Migrate lua-resty-session to 4.0.3 [tested, works] #489

oldium · 2023-08-11T21:41:57Z

Complete rework of #478, all issues of #478 should be addressed. Uses session:set and session:get to manipulate the session variables.

Tested by unit tests and on real-world project.

lordgreg · 2023-10-09T12:44:38Z

Hi. Will this get merged? @bodewig

ja-softdevel · 2023-10-12T12:28:26Z

@bodewig
Hello, is there an ETA on this merge?
It seems this is causing issues downstream with kong oidc.

oldium · 2023-10-12T12:51:42Z

Adding a cute kitten usually helps speed things up 😅

ja-softdevel · 2023-10-13T14:18:57Z

@oldium Hello, I git cloned your branch and built it in a Dockerfile along with kong-oidc. I was hoping your changes would resolve the error I keep getting.

using Docker:
Kong Gateway (OSS)
service: https://cat-fact.herokuapp.com/facts
route: /cats
plugin: kong-oidc
Keycloak for auth

The route is set to redirect to Keycloak for testing auth. But I get the following error in the Kong logs when Keycloak redirects back to the route.

[error] 1264#0: *2785 [lua] openidc.lua:1484: authenticate(): request to the redirect_uri path but there's no session state found, client: 172.25.17.1, server: kong, request: "GET /cats?state=41b59f8cd04f7404a603ba9908d18930&session_state=ba1bf1a8-cf0f-4563-8028-fcf3ddd9e0b1&code=16da05eb-78ea-4323-a742-bdbf2b8362c1.ba1bf1a8-cf0f-4563-8028-fcf3ddd9e0b1.9406568b-bc51-4841-a8ae-99a3fdb381c2 HTTP/1.1", host: "localhost"

What am I missing? The session_state object is clearly there.

Thanks.

lordgreg · 2023-10-13T14:20:38Z

@ja-softdevel - can you list which luarocks plugins you have installed?

usually, its lua-resty-session, which appears twice and causes the exact problem you are having.

ja-softdevel · 2023-10-13T15:22:39Z

@ja-softdevel - can you list which luarocks plugins you have installed?

usually, its lua-resty-session, which appears twice and causes the exact problem you are having.

FYI: I haven't had much experience with lua. C++, Python but not lua. So still figuring out how it does things.

Looks like lua-resty-session is appearing twice and lua-resty-openidc in the list:

$ luarocks list resty
Rocks installed for Lua 5.1
---------------------------
lua-resty-acme
   0.11.0-1 (installed) - /usr/local/lib/luarocks/rocks-5.1
lua-resty-counter
   0.2.1-1 (installed) - /usr/local/lib/luarocks/rocks-5.1
lua-resty-healthcheck
   1.6.2-1 (installed) - /usr/local/lib/luarocks/rocks-5.1
lua-resty-http
   0.17.1-0 (installed) - /usr/local/lib/luarocks/rocks-5.1
lua-resty-ipmatcher
   0.6.1-0 (installed) - /usr/local/lib/luarocks/rocks-5.1
lua-resty-jit-uuid
   0.0.7-2 (installed) - /usr/local/lib/luarocks/rocks-5.1
lua-resty-jwt
   0.2.3-0 (installed) - /usr/local/lib/luarocks/rocks-5.1
lua-resty-openidc
   1.7.6-3 (installed) - /usr/local/lib/luarocks/rocks-5.1
   1.6.0-1 (installed) - /usr/local/lib/luarocks/rocks-5.1
lua-resty-openssl
   0.8.23-1 (installed) - /usr/local/lib/luarocks/rocks-5.1
lua-resty-session
   4.0.4-1 (installed) - /usr/local/lib/luarocks/rocks-5.1
   3.10-1 (installed) - /usr/local/lib/luarocks/rocks-5.1
lua-resty-timer
   1.1.0-1 (installed) - /usr/local/lib/luarocks/rocks-5.1
lua-resty-timer-ng
   0.2.5-1 (installed) - /usr/local/lib/luarocks/rocks-5.1

In the Dockerfile, I'm installing 3 lua packages.:

git clone --branch resty-session-4.x https://github.com/oldium/lua-resty-openidc.git
git clone --branch v1.4.0-1 https://github.com/revomatico/kong-oidc.git
git clone --branch v1.1.0 https://github.com/dkoltsuk/kong-plugin-jwt-keycloak.git

Should I first uninstall lua-resty-openidc and lua-resty-session packages before doing the git clones?
Thanks.

lordgreg · 2023-10-13T15:35:21Z

How did you install the plugins? You've added the git clone commands, but do you made any luarocks make *.spec?

Anyways,

luarocks uninstall lua-resty-session 4.0.4-1 --force will fix your issue. The 3.10.1 gets installed using kong-oidc > lua-resty-openidc > lua-resty-session dependency hell :)

Which is why we are talking merging this PR into the master. :)

oldium · 2023-10-13T15:51:58Z

Newest Kong GW images use lua-resty-session 4, so I think that would not work. I guess you have this for Kong GW, right?

ja-softdevel · 2023-10-13T17:19:07Z

Alrighty!

So I added this line to the Dockerfile just after my apt updates but before doing the git clones which removed 4.0.4-1.

RUN luarocks remove lua-resty-session --force

After I clone @oldium 's fork and set to the resty-session-4.x branch, that repo will cause lua-resty-session 4.0.5-1 to get installed.

Then starting docker-compose and letting decK complete, I added the kong-oidc plugin to the (oh so lovely) '/cats' route. Only items set on the plugin were:
client id, client secret, discovery uri, and I changed the realm to match the one I set in keycloak.

I have deleted the image and rebuilt it. Then ran docker up/down to ensure this worked.

Thank you so much @lordgreg and @oldium for the assistance. Hopefully, @bodewig can get this merged and maybe add you two as maintainers to help prevent development stall out.

Dark3clipse · 2023-11-12T02:19:20Z

I've tested it and it seems to works for me too.

zaygraveyard · 2023-12-06T16:54:55Z

I get the following error when trying to logout a user that happens to not be logged-in, which used to work:

lua entry thread aborted: runtime error: /.../lualib/resty/session.lua:2077: unable to destroy nonexistent or closed session
stack traceback:
coroutine 0:
	[C]: in function 'assert'
	/.../lualib/resty/session.lua:2077: in function 'destroy'
	/.../lualib/resty/openidc.lua:1298: in function 'openidc_logout'
	/.../lualib/resty/openidc.lua:1508: in function 'authenticate'

Replacing

lua-resty-openidc/lib/resty/openidc.lua

Line 1287 in 734a3f4

session:destroy()

with the following fixes the issue:

  if next(session:get_data()) ~= nil then
    session:destroy()
  end

oldium · 2023-12-11T15:39:20Z

Thanks, I will check it

giafar · 2023-12-27T16:28:26Z

Hi. Will this get merged? @bodewig

bodewig · 2023-12-27T17:50:17Z

So people don't need to keep asking: I can not foresee when (or even if) I will find to properly review this or #478 myself.

It is my impression that lua-resty-session has also changed semantics so changing the code in way that Lua is happy will not be enough. Reports by people who have tried the patches in both PRs confirm this is not a simple "apply and all is well" fix. I do not have the cycles to understand what has changed between 3.x and 4.x over in lua-resty-session. lua-resty-openidc lacks any tests that would make use of sessions and personally I don't run any environment using lua-resty-openidc at all right now so wouldn't be able to properly test things myself.

Signed-off-by: Oldřich Jedlička <[email protected]>

oldium · 2023-12-28T22:45:32Z

I get the following error when trying to logout a user that happens to not be logged-in, which used to work:
lua entry thread aborted: runtime error: /.../lualib/resty/session.lua:2077: unable to destroy nonexistent or closed session
stack traceback:
coroutine 0:
	[C]: in function 'assert'
	/.../lualib/resty/session.lua:2077: in function 'destroy'
	/.../lualib/resty/openidc.lua:1298: in function 'openidc_logout'
	/.../lualib/resty/openidc.lua:1508: in function 'authenticate'
Replacing

lua-resty-openidc/lib/resty/openidc.lua

Line 1287 in 734a3f4

session:destroy()

with the following fixes the issue:
  if next(session:get_data()) ~= nil then
    session:destroy()
  end

I checked it and it seems this is a problem of lua-resty-session, so I reported a bug there. I also added the suggested workaround to lua-resty-openidc and a test case until this is fixed.

Signed-off-by: Oldřich Jedlička <[email protected]>

Bug in lua-resty-session does not permit calling session:destroy() on freshly started session with unset "audience" feature, so check for empty session before trying to destroy it. Signed-off-by: Oldřich Jedlička <[email protected]>

Address range 192.0.2.0/24 is reserved for documentation according to RFC 5737. The recommendation is to reject routing of this address range on routers, but as this is not mandatory, it might happen that the address is really routed. The tests on Docker on Windows fail because of this it, the fail reason is different to the expected one. Fix this by configuring Nginx to listen on 127.0.0.1:80 (and not 0.0.0.0:80) and connecting to 127.1.2.3 instead of 192.0.2.1. Signed-off-by: Oldřich Jedlička <[email protected]>

oldium · 2023-12-28T23:00:58Z

I have renamed the Pull Request to indicate this is more up-to-date than the second (unmaintained) one.

Anyway, enjoy 🚀😁

oldium · 2023-12-28T23:09:14Z

Just for info: We are using the code from this Pull Request in our project in Dockerfile in the following way:

ARG KONG_GW_FLAVOR="kong/kong-gateway"
ARG KONG_GW_VERSION="3.4.3.2-ubuntu"

FROM docker.io/${KONG_GW_FLAVOR}:${KONG_GW_VERSION}
...
# Download with https://codeload.github.com/zmartzone/lua-resty-openidc/legacy.tar.gz/pull/489/head
# See https://github.com/zmartzone/lua-resty-openidc/pull/489
ADD zmartzone-lua-resty-openidc-v1.7.6-21-g1553a39.tar.gz /install

RUN ls -l /install; cd /install/zmartzone-lua-resty-openidc-1553a39 \
    && find -name *.rockspec -exec luarocks make {} \;
...

oldium · 2023-12-29T21:43:26Z

It looks like the tests fail randomly - ~~may be because of timing of flushing the nginx logs to disk?~~ EDIT: This was caused by non-padded Base64 decoding

The mime module expects padded Base64 value, so add missing padding. Signed-off-by: Oldřich Jedlička <[email protected]>

oldium · 2023-12-29T23:13:07Z

Fixed decoding of Base64Url in tests (old issue), so they should pass now.

oldium · 2024-01-23T12:40:05Z

I have to say that ChatGPT recommended the Base64 fix and it really worked...

lordgreg · 2024-01-23T17:13:41Z

I will also test this out tomorrow. Thank you @oldium ;)

lukeyeager · 2024-02-23T22:11:49Z

Tested working for me

oldium mentioned this pull request Aug 11, 2023

Migrate lua-resty-session to 4.0.3 #478

Open

mgaeini approved these changes Sep 20, 2023

View reviewed changes

zandbelt assigned bodewig Sep 20, 2023

mrcjkb mentioned this pull request Dec 7, 2023

bump luarocks packages NixOS/nixpkgs#272647

Merged

13 tasks

sockejr mentioned this pull request Dec 14, 2023

guesstimate for release of lua-resty-session 4.0.3 #503

Open

bodewig removed their assignment Dec 27, 2023

Migrate lua-resty-session to 4.0.3

53299ec

Signed-off-by: Oldřich Jedlička <[email protected]>

oldium force-pushed the resty-session-4.x branch 2 times, most recently from 6250ab9 to 95d6fae Compare December 28, 2023 22:43

oldium added 3 commits December 28, 2023 23:56

Allow changing of query parameters in on_created call

bf5809b

Signed-off-by: Oldřich Jedlička <[email protected]>

Fix logout with no session

43b7de7

Bug in lua-resty-session does not permit calling session:destroy() on freshly started session with unset "audience" feature, so check for empty session before trying to destroy it. Signed-off-by: Oldřich Jedlička <[email protected]>

oldium force-pushed the resty-session-4.x branch from 95d6fae to 1553a39 Compare December 28, 2023 22:56

oldium changed the title ~~Migrate lua-resty-session to 4.0.3~~ Migrate lua-resty-session to 4.0.3 [tested, works] Dec 28, 2023

Fix Base64Url decoding of JWT in tests

a83609b

The mime module expects padded Base64 value, so add missing padding. Signed-off-by: Oldřich Jedlička <[email protected]>

oldium mentioned this pull request Apr 3, 2024

New session cannot be destroyed bungle/lua-resty-session#175

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Migrate lua-resty-session to 4.0.3 [tested, works] #489

Migrate lua-resty-session to 4.0.3 [tested, works] #489

oldium commented Aug 11, 2023

lordgreg commented Oct 9, 2023

ja-softdevel commented Oct 12, 2023

oldium commented Oct 12, 2023

ja-softdevel commented Oct 13, 2023

lordgreg commented Oct 13, 2023

ja-softdevel commented Oct 13, 2023

lordgreg commented Oct 13, 2023

oldium commented Oct 13, 2023

ja-softdevel commented Oct 13, 2023

Dark3clipse commented Nov 12, 2023

zaygraveyard commented Dec 6, 2023

oldium commented Dec 11, 2023

giafar commented Dec 27, 2023

bodewig commented Dec 27, 2023

oldium commented Dec 28, 2023 •

edited

oldium commented Dec 28, 2023

oldium commented Dec 28, 2023 •

edited

oldium commented Dec 29, 2023 •

edited

oldium commented Dec 29, 2023

oldium commented Jan 23, 2024

lordgreg commented Jan 23, 2024

lukeyeager commented Feb 23, 2024

Migrate lua-resty-session to 4.0.3 [tested, works] #489

Are you sure you want to change the base?

Migrate lua-resty-session to 4.0.3 [tested, works] #489

Conversation

oldium commented Aug 11, 2023

lordgreg commented Oct 9, 2023

ja-softdevel commented Oct 12, 2023

oldium commented Oct 12, 2023

ja-softdevel commented Oct 13, 2023

lordgreg commented Oct 13, 2023

ja-softdevel commented Oct 13, 2023

lordgreg commented Oct 13, 2023

oldium commented Oct 13, 2023

ja-softdevel commented Oct 13, 2023

Dark3clipse commented Nov 12, 2023

zaygraveyard commented Dec 6, 2023

oldium commented Dec 11, 2023

giafar commented Dec 27, 2023

bodewig commented Dec 27, 2023

oldium commented Dec 28, 2023 • edited

oldium commented Dec 28, 2023

oldium commented Dec 28, 2023 • edited

oldium commented Dec 29, 2023 • edited

oldium commented Dec 29, 2023

oldium commented Jan 23, 2024

lordgreg commented Jan 23, 2024

lukeyeager commented Feb 23, 2024

oldium commented Dec 28, 2023 •

edited

oldium commented Dec 28, 2023 •

edited

oldium commented Dec 29, 2023 •

edited