Uploaded image for project: 'Couchbase Server'
  1. Couchbase Server
  2. MB-25263

Admin user created via pam authentication not able to query password protected bucket

    XMLWordPrintable

Details

    • Bug
    • Resolution: Fixed
    • Critical
    • 4.6.3
    • 4.6.3
    • query
    • None
    • 4.6.3-4055
    • Untriaged
    • Yes

    Description

      1. create a password protected bucket test with some password.
      2. Query using curl command with user Administrator and password as password as:
      This behavior is correct:
      [root@localhost bin]# curl --user "Administrator" -H'Content-Type:application/json' http://127.0.0.1:8093/query/service -d '

      {"statement":"select * from test limit 1"}

      '
      Enter host password for user 'Administrator':
      {
      "requestID": "0656f67a-d405-45da-8e89-ea8d4a731c85",
      "signature":

      { "*": "*" }

      ,
      "results": [
      {
      "test":

      { "click": "to edit", "with JSON": "there are no reserved field names" }

      }
      ],
      "status": "success",
      "metrics":

      { "elapsedTime": "16.947363ms", "executionTime": "16.858628ms", "resultCount": 1, "resultSize": 148 }

      }

      3. make sure you enable pam on this system using:
      https://developer.couchbase.com/documentation/server/current/security/security-pam-auth.html

      4. create a user in UI with admin username and role as admin.
      5. Give a password to this user through useradd and passwd commands.

       
      [root@localhost bin]# useradd admin
      [root@localhost bin]# passwd admin
      Changing password for user admin2.
      New password: 
      BAD PASSWORD: The password fails the dictionary check - it is based on a dictionary word
      Retype new password: 
      [root@localhost bin]# passwd admin2
      Changing password for user admin2.
      New password: 
      BAD PASSWORD: The password fails the dictionary check - it is based on a dictionary word
      Retype new password: 
      passwd: all authentication tokens updated successfully.
      

      6. Try issuing the same query with admin username:

      [root@localhost bin]# curl --user "admin2" -H'Content-Type:application/json' http://127.0.0.1:8093/query/service -d '

      {"statement":"select * from test limit 1"}

      '
      Enter host password for user 'admin2':
      {
      "requestID": "4f4b3e2d-c257-44e2-8dec-311c74f44fd0",
      "signature":

      { "*": "*" }

      ,
      "results": [
      ],
      "errors": [

      { "code": 10000, "msg": "Authorization Failed Keyspace test - cause: Expecting 200 or 401 from ns_server auth endpoint. Got: 500 Internal Server Error" }

      ],
      "status": "stopped",
      "metrics":

      { "elapsedTime": "3.779132ms", "executionTime": "3.65362ms", "resultCount": 0, "resultSize": 0, "errorCount": 1 }

      }

      Attaching logs.

      Attachments

        Issue Links

          No reviews matched the request. Check your Options in the drop-down menu of this sections header.

          Activity

            People

              Prerna.Manaktala Prerna Manaktala (Inactive)
              Prerna.Manaktala Prerna Manaktala (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Gerrit Reviews

                  There are no open Gerrit changes

                  PagerDuty