opensearch-java icon indicating copy to clipboard operation
opensearch-java copied to clipboard

Published 20 hours ago • verified publisher icon opensearch-project

[BUG] Clear scroll request fails with sigv4 signature mismatch for java client 2.8.0

Open mschmie opened this issue 1 year ago • 4 comments

What is the bug?

clearScroll request to opensearch client fails with sigv4 signing mismatch:

org.opensearch.client.opensearch._types.OpenSearchException: Request failed: [security_exception] The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details.

The Canonical String for this request should have been 'DELETE /_search/scroll

... remaining request info...

How can one reproduce the bug?

How can one reproduce the bug?

Create an OpenSearchClient following instructions from here (https://opensearch.org/docs/2.7/clients/java/#connecting-to-amazon-opensearch-service) and then attempt to use the client's clearScroll API.

I believe this is because it is a DELETE request with a body. The search/scroll method works as intended. Sending the request results in a sigv4 error

What is the expected behavior?

The clearScroll API call does not have a signature mismatch

What is your host/environment?

Ubuntu 22.04 implementation 'org.opensearch.client:opensearch-java:2.8.0'

Do you have any screenshots?

If applicable, add screenshots to help explain your problem.

Do you have any additional context?

Add any other context about the problem.

mschmie avatar Nov 06 '23 10:11 mschmie

Hello,

any updates or hints about this issue ? We have got the same issue when using Opensearch in AWS

Best regards,

houssain-barouni avatar Dec 04 '23 14:12 houssain-barouni

AFAIK nobody is working on this. Want to help?

  1. Double check whether this is/not reproduced with curl against the Amazon managed service and serverless, https://code.dblock.org/2022/07/11/making-sigv4-authenticated-requests-to-managed-opensearch.html can help.
  2. Expand the existing POST tests for Sigv4 to DELETE and let's see if it's as trivial as always signing the body on a DELETE.

dblock avatar Dec 04 '23 14:12 dblock

Is this a dup of https://github.com/opensearch-project/opensearch-java/issues/521? There's a failing integration test in https://github.com/opensearch-project/opensearch-java/issues/712 if you want to fix this and include it.

dblock avatar Dec 04 '23 15:12 dblock

Replacing ApacheHttpClient by NettyNioAsyncHttpClient solves the issue. cf https://github.com/opensearch-project/data-prepper/pull/3338

houssain-barouni avatar Dec 15 '23 13:12 houssain-barouni