operator capabilities to use Backends and Products with ProviderKeys. Which is the default, as the 3scale API does not allow to create and get Access Tokens using the ProviderKeys (always has been like that).

       

      The workaround is that the customer manually creates access tokens in the UI and saves them in a secret to be read by the operator.

       

      With the master token access, the tenant's provider key can be read, but not the access tokens associated to admin users.

       

      Usually the current workflow is:

      a) the customer installs 3scale and master access token is saved in `system-seed`

      b) the customer creates a Tenant CR] with a reference to the system-seed secret

      c) The operator saves the tenant's provider key in a secret

      d) The customer creates Product CR and Backend CR with a reference to the tenant secret, which contains the provider key.

       

      This workflow used to work for 3scale 2.10, but is broken in 2.11

       

       

       

            Unassigned Unassigned
            eguzki Eguzki Astiz Lezaun
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved: