{"action":"created","issue":{"url":"https://api.github.com/repos/saltstack/salt/issues/39551","repository_url":"https://api.github.com/repos/saltstack/salt","labels_url":"https://api.github.com/repos/saltstack/salt/issues/39551/labels{/name}","comments_url":"https://api.github.com/repos/saltstack/salt/issues/39551/comments","events_url":"https://api.github.com/repos/saltstack/salt/issues/39551/events","html_url":"https://github.com/saltstack/salt/issues/39551","id":209367352,"number":39551,"title":"Salt API rest_cherrypy X-Auth-Token header contains wrong value","user":{"login":"MasterNayru","id":245610,"avatar_url":"https://avatars1.githubusercontent.com/u/245610?v=4","gravatar_id":"","url":"https://api.github.com/users/MasterNayru","html_url":"https://github.com/MasterNayru","followers_url":"https://api.github.com/users/MasterNayru/followers","following_url":"https://api.github.com/users/MasterNayru/following{/other_user}","gists_url":"https://api.github.com/users/MasterNayru/gists{/gist_id}","starred_url":"https://api.github.com/users/MasterNayru/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MasterNayru/subscriptions","organizations_url":"https://api.github.com/users/MasterNayru/orgs","repos_url":"https://api.github.com/users/MasterNayru/repos","events_url":"https://api.github.com/users/MasterNayru/events{/privacy}","received_events_url":"https://api.github.com/users/MasterNayru/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2017-02-22T06:48:48Z","updated_at":"2017-09-16T12:57:52Z","closed_at":"2017-02-22T08:38:57Z","author_association":"CONTRIBUTOR","body":"I am trying to set up Salt API using the rest_cherrypy module, and it seems to be working fine, except the value in the `X-Auth-Token` header returned when you hit the `/login` endpoint contains the wrong value, and so then you cannot use this token to authenticate against any of the other endpoints.\r\n\r\n### Setup\r\n```\r\n$ cat /etc/salt/master.d/api.conf\r\nrest_cherrypy:\r\n  port: 8000\r\n  disable_ssl: true\r\n\r\nexternal_auth:\r\n  pam:\r\n    jmoore:\r\n      - 'test.ping'\r\n```\r\n\r\n### Steps to Reproduce Issue\r\n```\r\n$  curl -sS http://localhost:8000/login -H 'Accept: application/x-yaml' -d username=jmoore -d password=something -d eauth=pam\r\nreturn:\r\n- eauth: pam\r\n  expire: 1487788791.948098\r\n  perms:\r\n  - test.ping\r\n  start: 1487745591.948097\r\n  token: d59c1f9bea746d6e711a5ea2910ca234ffcc8a01\r\n  user: jmoore\r\n\r\n$ curl -sS http://localhost:8000/run -H \"Content-type: application/json\" -H 'Accept: application/json' -d '[{\"client\": \"local\", \"tgt\": \"*\", \"fun\": \"test.ping\", \"token\": \"d59c1f9bea746d6e711a5ea2910ca234ffcc8a01\"}]'\r\n<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\"\r\n\"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd\">\r\n<html>\r\n<head>\r\n    <meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\"></meta>\r\n    <title>401 Unauthorized</title>\r\n    <style type=\"text/css\">\r\n    #powered_by {\r\n        margin-top: 20px;\r\n        border-top: 2px solid black;\r\n        font-style: italic;\r\n    }\r\n\r\n    #traceback {\r\n        color: red;\r\n    }\r\n    </style>\r\n</head>\r\n    <body>\r\n        <h2>401 Unauthorized</h2>\r\n        <p>No permission -- see authorization schemes</p>\r\n        <pre id=\"traceback\"></pre>\r\n    <div id=\"powered_by\">\r\n    <span>Powered by <a href=\"http://www.cherrypy.org\">CherryPy 3.2.2</a></span>\r\n    </div>\r\n    </body>\r\n</html>\r\n```\r\n\r\nThe length of the token returned seemed much shorter than the expected token length if a token was created with the `salt` command directly, so I made this change:\r\n\r\n```\r\n$ git diff /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.py app.py.modified\r\ndiff --git a/usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.py b/app.py.modified\r\nindex 1098c24..01bbfc4 100644\r\n--- a/usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.py\r\n+++ b/app.py.modified\r\n@@ -1678,7 +1678,7 @@ class Login(LowDataAdapter):\r\n             raise cherrypy.HTTPError(401,\r\n                     'Could not authenticate using provided credentials')\r\n\r\n-        cherrypy.response.headers['X-Auth-Token'] = cherrypy.session.id\r\n+        cherrypy.response.headers['X-Auth-Token'] = token['token']\r\n         cherrypy.session['token'] = token['token']\r\n         cherrypy.session['timeout'] = (token['expire'] - token['start']) / 60\r\n         cherrypy.session['user'] = token['name']\r\n@@ -1709,7 +1709,7 @@ class Login(LowDataAdapter):\r\n             perms = None\r\n\r\n         return {'return': [{\r\n-            'token': cherrypy.session.id,\r\n+            'token': token['token'],\r\n             'expire': token['expire'],\r\n             'start': token['start'],\r\n             'user': token['name'],\r\n```\r\n\r\nthen the token returned is correct:\r\n\r\n```\r\ncurl -sS http://localhost:8000/login -H 'Accept: application/x-yaml' -d username=jmoore -d password=something -d eauth=pam\r\nreturn:\r\n- eauth: pam\r\n  expire: 1487788303.17605\r\n  perms:\r\n  - test.ping\r\n  start: 1487745103.176049\r\n  token: 2edd374638af684090a0c740616684a35bfbeda47e3dc0dcf4c24c02bd63bc39\r\n  user: jmoore\r\n\r\n$ curl -sS http://localhost:8000/run -H \"Content-type: application/json\" -H 'Accept: application/json' -d '[{\"client\": \"local\", \"tgt\": \"*\", \"fun\": \"test.ping\", \"token\": \"2edd374638af684090a0c740616684a35bfbeda47e3dc0dcf4c24c02bd63bc39\"}]'\r\n{\"return\": [{\"host1.localdomain\": true}]}\r\n```\r\n\r\n### Versions Report\r\n(Provided by running `salt --versions-report`. Please also mention any differences in master/minion versions.)\r\n```\r\n$ salt --versions-report\r\nSalt Version:\r\n           Salt: 2016.11.1\r\n\r\nDependency Versions:\r\n           cffi: 1.9.1\r\n       cherrypy: 3.2.2\r\n       dateutil: 2.6.0\r\n          gitdb: Not Installed\r\n      gitpython: Not Installed\r\n          ioflo: Not Installed\r\n         Jinja2: 2.7.2\r\n        libgit2: Not Installed\r\n        libnacl: Not Installed\r\n       M2Crypto: Not Installed\r\n           Mako: 1.0.6\r\n   msgpack-pure: Not Installed\r\n msgpack-python: 0.4.8\r\n   mysql-python: Not Installed\r\n      pycparser: 2.17\r\n       pycrypto: 2.6.1\r\n         pygit2: Not Installed\r\n         Python: 2.7.5 (default, Nov  6 2016, 00:28:07)\r\n   python-gnupg: Not Installed\r\n         PyYAML: 3.11\r\n          PyZMQ: 15.3.0\r\n           RAET: Not Installed\r\n          smmap: Not Installed\r\n        timelib: Not Installed\r\n        Tornado: 4.2.1\r\n            ZMQ: 4.1.4\r\n\r\nSystem Versions:\r\n           dist: centos 7.3.1611 Core\r\n        machine: x86_64\r\n        release: 3.10.0-514.6.1.el7.x86_64\r\n         system: Linux\r\n        version: CentOS Linux 7.3.1611 Core\r\n```"},"comment":{"url":"https://api.github.com/repos/saltstack/salt/issues/comments/329966966","html_url":"https://github.com/saltstack/salt/issues/39551#issuecomment-329966966","issue_url":"https://api.github.com/repos/saltstack/salt/issues/39551","id":329966966,"user":{"login":"basdusee","id":17906697,"avatar_url":"https://avatars3.githubusercontent.com/u/17906697?v=4","gravatar_id":"","url":"https://api.github.com/users/basdusee","html_url":"https://github.com/basdusee","followers_url":"https://api.github.com/users/basdusee/followers","following_url":"https://api.github.com/users/basdusee/following{/other_user}","gists_url":"https://api.github.com/users/basdusee/gists{/gist_id}","starred_url":"https://api.github.com/users/basdusee/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/basdusee/subscriptions","organizations_url":"https://api.github.com/users/basdusee/orgs","repos_url":"https://api.github.com/users/basdusee/repos","events_url":"https://api.github.com/users/basdusee/events{/privacy}","received_events_url":"https://api.github.com/users/basdusee/received_events","type":"User","site_admin":false},"created_at":"2017-09-16T12:57:52Z","updated_at":"2017-09-16T12:57:52Z","author_association":"NONE","body":"If you somehow use a proxy which breaks persistent sessions, your salt api authentication will break too.\r\n\r\nWe tried a fancy set-up with nginx + uwsgi to run salt-api, because we wanted to offload SSL from Cherrypy, and because uwsgi just seems cool, using nginx's \"uwsgi_pass\" to a unix socket running uwsgi.\r\nReally fancy, but it totally broke, because the wsgi protocol doesn't understand the concept of persistent http sessions (mailnly, because it isn't http). So every request just got a new session_id, without the stored salt token.\r\n\r\nWe're now running nginx ssl with a proxy_pass to 127.0.0.1:8000 running salt-api cherrypy with disabled ssl, which really runs solid.\r\n\r\nI just want to share this for people googling and trying to find solutions of running salt-api behind an nginx proxy. \r\n\r\npart of /etc/salt/master:\r\n`external_auth:\r\n  pam:\r\n    linux_adm%:\r\n      - 'test.ping'\r\n\r\nrest_cherrypy:\r\n  host: 127.0.0.1\r\n  port: 8000\r\n  disable_ssl: True\r\n`\r\nthe nginx.conf:\r\n`server {\r\n    listen external.domain.com:8000 ssl;\r\n\r\n    server_name external.domain.com;\r\n    charset utf-8;\r\n\r\n    ssl_certificate     /etc/ssl/cert.pem;\r\n    ssl_certificate_key /etc/ssl/cert.key;\r\n    ssl_protocols TLSv1.2 TLSv1.1 TLSv1;\r\n    ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';\r\n    ssl_prefer_server_ciphers on;\r\n    ssl_session_cache shared:SSL:10m;\r\n\r\n    location / {\r\n        proxy_pass         http://127.0.0.1:8000;\r\n        proxy_redirect     off;\r\n        proxy_set_header   Host $host;\r\n        proxy_set_header   X-Real-IP $remote_addr;\r\n        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;\r\n        proxy_set_header   X-Forwarded-Host $server_name;\r\n    }\r\n}\r\n`"}}
{"actor":{"display_login":"basdusee"}}