Unable to authenticate the client connection using on_client_authenticate from plugin_template

[venkatac-ayla]

We have a custom auth plugin created using plugin_template and it was working fine with emqx version 4.0.7. Here is the code

on_client_auth(#{clientid := Dsn,
                 password := Proof,
                 peerhost := Peerhost,
                 username := <<"V1/PROOF", ParamStr/binary>> }, AuthResult, Endpoint) ->
    Params = cow_qs:parse_qs(string:trim(ParamStr, leading, "?")),

    {_, StartSec, StartMSec} = os:timestamp(),
    ?SLOG(debug, #{msg => "start to call auth proof api, time", dsn => Dsn, start_sec => StartSec, start_msec => StartMSec, peer_host => Peerhost}),

    Result = case test_http:request(post, Endpoint ++ ?AUTH_PROOF_PATH,
                                    [{ dsn, Dsn }, {ipAddress, inet:ntoa(Peerhost)},
                                     { proof, Proof }] ++ Params,
                                    [], []) of
                 {ok, 200, Body} -> ets:insert(test_dsns, [{Dsn, Body}]), success;
                 {error, Error} -> Error;
                 Others -> {auth_failed, Others}
             end,

    {_, EndSec, EndMSec} = os:timestamp(),
    ?SLOG(debug, #{msg => "finish auth proof api call, time", dsn => Dsn, end_sec => EndSec, end_msec => EndMSec, diff_time => EndSec - StartSec}),

    { stop, AuthResult#{ auth_result => Result } };

We have updated the code to run on EMQX 5.6.0 and here is the code and after that we always get badmatch error

on_client_auth(#{clientid := Dsn,
                 password := Proof,
                 peerhost := Peerhost,
                 username := <<"V1/PROOF", ParamStr/binary>> }, Result, Endpoint) ->
    Params = cow_qs:parse_qs(string:trim(ParamStr, leading, "?")),

    {_, StartSec, StartMSec} = os:timestamp(),
    ?SLOG(debug, #{msg => "start to call auth proof api, time", dsn => Dsn, start_sec => StartSec, start_msec => StartMSec, peer_host => Peerhost}),

    Result = case test_http:request(post, Endpoint ++ ?AUTH_PROOF_PATH,
                                    [{ dsn, Dsn }, {ipAddress, inet:ntoa(Peerhost)},
                                     { proof, Proof }] ++ Params,
                                    [], []) of
       {ok, 200, Body} -> ets:insert(test_dsns, [{Dsn, Body}]), ok;
       {error, Error} -> Error;
       Others -> {auth_failed, Others}
    end,

    {_, EndSec, EndMSec} = os:timestamp(),
    ?SLOG(debug, #{msg => "finish auth proof api call, time", dsn => Dsn, end_sec => EndSec, end_msec => EndMSec, diff_time => EndSec - StartSec}),
    {stop, #{auth_result => Result}};

The issue its reporting is with this line - {ok, 200, Body} -> ets:insert(test_dsns, [{Dsn, Body}]), ok;
At the end instead of ok tried returning {ok, true}/ {ok,ok}/{ok, Body}/success. For everything it says bad match. Here is the stack trace.

2024-05-03T05:59:52.601809+00:00 [debug] clientid: W029118485, msg: test_http::response info-1, peername: 49.249.189.54:52242, username: V1/PROOF, body: {"req_id":28150674,"status":200,"header":{"x-auth-key":"p2LkN5ZVZnQyN6yGm1NxIZDr5v6nfTBmN/QT","Date":"Fri, 03 May 2024 05:59:52 GMT","Content-Type":"application/json; charset=utf-8"},"payload":{"device":{"product_name":"camera_mini_12s-A5","model":"AY001MRT1","api_major":0,"api_minor":0,"sw_version":"unknown","lan_ip":null,"regtoken":"00bcaa","ans_cipher_key":"hDPejqYhHX1QMaYZJOi6Hdbg==","ans_server":"ans.dev.com","setup_token":null,"oem":null,"oem_model":null,"registration_type":"AP-Mode","ssid":null,"key":16065892,"unix_time":1714715992,"log_server":{"host":"log.default.svc.cluster.local","uri":"/api/v1/device/logs","protocol":"http"},"lan_enabled":true,"local_access_enabled":true,"registered":1,"device_type":"Wifi","setup_location":"","mac":null,"imei":null,"dom_at":null,"manuf_sn":null,"manuf_model":null,"activated_at":"2023-11-24T07:46:06Z","template_version":"demo_dp 1.7","transport_type":"mqtt","message_version":1}}}, code: 200, headers: [{"connection","keep-alive"},{"date","Fri, 03 May 2024 05:59:52 GMT"},{"content-length","1016"},{"content-type","application/json;charset=utf-8"},{"x-request-id","7b5d66c0da40002d88981d55eb2cae1e"},{"authorization","HMAC-SHA256 Credential=dncService/s2s/v1, SignedHeaders=x-origin-host;x-sso-date, Signature=565e8c4385d582595ca73709e4f10f56fc07fffc295cc45542cf5b1890d7aa01"},{"x-sso-date","24240503T055952Z"},{"x-origin-host","dnc.dev.com"},{"x-auth-key","p2LkN5ZVZnQyN6yGm1NxIZDr5v6nfTBmN/QT"},{"access-control-allow-origin","*"},{"access-control-allow-credentials","true"},{"access-control-allow-methods","GET,PUT,POST,DELETE,PATCH,OPTIONS"},{"access-control-allow-headers","accept,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization,x-csrf-token,Content-Disposition,X-Pingother"},{"access-control-max-age","1728000"}], method: POST, url: http://dnc.dev.com/dnc/internal/v1/auth/proof
2024-05-03T05:59:52.602792+00:00 [error] clientid: W029118485, msg: failed_to_execute, peername: 49.249.189.54:52242, username: V1/PROOF, exception: error, failed_call: {test_auth,on_client_auth,[#{clientid => <<"AC000W029118485">>,enable_authn => true,is_bridge => false,is_superuser => false,listener => 'tcp:default',mountpoint => undefined,password => <<"IIecUBerv14wbZRMZ/08tTX==">>,peerhost => {49,249,189,54},peerport => 52242,protocol => mqtt,sockport => 1883,username => <<"V1/PROOF">>,zone => default},ignore,"http://dnc.dev.com"]}, reason: {badmatch,ok}, stacktrace: [{test_auth,on_client_auth,3,[{file,"/test_auth/src/test_auth.erl"},{line,94}]},{emqx_hooks,safe_execute,2,[{file,"emqx_hooks.erl"},{line,205}]},{emqx_hooks,do_run_fold,3,[{file,"emqx_hooks.erl"},{line,185}]},{emqx_access_control,authenticate,1,[{file,"emqx_access_control.erl"},{line,224}]},{emqx_channel,do_authenticate,2,[{file,"emqx_channel.erl"},{line,1716}]},{emqx_channel,handle_in,2,[{file,"emqx_channel.erl"},{line,351}]},{emqx_connection,with_channel,3,[{file,"emqx_connection.erl"},{line,846}]},{emqx_connection,process_msg,2,[{file,"emqx_connection.erl"},{line,495}]},{emqx_connection,process_msg,2,[{file,"emqx_connection.erl"},{line,501}]},{emqx_connection,handle_recv,3,[{file,"emqx_connection.erl"},{line,457}]},{proc_lib,wake_up,3,[{file,"proc_lib.erl"},{line,250}]}]

The test_http:request method returns {0k, 200, Body} on success.

Any thoughts on what should be returned once it evaluates {0k, 200, Body} in case statement. Am I missing something here?

[ieQu1]

Hello,

From the information provided, it looks like the incorrect return value originates in test_http module. This module is not part of EMQX, so we can't troubleshoot it.

As a side note, this authN hook looks like a generic HTTP authentication plugin. Can builtin auth plugin do the same job?

[venkatac-ayla]

Here is the code for test_http response code. The test_hmac:authenticate is returning true. Do you mean to say {ok, Code, Body} return value is in-correct

reply({ok, {{_, Code, _}, Headers, Body}}, Method, URL) -> ?SLOG(debug, #{msg => "test_http::response info", code => Code, headers => Headers, body => Body, method => Method, url => URL}), case test_hmac:authenticate(Headers, Method, URL) of true -> ?SLOG(debug, #{msg => "test_http::response info-1", code => Code, headers => Headers, body => Body, method => Method, url => URL}), {ok, Code, Body}; false -> {error, hmac_failed} end;

[thalesmg]

Hi. The error from your logs is {badmatch, ok}.

If you check your sample code, Result is already bound as an argument to on_client_auth/3:

on_client_auth(_, Result, Endpoint) ->

... and later you attempt to use the same variable to assign the result of test_http:request processing:

    Result = case test_http:request(post, Endpoint ++ ?AUTH_PROOF_PATH,

Since the result of case is ok and not the original Result, it fails. Try to use a fresh variable name.

[venkatac-ayla]

Thanks, thalesmg. I could resolve that by using different variable.

Another question was related to what should be the response format for on_client_authenticate. As per documentation it just mentions response is AuthNResult. But what is the format of AuthNResult and AuthZResult.

Can someone point to detailed documentation?

[CyberJos]

I could be wrong, but if you follow this link https://www.emqx.io/docs/en/latest/extensions/hooks.html#callback-function , it shows that authNResult is used for authentication and authZResult is used for authorization.