How do I configure autentication properly for locally hosted docker container

General Discussions
1

I’ve downloaded the docker container and have it running locally, with Postman I managed to send messages to localhost:9000 just fine as well.

But now, through Access Control I enabled basic authentication with the internal database, created a user in User Mgmt, gave that user a password, but with that user I can’t POST messages, using Postman, like I could before I enabled authentication. What am I missing here?

2

Hi @wraldpyk

What’s the error you’re seeing?

Also, after you enabled basic auth, why don’t you try with the default user first. This is how I do it in my Postman.

image.png
image.png832×320 23.3 KB

And also, creating client users is done by adding “client usernames” via the Access Control menu as well, be careful not to mistake it with the Administrator users management from the bottom of the left menu.

3

With both my new user and the default user I get the following response:

<solace-error-response>
    <code>403</code>
    <reason>
        <![CDATA[Unauthorized]]>
    </reason>
    <detail>
        <![CDATA[
SMF ClientCtrl response error
]]>
    </detail>
    <internal-use>2:13398</internal-use>
</solace-error-response>

I have enabled basic authentication in Postman, while sending a POST.

My curl export from Postman is:

curl --location --request POST 'localhost:9000/amazing/message' \
--header 'Authorization: Basic ZGVmYXVsdDpkZWZhdWx0' \
--header 'Content-Type: text/plain' \
--header 'Cookie: TSID=44606607e086e888' \
--data-raw 'awesome 2'

With auth disabled on the server this same request works (without basic auth obviously)

4

Can you try using --user “user:pass” instead of --header ‘Auth…’

5

This gave me the same error. Maybe my configuration is incorrect?

image.png
image.png1562×532 32.2 KB

6

Can you post a screenshot of your postman? It’s difficult to know if you entered the correct fields with just the base64 value for username:password (blur the password is fine).

Also, can you show your list of Client Usernames from Broker Manager gui?

7

Both are attached below. I gave the user full permission to just try it out.

image.png
image.png1742×570 26 KB

image.png
image.png1738×498 45.1 KB

8

Hmm this looks like admin or management users and not application or client users.

You should use the client usernames menu from Access Control menu on the left for apps user.

Or, just use default:default for testing as the default user has most access open.

9

Ok interesting, I assumed it would take usernames from the User Mgmt (bottom section in the sidebar). I have found the “default” user, but it doesn’t work for me with the API calls that worked before I enabled basic auth.

Also with clients I can’t specify a password, is that correct?

10

Ari is correct. In your screenshot of activating the Internal Database 2 posts ago, notice the “Client Usernames” tab. This is where you would add your user for messaging access and assign a password.

11

Yep that did the trick, I’ve been on different pages. Also, the default user didn’t have password ‘default’, so when I changed it it worked also. Thanks a lot!

12

Glad that helped.

Management users and messaging users are completely separate in PubSub+. This is for security reasons where a management user cannot view potentially sensitive message payloads and messaging users cannot change broker configuration, etc.