{"action":"created","issue":{"url":"https://api.github.com/repos/authzforce/fiware/issues/7","repository_url":"https://api.github.com/repos/authzforce/fiware","labels_url":"https://api.github.com/repos/authzforce/fiware/issues/7/labels{/name}","comments_url":"https://api.github.com/repos/authzforce/fiware/issues/7/comments","events_url":"https://api.github.com/repos/authzforce/fiware/issues/7/events","html_url":"https://github.com/authzforce/fiware/issues/7","id":171886073,"number":7,"title":"Problem in interaction between idm,pep and authzforce","user":{"login":"AnotherCodeArtist","id":6880844,"avatar_url":"https://avatars.githubusercontent.com/u/6880844?v=3","gravatar_id":"","url":"https://api.github.com/users/AnotherCodeArtist","html_url":"https://github.com/AnotherCodeArtist","followers_url":"https://api.github.com/users/AnotherCodeArtist/followers","following_url":"https://api.github.com/users/AnotherCodeArtist/following{/other_user}","gists_url":"https://api.github.com/users/AnotherCodeArtist/gists{/gist_id}","starred_url":"https://api.github.com/users/AnotherCodeArtist/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/AnotherCodeArtist/subscriptions","organizations_url":"https://api.github.com/users/AnotherCodeArtist/orgs","repos_url":"https://api.github.com/users/AnotherCodeArtist/repos","events_url":"https://api.github.com/users/AnotherCodeArtist/events{/privacy}","received_events_url":"https://api.github.com/users/AnotherCodeArtist/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-08-18T12:10:05Z","updated_at":"2016-08-26T13:31:05Z","closed_at":null,"body":"There's apparently a problem in the interaction between idm, authzforce and probably pep.\r\nSince I cannot tell which component is the actual trouble maker, I've filed an issue at the IdM project as well. So please see this [issue](https://github.com/ging/fiware-idm/issues/70) for a detailed description. I cannot see any rules in the PAP that correspond to the roles I have defined in IdM, although the IdM creates a valid domain.\r\n\r\nAs mentioned in the other issue, authentication between my client app and the IdM works perfectly fine. But whenever PEP tries to perform the authorization, things go terribly wrong.\r\n\r\nHere's again the log from PEP:\r\n```\r\n2016-08-18 11:32:30.971  - INFO: IDM-Client - Checking token with IDM...\r\n2016-08-18 11:32:31.001  - INFO: AZF-Client - Checking auth with AZF...\r\n2016-08-18 11:32:31.002  - INFO: AZF-Client - Checking authorization to roles [ 'provider', '4db71b9d39d340f387585ed832c28c78' ] to do  GET  on  v2/entities and app  6806127773ae47fdb777886585358543\r\n2016-08-18 11:32:31.002  - INFO: AZF-Client - Checking auth with AZF...\r\n2016-08-18 11:32:31.006  - ERROR: Server - Caught exception: Error: There are errors in your xml file: syntax error\r\n```\r\n\r\nWireshark revealed the following:\r\n\r\nPEP first checks the token with the IdM\r\n```\r\nFrame 43: 142 bytes on wire (1136 bits), 142 bytes captured (1136 bits) on interface 0\r\nEthernet II, Src: AsustekC_86:b6:ea (d8:50:e6:86:b6:ea), Dst: Apple_1f:46:33 (c8:2a:14:1f:46:33)\r\nInternet Protocol Version 4, Src: 10.12.200.84, Dst: 10.12.200.247\r\nTransmission Control Protocol, Src Port: 41769 (41769), Dst Port: 8000 (8000), Seq: 1449, Ack: 1, Len: 76\r\n    Source Port: 41769\r\n    Destination Port: 8000\r\n    [Stream index: 2]\r\n    [TCP Segment Len: 76]\r\n    Sequence number: 1449    (relative sequence number)\r\n    [Next sequence number: 1525    (relative sequence number)]\r\n    Acknowledgment number: 1    (relative ack number)\r\n    Header Length: 32 bytes\r\n    Flags: 0x018 (PSH, ACK)\r\n    Window size value: 1369\r\n    [Calculated window size: 87616]\r\n    [Window size scaling factor: 64]\r\n    Checksum: 0x98a7 [validation disabled]\r\n    Urgent pointer: 0\r\n    Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps\r\n    [SEQ/ACK analysis]\r\n    TCP segment data (76 bytes)\r\n[2 Reassembled TCP Segments (1524 bytes): #42(1448), #43(76)]\r\nHypertext Transfer Protocol\r\n    GET /user?access_token=lH15kS8pSCV1wGFf57lp1zYMAsBTuw HTTP/1.1\\r\\n\r\n        [Expert Info (Chat/Sequence): GET /user?access_token=lH15kS8pSCV1wGFf57lp1zYMAsBTuw HTTP/1.1\\r\\n]\r\n        Request Method: GET\r\n        Request URI: /user?access_token=lH15kS8pSCV1wGFf57lp1zYMAsBTuw\r\n        Request Version: HTTP/1.1\r\n    Host: 10.12.200.247:8000\\r\\n\r\n    Connection: keep-alive\\r\\n\r\n    User-Agent: Mozilla/5.0 (Linux; Android 6.0.1; Nexus 7 Build/MOB30P; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/52.0.2743.98 Safari/537.36\\r\\n\r\n    Accept: */*\\r\\n\r\n    Accept-Encoding: gzip, deflate\\r\\n\r\n    Accept-Language: en-US\\r\\n\r\n     [truncated]Cookie: csrftoken=nfAqXttUUjNygfpWdWUBD7DrbANdRstQ; sessionid=\".eJyFU8tu3DYUdcdjjyPHdmK3zbOp0yau3MeYpKhXVkWbVQp4kZaINsaAL1lyZqS5I8qoFwKSTYD-Q3-jX9Af6bZ_EUojt4OiQKCFyHvPuee--GbQwEcu262LSpZzrSamfK0LdigUFUJpFCqCaRr4QqBQIyEI9rXSCrF\r\n    X-Requested-With: com.ionicframework.myfiwareclient357647\\r\\n\r\n    \\r\\n\r\n    [Full request URI: http://10.12.200.247:8000/user?access_token=lH15kS8pSCV1wGFf57lp1zYMAsBTuw]\r\n    [HTTP request 1/1]\r\n```\r\nThen the Idm provides the necessary information about the AFZ domain:\r\n```\r\nHTTP/1.0 200 OK\r\nDate: Thu, 18 Aug 2016 11:32:19 GMT\r\nServer: WSGIServer/0.1 Python/2.7.6\r\nVary: Accept-Language, Cookie\r\nX-Frame-Options: SAMEORIGIN\r\nContent-Type: application/json\r\nContent-Language: en\r\nSet-Cookie:  sessionid=\".eJyFU8tu3DYUdcdjjyPHdmK3zbOp0yau3MeYpKhXVkWbVQp4kZaINsaAL1lyZqS5I8qoFwKSTYD-Q3-jX9Af6bZ_EUojt4OiQKCFyHvPuee--GbQwEcu262LSpZzrSamfK0LdigUFUJpFCqCaRr4QqBQIyEI9rXSCrFRXenFJFfJaG1t7aLMClVqGLDthT7Py2JS8Jk-ZTsTXpts0kOzAdvr3bpQ8zIvTHLfsjNj5s9OTjAJx8h--Jnne354cumdwDrbs9zLXOpqsqQmm5bx85znBYEh218REFza1BU7snUUlbG3zjnu7eOf9FVlykL_0ON2prwyEy5Nfpmbqxd__v7HK7bRlS__E6EN7_zSehzYOH4Lmw2MXLapyplNA7YauOGyQa7AOWXDtnDYPq3Zbp_4j9zwaXkON89gp4FdN7lhC7iuvzqDPbeBW26ybq31Ygq3s_UOYZ16kXKpYT_Zur4XfNrVv2wFHGTDDts31Wbw8Up7kkFLU_BJcmgPGPu-FwYi8r2Aklhy6hNClY-8iFKJeN3Ap252-wMDyfaTDQvgapYX2cGKWLaqnC0lqeIhkgRFAeEUqUikfojaJEgYEx4IK3mnlbz3f5I-QqhXbAPPazHN5Ycl7WqGItXaDxXlSkYxkphEXNoiI-GRWidDCzNXc73sqtKFsdO_pqdxEFKCYs82KUUxj1KayhB5KVECyyW5m_Ddjv66X6mas41FOdUV3DuD-w08cPuAoUSppwIUehGmOhUiCFI_DrEkMfalr7O7__bTBtntFnm5V-04H3avS-mU11MDn7Fbq_4uj0cd4nmP-JyN9K_zfGETOZSKG23ymXb-OcBj5oz-2tq_-dBZ__s3mVdlFCA87v8OM9KBL45fwpfvXsITNpovygstDTxt4MjNnGS7a9hscm3_Ktvu1tbawK3ZsE0Ojhv42oKzgXW2hAv1vdGVGctyVneP5Bt2iGIU45TjgGNBhd3AIOICpxGNcEQJxfAt2zS64IWB77KjWtTj9wRqWnM:1baLYZ:YyDjkSAR3VR82PFrrTF29kTd5zE\"; httponly; Path=/\r\n\r\n{\"organizations\": [], \"displayName\": \"johndoe\", \"roles\": [{\"name\": \"Provider\", \"id\": \"provider\"}, {\"name\": \"Restaurant-Viewer\", \"id\": \"4db71b9d39d340f387585ed832c28c78\"}], \"app_id\": \"6806127773ae47fdb777886585358543\",\r\n \"email\": \"jd@test.com\", \"id\": \"johndoe\", \"app_azf_domain\": \"-XUmQmUdEeatWgJCrBEABg\"}\r\n````\r\n\r\nAfter this I cannot make out a valid http request sent from PEP to AFZ, nevertheless the following response pops up:\r\n\r\n```\r\nFrame 67: 200 bytes on wire (1600 bits), 200 bytes captured (1600 bits) on interface 9\r\nNull/Loopback\r\nInternet Protocol Version 4, Src: 10.12.200.247, Dst: 10.12.200.247\r\nTransmission Control Protocol, Src Port: 8282 (8282), Dst Port: 62035 (62035), Seq: 1, Ack: 329, Len: 144\r\n    Source Port: 8282\r\n    Destination Port: 62035\r\n    [Stream index: 3]\r\n    [TCP Segment Len: 144]\r\n    Sequence number: 1    (relative sequence number)\r\n    [Next sequence number: 145    (relative sequence number)]\r\n    Acknowledgment number: 329    (relative ack number)\r\n    Header Length: 32 bytes\r\n    Flags: 0x018 (PSH, ACK)\r\n    Window size value: 12749\r\n    [Calculated window size: 407968]\r\n    [Window size scaling factor: 32]\r\n    Checksum: 0xa6bd [validation disabled]\r\n    Urgent pointer: 0\r\n    Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps\r\n    [SEQ/ACK analysis]\r\nHypertext Transfer Protocol\r\n    HTTP/1.1 400 Bad Request\\r\\n\r\n        [Expert Info (Chat/Sequence): HTTP/1.1 400 Bad Request\\r\\n]\r\n        Request Version: HTTP/1.1\r\n        Status Code: 400\r\n        Response Phrase: Bad Request\r\n    Server: Apache-Coyote/1.1\\r\\n\r\n    Transfer-Encoding: chunked\\r\\n\r\n    Date: Thu, 18 Aug 2016 11:32:31 GMT\\r\\n\r\n    Connection: close\\r\\n\r\n    \\r\\n\r\n    [HTTP response 1/1]\r\n    HTTP chunked response\r\n        End of chunked encoding\r\n            Chunk size: 0 octets\r\n        \\r\\n\r\n```\r\n\r\nSo maybe there's something wrong with the request sent from PEP. Nevertheless, could you please check whether the XML stored in AFZ looks ok (https://github.com/ging/fiware-idm/issues/70)?\r\n\r\nThe permissions for role \"Restaurant-Viewer\" should be \"GET\" , \"/v2/entities\"."},"comment":{"url":"https://api.github.com/repos/authzforce/fiware/issues/comments/242735873","html_url":"https://github.com/authzforce/fiware/issues/7#issuecomment-242735873","issue_url":"https://api.github.com/repos/authzforce/fiware/issues/7","id":242735873,"user":{"login":"AnotherCodeArtist","id":6880844,"avatar_url":"https://avatars.githubusercontent.com/u/6880844?v=3","gravatar_id":"","url":"https://api.github.com/users/AnotherCodeArtist","html_url":"https://github.com/AnotherCodeArtist","followers_url":"https://api.github.com/users/AnotherCodeArtist/followers","following_url":"https://api.github.com/users/AnotherCodeArtist/following{/other_user}","gists_url":"https://api.github.com/users/AnotherCodeArtist/gists{/gist_id}","starred_url":"https://api.github.com/users/AnotherCodeArtist/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/AnotherCodeArtist/subscriptions","organizations_url":"https://api.github.com/users/AnotherCodeArtist/orgs","repos_url":"https://api.github.com/users/AnotherCodeArtist/repos","events_url":"https://api.github.com/users/AnotherCodeArtist/events{/privacy}","received_events_url":"https://api.github.com/users/AnotherCodeArtist/received_events","type":"User","site_admin":false},"created_at":"2016-08-26T13:31:05Z","updated_at":"2016-08-26T13:31:05Z","body":"Hi @cdanger! I'll provide you with the capture result on Monday. To me it's just some binary content sent to the authzforce port, so I doubt that would be helpful. It's definitely no valid request so I totally agree with AZF's response but also don't know what triggers this response. Anyway, we will see soon.\r\nBTW: Is it possible for you to setup a working security installation based on the currently available docker-images/Dockerfiles or master branches?"}}
{"actor":{"display_login":"AnotherCodeArtist"}}