Cloudfoundry UAA resource app (/api) access denied when run in different domains

Question

I had no problem running the /uaa with /api and /app all on localhost:8080. Both the authorization code flow and implicit flow works flawlessly.

However, I found running all apps on the same domain hardly realistic so I decided to test them out on different domains. Here's what I did: - Boot /uaa on localhost:8080 - Boot /api on localhost:8181 - Boot /app on localhost:8282 - change all url config to point to the correct address

The authorization flow still worked fine. However, I got a Access Denied leading to a javascript error on the implicit flow.

When the /app tries to contact /api, /api throws this:

------------------------------------------------------------------------------------
DEBUG --- FilterSecurityInterceptor: Secure object: FilterInvocation: URL: /apps; Attributes: [scope=cloud_controller.read]
[2013-11-04 18:26:42.521] samples/api - ???? [http-8181-2] .... DEBUG --- FilterSecurityInterceptor: Previously Authenticated: org.springframework.security.authentication.AnonymousAuthenticationToken@9055c2bc: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: ROLE_ANONYMOUS
[2013-11-04 18:26:42.521] samples/api - ???? [http-8181-2] .... DEBUG --- UnanimousBased: Voter: org.springframework.security.oauth2.provider.vote.ScopeVoter@54b82ec7, returned: 0
[2013-11-04 18:26:42.521] samples/api - ???? [http-8181-2] .... DEBUG --- UnanimousBased: Voter: org.springframework.security.access.vote.AuthenticatedVoter@8073645, returned: 0
[2013-11-04 18:26:42.522] samples/api - ???? [http-8181-2] .... DEBUG --- ExceptionTranslationFilter: Access is denied (user is anonymous); redirecting to authentication entry point
org.springframework.security.access.AccessDeniedException: Access is denied
    at org.springframework.security.access.vote.AbstractAccessDecisionManager.checkAllowIfAllAbstainDecisions(AbstractAccessDecisionManager.java:70)
    at org.springframework.security.access.vote.UnanimousBased.decide(UnanimousBased.java:107)
    at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:206)
    at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:115)
    at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:84)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.cloudfoundry.identity.api.web.ContentTypeFilter.doFilter(ContentTypeFilter.java:64)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:113)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:103)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:113)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:54)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:45)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationProcessingFilter.doFilter(OAuth2AuthenticationProcessingFilter.java:131)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:87)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:192)
    at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:160)
    at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346)
    at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:259)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
    at org.cloudfoundry.identity.api.web.CorsFilter.doFilterInternal(CorsFilter.java:37)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:76)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293)
    at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:859)
    at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:602)
    at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489)
    at java.lang.Thread.run(Thread.java:722)
------------------------------------------------------------------------------------

It seems that /api is not able to retrieve user marissa's identity from authentication context as it only got anonymous user (running all three apps on localhost will have displayed 'retrieved marissa from security http session').

I am wondering what is the correct way to configure UAA and its samples on different domains.

It seems like you're trying to add formatting to your question using the slash '/'. Try clicking on the orange rectangular question mark above the edit window for help with formatting. Other than that, is there any way to make your debug dump more concise? I don't imagine many people will want to read all of that. — Scott Solmer, Nov 05 '13 at 01:50

Dave Syer · Accepted Answer · 2013-11-06T11:00:52.963

1

Looks like cross-site request protection from your browser? With modern browsers you can add CORS headers, for example using a filter (Tomcat ships with one built in - you just have to enable it with the right hostnames and paths). The demo apps do attempt to work around that, but there was a bug in the CorsFilter. Fixed in this commit.

edited Nov 06 '13 at 11:00

answered Nov 05 '13 at 13:52

Dave Syer

56,583
10
155
143

I see a CORS filter in /api app, which sets the Access-Control-Allow-Origin header to * and filters all incoming request. Is that what you are talking about? – davidiamyou Nov 06 '13 at 00:45
Sorry, I missed the `CorsFilter` in the stack trace. So not that. It looks to me like the client didn't send an access token at all. If it's a problem in the JavaScript it might be in the library. I'll see if I can reproduce. – Dave Syer Nov 06 '13 at 09:58
I get it and it is CORS related. CORS clients need to be able to send OPTIONS requests to find out if they can follow up with a GET (etc.), and the /app sample does not handle OPTIONS explicitly, so it just redirects to the UAA login. Anwswer amended. – Dave Syer Nov 06 '13 at 10:59
Thanks for the answer Dave! So if I understand it correctly, I would need to find a way to change the jso request method to OPTIONS or just experimentally commend out the part in CORS filter where checks for request method == OPTIONS? – davidiamyou Nov 06 '13 at 15:09
No, I think CORS clients *need* to send OPTIONS. You need to make sure the server responds (by patching with that commit I linked to, or using a fresh build from the "develop" branch). – Dave Syer Nov 07 '13 at 08:05
Hi Dave, I checked out the dev branch and it works fine now. Just one more question, not sure if it's a bug or not. When I access localhost:8080/uaa/approvals as a logged in user, I always get a Access Denied exception. Not sure if it happens on your end? – davidiamyou Nov 10 '13 at 16:45
I don't think there is a UI at that endpoint, just a JSON endpoint (protected with OAuth2 [here](https://github.com/cloudfoundry/uaa/blob/6d214c2728e076523419e3fb0c20c8395485cb03/uaa/src/main/webapp/WEB-INF/spring/approvals-endpoints.xml#L45)). – Dave Syer Nov 12 '13 at 14:13

Cloudfoundry UAA resource app (/api) access denied when run in different domains

1 Answers1