Basic auth login issue

[vdice]

I'm having trouble logging in with basic auth. Tested with latest commit on main (as of writing: d62d537bb096fb8ce25cabb731471b7a500d7e10) and most recent v0.8.0 tag.

However, I may be missing something. Here's my flow:

1. Generate htpassword file, start bindle server

$ echo ${PASSWORD} | htpasswd -cBi ./htpassword admin
Adding password for user admin

$ AUTH_MODE='--htpasswd-file ./htpassword' make serve
cargo run --features cli --bin bindle-server -- --directory /Users/vdice/.bindle/bindles --address 127.0.0.1:8080   --htpasswd-file ./htpassword
    Finished dev [unoptimized + debuginfo] target(s) in 0.07s
     Running `target/debug/bindle-server --directory /Users/vdice/.bindle/bindles --address '127.0.0.1:8080' --htpasswd-file ./htpassword`
2022-02-04T17:59:10.224917Z  WARN bindle_server: No config file loaded error=failed to read TOML file /Users/vdice/Library/Application Support/bindle/server.toml: No such file or directory (os error 2)
2022-02-04T17:59:10.224995Z  WARN bindle_server: No keyring.toml found. Using default keyring.
2022-02-04T17:59:10.225172Z  INFO bindle_server: Using verification strategy of GreedyVerification
2022-02-04T17:59:10.225505Z  INFO bindle_server: Starting server at 127.0.0.1:8080, and serving bindles from /Users/vdice/.bindle/bindles
2022-02-04T17:59:10.225520Z  INFO bindle_server: Using FileProvider
2022-02-04T17:59:10.225528Z  INFO bindle_server: Auth mode: HTTP Basic Auth
2022-02-04T17:59:10.225677Z DEBUG bindle::provider::file: Creating new file provider path=/Users/vdice/.bindle/bindles cache_size=50
2022-02-04T17:59:10.225755Z DEBUG bindle::provider::file: warming index
2022-02-04T17:59:10.225768Z  INFO bindle::provider::file: Beginning index warm path=/Users/vdice/.bindle/bindles
2022-02-04T17:59:10.225965Z  INFO bindle::provider::file: Loading invoice into search index path=/Users/vdice/.bindle/bindles/invoices/26a53c8670e4bbcb1ec1adbb0f87b6a28a363636835e67d7ebd4f7cba6db3753/invoice.toml
2022-02-04T17:59:10.242246Z  INFO bindle::provider::file: Loading invoice into search index path=/Users/vdice/.bindle/bindles/invoices/9952d6c87384a10846abdb9cd8a84796bb36b3d12140144f3b59b1d77cba4811/invoice.toml
2022-02-04T17:59:10.257905Z  INFO bindle::provider::file: Loading invoice into search index path=/Users/vdice/.bindle/bindles/invoices/59ec977e4fcca995e928e61bb4f25869a058f85479a6b63ea0e4d61e2794b4c1/invoice.toml
2022-02-04T17:59:10.273870Z  INFO bindle::provider::file: Loading invoice into search index path=/Users/vdice/.bindle/bindles/invoices/c809013db4f25a514a3d9dea69edbe10c81a75e625cab979f238e35ead864ed0/invoice.toml
2022-02-04T17:59:10.289691Z  INFO bindle::provider::file: Loading invoice into search index path=/Users/vdice/.bindle/bindles/invoices/912a4ee7f7401408279eb3c646591ecb33953c7cffc01086df50ee891e2c4911/invoice.toml
2022-02-04T17:59:10.305543Z DEBUG bindle::provider::file: Warmed index total_indexed=5
2022-02-04T17:59:10.305658Z DEBUG bindle::server: No TLS config found, starting server in HTTP mode

2. Attempt to login:

$ BINDLE_URL="http://127.0.0.1:8080/v1" BINDLE_HTTP_USER="admin" BINDLE_HTTP_PASSWORD="${PASSWORD}" bindle login
Error contacting server: The request could not be handled by the server. Verify your Bindle server URL

3. Bindle server logs:

2022-02-04T18:00:09.483206Z  INFO request{method=GET path=/v1/login version=HTTP/1.1 remote.addr=127.0.0.1:56443}: warp::filters::trace: processing request
2022-02-04T18:00:09.483632Z ERROR request{method=GET path=/v1/login version=HTTP/1.1 remote.addr=127.0.0.1:56443}: bindle::server::handlers::v1: Unable to parse device auth url error=RelativeUrlWithoutBase
2022-02-04T18:00:09.483725Z DEBUG request{method=GET path=/v1/login version=HTTP/1.1 remote.addr=127.0.0.1:56443}: bindle::server::reply: Parsed accept header into list accept_value=application/toml accept_items=["application/toml"]
2022-02-04T18:00:09.483784Z DEBUG request{method=GET path=/v1/login version=HTTP/1.1 remote.addr=127.0.0.1:56443}: bindle::server::reply: Selected a best-fit MIME best_fit=application/toml
2022-02-04T18:00:09.483865Z  INFO request{method=GET path=/v1/login version=HTTP/1.1 remote.addr=127.0.0.1:56443}: warp::filters::trace: finished processing with success status=400

[thomastaylor312]

This looks like it is somehow hitting the oauth flow code for some reason

2022-02-04T18:00:09.483632Z ERROR request{method=GET path=/v1/login version=HTTP/1.1 remote.addr=127.0.0.1:56443}: bindle::server::handlers::v1: Unable to parse device auth url error=RelativeUrlWithoutBase

[thomastaylor312]

Oh @vdice because it is HTTP basic auth, you don't need to bindle login. You can just set the user and password and be good to go

[thomastaylor312]

I think the solution here is:

• Document this behavior
• Update the client to just return if http basic auth is set

[vdice]

Ah, I see. Thanks @thomastaylor312. Path forward sgtm.

[vdice]

@thomastaylor312 could the login flow w/ basic auth also create a session token with the provided un/pw so that it doesn't need to be passed in on further actions again? a la oidc? Or is this an anti-pattern w/ basic auth?

[thomastaylor312]

I think that could work! You'd store it just like an OIDC token. We should probably capture that in another issue if you want to go that way

[vdice]

Oops, there are actually a few items needed to resolve this issue, as mentioned in https://github.com/deislabs/bindle/issues/302#issuecomment-1030246302