Cannot login into EdgeX UI using the id_token

[mohammedimrankasab]

Hi Team,

We have installed the EdgeX 3.0 on K3s with Nginx by following the guidelines from here and setting the secure store as true.
By following the steps from above link, we are able to successfully generate the vault and id token and then pass the id token to communicate the internal API's through ingress.

Now on the EdgeX UI part we are unable to login by passing the same id token which got generated earlier.
Node: EdgeX UI and consul are exposed by NodePort.

sample token:
eyJhbGciOiJFUzM4NCIsImtpZCI6IjM3MWIzOTEyLTBkZjAtNThkNC1kOGI0LWIzMjZlMzE0NTkxMiJ9.redacted.mZecQg0el-pbAY88BqUjUvnibDO_vxWWWkzL6Vip9S2zeCYMA84wsJKyOkgRg_7X4MdbItHcq-L36M-XZ0ujW25nelrphJ1kAL__v_eKQdXt-zCrXiRHXr8jMIlwKfWv

decoded token:

{
  "aud": "edgex",
  "exp": 1695223406,
  "iat": 1695216266,
  "iss": "http://edgex-vault:8200/v1/identity/oidc",
  "name": "edgexuser",
  "namespace": "root",
  "sub": "e7335090-c2a1-e28a-c6a0-a94baebd8783"
}

We also tried generating the certificates using our own DNS name and exposing the EdgeX UI on ingress but that didn't work as browser is asking for SSL certificates.

Kindly looking out for an help here on how we can solve this issue of EdgeX UI not accepting the id token

Note: we have used the Minnesota release

[bnevis-i]

Was able to reproduce this. I think the token is fine. It's looking like something in the backend webserver of the UI.

This is showing up in the edgex-ui container log

/(target service)/api/v3/ping
2023/09/20 18:03:53 http: proxy error: context deadline exceeded

[mohammedimrankasab]

@bnevis-i There is one more observation that same thing is happening with Consul. Token generated cannot be used to login Consul.
Neither the vault token nor the Id token is working for Consul

[bnevis-i]

Ok. Consul is a different tool and of course has its own token. I'll dig it out of the edgex-compose scripts and update this discussion with a short command you can use.

[bnevis-i]

This should do the trick:

$  kubectl exec -ti edgex-core-consul-5b5cb7bd85-p26wc -- sh -c 'cat $STAGEGATE_REGISTRY_ACL_MANAGEMENTTOKENPATH | jq -r ".SecretID"'

Replace edgex-core-consul-5b5cb7bd85-p26wc with whatever the edgex-core-consul pod is in your deployment.

[mohammedimrankasab]

Yes, it works. Thank you 😃

[bnevis-i]

edgex-ui is broken in the Helm deployment in secure mode. Non-secure mode seems to be OK.

I have filed an issue with explanation and root cause.

[mohammedimrankasab]

Thanks @bnevis-i for your prompt reply here. Yes, there is no problem with Non-secure mode.

[bnevis-i]

I think it is possible to fix edgex-ui-go. I filed a ticket on that one too: edgexfoundry/edgex-ui-go#635

[mohammedimrankasab]

Wow, that's good.

[bnevis-i]

Note: we have used the Minnesota release

Did this work before on the Helm deployment in secure mode? I am thinking not.

[mohammedimrankasab]

This is the first time we used Helm deployment in the secure mode.

[bnevis-i]

@mohammedimrankasab There are now some PR's in flight to fix this in the 3.1 stabilization release.