I'm trying to get a small golang application to connect to a hyperledger fabric network. The network is based on one of the official hyperledger-fabric samples, called 'first-network'. It is started by their 'byfn.sh' script and runs a functioning end-2-end test. The test executes commands directly using the 'cli' container that has all the valid crypto material.
I, however, try to do query or create a Tx using the fabric-sdk-go. I created a connection profile based on the official documentation and samples I found online.
sdk, err := fabsdk.New(config.FromFile("../integrity-network/connection-profile.yaml"))
...
clientChannelContext := sdk.ChannelContext("integrity-channel", fabsdk.WithUser("Admin#org1.example.com"), fabsdk.WithOrg("Org1"))
Reading the profile and creating the SDK instance works, however creation of the channel context fails and peer0 of org1 tells me: first record does not look like a TLS handshake
I'm a bit confused about the crypto material I have to provide in the connection profile, but based on examples online I think it should be correct:
x-type: "hlfv1"
description: "Connection profile for our integrity network."
version: "1.0"
client:
organization: org1
logging:
level: debug
cryptoconfig:
path: ../integrity-network/crypto-config/
credentialStore:
path: "/tmp/state-store"
cryptoStore:
path: /tmp/msp
tlsCerts:
systemCertPool: false
client:
key:
path: ../integrity-network/crypto-config/peerOrganizations/org1.example.com/users/Admin#org1.example.com/tls/client.key
cert:
path: ../integrity-network/crypto-config/peerOrganizations/org1.example.com/users/Admin#org1.example.com/tls/client.crt
channels:
integrity-channel:
orderers:
- orderer.example.com
peers:
peer0.org1.example.com:
endorsingPeer: true
chaincodeQuery: true
ledgerQuery: true
eventSource: true
peer1.org1.example.com:
endorsingPeer: true
chaincodeQuery: true
ledgerQuery: true
eventSource: true
organizations:
OrdererOrg:
mspid: OrdererOrg
cryptoPath: crypto-config/ordererOrganizations/example.com/users/Admin#example.com/msp
adminPrivateKey:
path: ../integrity-network/crypto-config/ordererOrganizations/example.com/users/Admin#example.com/msp/keystore/f6dc3f715ffd9547e5ff5e3e08d5ac17f1e2b09968d2daba9e7a9a4e374a2fb1_sk
signedCert:
path: ../integrity-network/crypto-config/ordererOrganizations/example.com/users/Admin#example.com/msp/signcerts/Admin#example.com-cert.pem
Org1:
mspid: Org1MSP
cryptoPath: ../integrity-network/crypto-config/peerOrganizations/org1.example.com/users/Admin#org1.example.com/msp
peers:
- peer0.org1.example.com
- peer1.org1.example.com
adminPrivateKey:
path: ../integrity-network/crypto-config/peerOrganizations/org1.example.com/users/Admin#org1.example.com/msp/keystore/25117a9fcadf7b40ed7dcd29b7a478ca86728e564a8388aa889a5de71dec5df8_sk
signedCert:
path: ../integrity-network/crypto-config/peerOrganizations/org1.example.com/users/Admin#org1.example.com/msp/signcerts/Admin#org1.example.com-cert.pem
users:
Admin#org1.example.com:
key:
path: ../integrity-network/crypto-config/peerOrganizations/org1.example.com/users/Admin#org1.example.com/msp/keystore/25117a9fcadf7b40ed7dcd29b7a478ca86728e564a8388aa889a5de71dec5df8_sk
cert:
path: ../integrity-network/crypto-config/peerOrganizations/org1.example.com/users/Admin#org1.example.com/msp/signcerts/Admin#org1.example.com-cert.pem
User1#org1.example.com:
key:
path: ../integrity-network/crypto-config/peerOrganizations/org1.example.com/users/User1#org1.example.com/msp/keystore/e318dc3e94283337e3089673c8aca07ce0d6cc8ffdb03984ab2de11ec7ac11dd_sk
cert:
path: ../integrity-network/crypto-config/peerOrganizations/org1.example.com/users/User1#org1.example.com/msp/signcerts/User1#org1.example.com-cert.pem
Org2:
mspid: Org2MSP
cryptoPath: crypto-config/peerOrganizations/org2.example.com/users/Admin#org2.example.com/msp
peers:
- peer0.org2.example.com
- peer1.org2.example.com
adminPrivateKey:
path: ../integrity-network/crypto-config/peerOrganizations/org2.example.com/users/Admin#org2.example.com/msp/keystore/078fca0bf56b77656f745e62100a1fd7d55f5d2c2925b6180daac49b67e64f0d_sk
signedCert:
path: ../integrity-network/crypto-config/peerOrganizations/org2.example.com/users/Admin#org2.example.com/msp/signcerts/Admin#org2.example.com-cert.pem
users:
Admin#org2.example.com:
key:
path: ../integrity-network/crypto-config/peerOrganizations/org2.example.com/users/Admin#org2.example.com/msp/keystore/078fca0bf56b77656f745e62100a1fd7d55f5d2c2925b6180daac49b67e64f0d_sk
cert:
path: ../integrity-network/crypto-config/peerOrganizations/org2.example.com/users/Admin#org2.example.com/msp/signcerts/Admin#org2.example.com-cert.pem
User1#org2.example.com:
key:
path: ../integrity-network/crypto-config/peerOrganizations/org2.example.com/users/User1#org2.example.com/msp/keystore/3fee22d1537bc40b5e3d036919e3651976a92e42df5725983400a4012f5bc138_sk
cert:
path: ../integrity-network/crypto-config/peerOrganizations/org2.example.com/users/User1#org2.example.com/msp/signcerts/User1#org2.example.com-cert.pem
orderers:
orderer.example.com:
url: grpc://localhost:7050
grpcOptions:
ssl-target-name-override: orderer.example.com
peers:
peer0.org1.example.com:
url: grpc://localhost:7051
grpcOptions:
ssl-target-name-override: peer0.org1.example.com
request-timeout: 120001
tlsCACerts:
path: ../integrity-network/crypto-config/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/msp/tlscacerts/tlsca.org1.example.com-cert.pem
peer1.org1.example.com:
url: grpc://localhost:8051
grpcOptions:
ssl-target-name-override: peer1.org1.example.com
request-timeout: 120001
tlsCACerts:
path: ../integrity-network/crypto-config/peerOrganizations/org1.example.com/peers/peer1.org1.example.com/msp/tlscacerts/tlsca.org1.example.com-cert.pem
peer0.org2.example.com:
url: grpc://localhost:9051
grpcOptions:
ssl-target-name-override: peer0.org1.example.com
request-timeout: 120001
tlsCACerts:
path: ../integrity-network/crypto-config/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/msp/tlscacerts/tlsca.org2.example.com-cert.pem
peer1.org2.net.ink.tum.de:
url: grpc://localhost:10051
grpcOptions:
ssl-target-name-override: peer1.org2.example.com
request-timeout: 120001
tlsCACerts:
path: ../integrity-network/crypto-config/peerOrganizations/org2.example.com/peers/peer1.org2.example.com/msp/tlscacerts/tlsca.org2.example.com-cert.pem
Note: for some reason I needed the users section, otherwise I would get a user not found. Most examples I found online did not include that section.
You need to use grpcs in your peer URLs:
peers:
peer0.org1.example.com:
url: grpcs://localhost:7051
Related
When I send a GET request to AWS APIGateway's URL "https://blablabla.execute-api.us-east-1.amazonaws.com/dev/crs/blablabla.png" or Custom Domain's URL "devblablabla.bla.com" via browser or POSTMAN I receive a 200 response with the "X-Cache: Miss from cloudfront" header:
GET request to AWS APIGateway
Do you have any idea how I can rewrite the serverless.yml file for receiving 200 response with the "X-cache:HIT" header?
This is the configuration that I deploy:
# serverless.yml
service: s3-blablabla-service
provider:
name: aws
stage: dev
region: us-east-1
environment:
SERVICE_NAME: ${self:service}
apiGateway:
binaryMediaTypes: "*/*"
plugins:
- serverless-apigateway-service-proxy
- serverless-domain-manager
- serverless-finch
custom:
c3launchBucketName: "blabla-pl-${self:provider.stage}"
c3scormBucketName: "blabla-crs-${self:provider.stage}"
domainName: "${self:provider.stage}blablabla.bla.com" # Change this to your domain.
basePath: "" # This will be prefixed to all routes
apiGatewayServiceProxies:
- s3:
path: /pl/{myKey+} # use path param
method: get
action: GetObject
bucket:
# ${self:custom.c3launchBucketName}
Ref: S3Bucket
key:
pathParam: myKey
requestParameters:
"integration.request.header.cache-control": "'public, max-age=31536000, immutable'"
- s3:
path: /crs/{myKey+} # use path param
method: get
action: GetObject
bucket:
# ${self:custom.c3scormBucketName}
Ref: S3ScormBucket
key:
pathParam: myKey
requestParameters:
"integration.request.header.cache-control": "'public, max-age=31536000, immutable'"
customDomain:
domainName: ${self:custom.domainName}
basePath: ${self:custom.basePath}
stage: ${self:provider.stage}
createRoute53Record: true
autoDomain: true
client:
bucketName: ${self:custom.c3launchBucketName}
resources:
Resources:
S3Bucket:
Type: 'AWS::S3::Bucket'
Properties:
BucketName: ${self:custom.c3launchBucketName}
S3ScormBucket:
Type: 'AWS::S3::Bucket'
Properties:
BucketName: ${self:custom.c3scormBucketName}
After the deployment I receive this result:
endpoints:
GET - https://blablabla.execute-api.us-east-1.amazonaws.com/dev/pl/{myKey+}
GET - https://blablabla.execute-api.us-east-1.amazonaws.com/dev/crs/{myKey+}
Service deployed to stack s3-blablabla-service-dev
Serverless Domain Manager:
Domain Name: devblablabla.bla.com
Target Domain: abrakadabra.cloudfront.net
Hosted Zone Id: BARBARBAR
I have two test tests, one reading and one writing on the blockchain. I'm getting two different errors, one at the start of the test and one at the writing test. The reading test is working normally without problems.
Initial error:
2021.12.21-16:43:01.870 info [caliper] [round-orchestrator] Preparing worker connections
2021.12.21-16:43:01.870 info [caliper] [worker-orchestrator] Launching worker 1 of 2
2021.12.21-16:43:01.878 info [caliper] [worker-orchestrator] Launching worker 2 of 2
2021.12.21-16:43:01.884 info [caliper] [worker-orchestrator] Messenger not configured, entering configure phase...
2021.12.21-16:43:01.885 info [caliper] [worker-orchestrator] No existing workers detected, entering worker launch phase...
2021.12.21-16:43:01.885 info [caliper] [worker-orchestrator] Waiting for 2 workers to be connected...
2021.12.21-16:43:02.426 info [caliper] [cli-launch-worker] Set workspace path: /home/ubuntu/caliper/caliper-benchmarks/monitor
2021.12.21-16:43:02.427 info [caliper] [cli-launch-worker] Set benchmark configuration path: /home/ubuntu/caliper/caliper-benchmarks/monitor/config.yaml
2021.12.21-16:43:02.427 info [caliper] [cli-launch-worker] Set network configuration path: /home/ubuntu/caliper/caliper-benchmarks/monitor/network.yaml
2021.12.21-16:43:02.427 info [caliper] [cli-launch-worker] Set SUT type: fabric
2021.12.21-16:43:02.444 info [caliper] [cli-launch-worker] Set workspace path: /home/ubuntu/caliper/caliper-benchmarks/monitor
2021.12.21-16:43:02.446 info [caliper] [cli-launch-worker] Set benchmark configuration path: /home/ubuntu/caliper/caliper-benchmarks/monitor/config.yaml
2021.12.21-16:43:02.446 info [caliper] [cli-launch-worker] Set network configuration path: /home/ubuntu/caliper/caliper-benchmarks/monitor/network.yaml
2021.12.21-16:43:02.447 info [caliper] [cli-launch-worker] Set SUT type: fabric
2021.12.21-16:43:02.505 info [caliper] [worker-orchestrator] 2 workers connected, progressing to worker assignment phase.
2021.12.21-16:43:02.505 info [caliper] [worker-orchestrator] Workers currently unassigned, awaiting index assignment...
2021.12.21-16:43:02.506 info [caliper] [worker-orchestrator] Waiting for 2 workers to be assigned...
2021.12.21-16:43:02.559 info [caliper] [worker-orchestrator] 2 workers assigned, progressing to worker initialization phase.
2021.12.21-16:43:02.560 info [caliper] [worker-orchestrator] Waiting for 2 workers to be ready...
2021.12.21-16:43:03.629 info [caliper] [worker-message-handler] Initializing Worker#1...
2021.12.21-16:43:03.629 info [caliper] [fabric-connector] Initializing gateway connector compatible with installed SDK: 2.2.3
2021.12.21-16:43:03.629 info [caliper] [IdentityManager] Adding User1 (admin=false) as User1 for organization Org1MSP
2021.12.21-16:43:03.629 info [caliper] [worker-message-handler] Worker#1 initialized
2021.12.21-16:43:03.683 info [caliper] [worker-orchestrator] 2 workers ready, progressing to test preparation phase.
2021.12.21-16:43:03.684 info [caliper] [round-orchestrator] Started round 1 (Set)
2021.12.21-16:43:03.690 info [caliper] [worker-message-handler] Preparing Worker#1 for Round#0
2021.12.21-16:43:03.696 info [caliper] [connectors/v2/FabricGateway] Connecting user with identity User1 to a Network Gateway
2021.12.21-16:43:04.005 info [caliper] [worker-message-handler] Initializing Worker#0...
2021.12.21-16:43:04.005 info [caliper] [fabric-connector] Initializing gateway connector compatible with installed SDK: 2.2.3
2021.12.21-16:43:04.005 info [caliper] [IdentityManager] Adding User1 (admin=false) as User1 for organization Org1MSP
2021.12.21-16:43:04.005 info [caliper] [worker-message-handler] Worker#0 initialized
2021.12.21-16:43:04.006 info [caliper] [worker-message-handler] Preparing Worker#0 for Round#0
2021.12.21-16:43:04.006 info [caliper] [connectors/v2/FabricGateway] Connecting user with identity User1 to a Network Gateway
2021.12.21-16:43:04.007 info [caliper] [connectors/v2/FabricGateway] Successfully connected user with identity User1 to a Network Gateway
2021.12.21-16:43:04.008 info [caliper] [connectors/v2/FabricGateway] Generating contract map for user User1
2021.12.21-16:43:04.018 info [caliper] [connectors/v2/FabricGateway] Successfully connected user with identity User1 to a Network Gateway
2021.12.21-16:43:04.019 info [caliper] [connectors/v2/FabricGateway] Generating contract map for user User1
2021-12-21T16:43:07.083Z - error: [ServiceEndpoint]: Error: Failed to connect before the deadline on Committer- name: orderer.example.com:7050, url:grpc://localhost:7050, connected:false, connectAttempted:true
2021-12-21T16:43:07.086Z - error: [ServiceEndpoint]: waitForReady - Failed to connect to remote gRPC server orderer.example.com:7050 url:grpc://localhost:7050 timeout:3000
2021-12-21T16:43:07.088Z - error: [DiscoveryService]: _buildOrderer[channelall] - Unable to connect to the discovered orderer orderer.example.com:7050 due to Error: Failed to connect before the deadline on Committer- name: orderer.example.com:7050, url:grpc://localhost:7050, connected:false, connectAttempted:true
2021-12-21T16:43:07.085Z - error: [ServiceEndpoint]: Error: Failed to connect before the deadline on Committer- name: orderer.example.com:7050, url:grpc://localhost:7050, connected:false, connectAttempted:true
2021-12-21T16:43:07.090Z - error: [ServiceEndpoint]: waitForReady - Failed to connect to remote gRPC server orderer.example.com:7050 url:grpc://localhost:7050 timeout:3000
2021-12-21T16:43:07.092Z - error: [DiscoveryService]: _buildOrderer[channelall] - Unable to connect to the discovered orderer orderer.example.com:7050 due to Error: Failed to connect before the deadline on Committer- name: orderer.example.com:7050, url:grpc://localhost:7050, connected:false, connectAttempted:true
The second error that occurs in the writing test is the following:
2021.12.21-16:43:07.112 info [caliper] [worker-orchestrator] 2 workers prepared, progressing to test phase.
2021.12.21-16:43:07.112 info [caliper] [round-orchestrator] Monitors successfully started
2021.12.21-16:43:07.115 info [caliper] [worker-message-handler] Worker#1 is starting Round#0
2021.12.21-16:43:07.116 info [caliper] [worker-message-handler] Worker#0 is starting Round#0
2021.12.21-16:43:07.123 info [caliper] [caliper-worker] Worker #1 starting workload loop
2021.12.21-16:43:07.126 info [caliper] [caliper-worker] Worker #0 starting workload loop
2021.12.21-16:43:07.941 error [caliper] [connectors/v2/FabricGateway] Failed to perform submit transaction [set] using arguments [node1,{'CPU':50,'MEM':50,'STG':50.0,'DAT':'2020-11-17T00:10:00Z'}], with error: Error: No endorsement plan available
at DiscoveryHandler.endorse (/home/ubuntu/caliper/node_modules/fabric-network/node_modules/fabric-common/lib/DiscoveryHandler.js:208:10)
at process._tickCallback (internal/process/next_tick.js:68:7)
Connection File
---
name: fabric
version: 2.0.0
client:
organization: Org1
connection:
timeout:
peer:
endorser: '300'
organizations:
Org1:
mspid: Org1MSP
peers:
- peer0.org1.example.com
certificateAuthorities:
- ca.org1.example.com
orderers:
orderer.example.com:
url: grpc://192.169.0.9:7050
grpcOptions:
ssl-target-name-override: orderer.example.com
peers:
peer0.org1.example.com:
url: grpc://192.169.0.7:7051
tlsCACerts:
path: peerOrganizations/org1.example.com/tlsca/tlsca.org1.example.com-cert.pem
grpcOptions:
ssl-target-name-override: peer0.org1.example.com
certificateAuthorities:
ca.org1.example.com:
url: https://192.169.0.7:7054
caName: ca-org1
tlsCACerts:
path: peerOrganizations/org1.example.com/tlsca/tlsca.org1.example.com-cert.pem
httpOptions:
verify: false
Network File
name: Fabric
version: '2.0.0'
caliper:
blockchain: fabric
sutOptions:
mutualTls: false
organizations:
- mspid: Org1MSP
identities:
certificates:
- name: 'User1'
clientPrivateKey:
path: 'peerOrganizations/org1.example.com/users/User1#org1.example.com/msp/keystore/priv_sk'
clientSignedCert:
path: 'peerOrganizations/org1.example.com/users/User1#org1.example.com/msp/signcerts/User1#org1.example.com-cert.pem'
connectionProfile:
path: 'connection_files/connection-org1.yaml'
discover: true
orderers:
orderer.example.com:
url: grpc://192.169.0.9:7050
grpcOptions:
ssl-target-name-override: orderer.example.com
channels:
- channelName: channelall
contracts:
- id: monitor
I kindly ask for any tips so that I can solve these problems and follow the development.
From the network file you posted a couple of points
you can't define any nodes in it (for example you've added orderers). They are ignored
you've specified that your connection profile is a dynamic profile by setting discover to true in your network file, this means it will use discovery to determine the network topology and may not use the nodes you have explicitly defined in your connection profile. If you want to be explicit in your connection profile (and thus define a static connection profile) like you have in your above example, you should set discover to false, which hopefully will solve your problem.
As a side note, if you use discovery then the node-sdk (used by caliper) and caliper by default converts all discovered node hosts to localhost, which is why you see it trying to contact localhost. To disable this see Runtime settings in https://hyperledger.github.io/caliper/v0.4.2/fabric-config/new/
The issue was in the connection file.
The old file was:
---
name: fabric
version: 2.0.0
client:
organization: Org1
connection:
timeout:
peer:
endorser: '300'
orderer: '10000'
organizations:
Org1:
mspid: Org1MSP
peers:
- peer0.org1.example.com
certificateAuthorities:
- ca.org1.example.com
orderers:
orderer.example.com:
url: grpc://192.169.0.9:7050
grpcOptions:
ssl-target-name-override: orderer.example.com
peers:
peer0.org1.example.com:
url: grpc://192.169.0.7:7051
tlsCACerts:
path: crypto-config/peerOrganizations/org1.example.com/tlsca/tlsca.org1.example.com-cert.pem
grpcOptions:
ssl-target-name-override: peer0.org1.example.com
certificateAuthorities:
ca.org1.example.com:
url: http://192.169.0.7:7054
caName: ca-org1
tlsCACerts:
path: crypto-config/peerOrganizations/org1.example.com/tlsca/tlsca.org1.example.com-cert.pem
httpOptions:
verify: false
The new connection file that I created is this:
---
name: fabric
description: "Sample connection profile for documentation topic"
version: 2.0.0
channels:
channelall:
orderers:
- orderer.example.com
peers:
peer0.org1.example.com:
endorsingPeer: true
chaincodeQuery: true
ledgerQuery: true
eventSource: true
peer0.org2.example.com:
endorsingPeer: true
chaincodeQuery: true
ledgerQuery: true
eventSource: true
peer0.org3.example.com:
endorsingPeer: false
chaincodeQuery: false
ledgerQuery: true
eventSource: true
organizations:
Org1:
mspid: Org1MSP
peers:
- peer0.org1.example.com
Org2:
mspid: Org2MSP
peers:
- peer0.org2.example.com
Org3:
mspid: Org3MSP
peers:
- peer0.org3.example.com
orderers:
orderer.example.com:
url: grpc://192.169.0.9:7050
grpcOptions:
ssl-target-name-override: orderer.example.com
peers:
peer0.org1.example.com:
url: grpc://192.169.0.7:7051
grpcOptions:
ssl-target-name-override: peer0.org1.example.com
request-timeout: 120001
peer0.org2.example.com:
url: grpc://192.169.0.10:7051
grpcOptions:
ssl-target-name-override: peer0.org2.example.com
request-timeout: 120001
peer0.org3.example.com:
url: grpc://192.169.0.11:7051
grpcOptions:
ssl-target-name-override: peer0.org3.example.com
request-timeout: 120001
With all information about peers and orderers.
Thanks everybody for the help.
I am trying to deploy sample.war application on EC2 instance at the time of launch. That is when an instance is launched the application should be deployed automatically on it using cfn-init and Metadata. I added a user with policy and authentication with no luck. If I wget with the S3 path, the file is being downloaded. Below is my script. What am I missing in this, or is there any other way to do this?
---
AWSTemplateFormatVersion: 2010-09-09
Description: Test QA Template
Resources:
MyInstance:
Type: AWS::EC2::Instance
Properties:
ImageId: !Ref AMIIdParam
InstanceType: !Ref InstanceType
Metadata:
AWS::CloudFormation::Init:
config:
packages:
yum:
java-1.8.0-openjdk.x86_64: []
tomcat: []
httpd.x86_64: []
services:
sysvinit:
httpd:
enabled: true
ensureRunning: true
files:
/usr/share/tomcat/webapps/sample.zip:
source: https://s3.amazonaws.com/mybucket/sample.zip
mode: '000500'
owner: tomcat
group: tomcat
authentication: S3AccessCreds
AWS::CloudFormation::Authentication:
S3AccessCreds:
type: 'S3'
accessKeyId: !Ref HostKeys
secretKey: Fn::GetAtt:
- HostKeys
- SecretAccessKey
buckets: !Ref BucketName
CfnUser:
Type: AWS::IAM::User
Properties:
Path: '/'
Policies:
- PolicyName: 'S3Access'
PolicyDocument:
Statement:
- Effect: 'Allow'
Action: s3:*
Resource: '*'
HostKeys:
Type: AWS::IAM::AccessKey
Properties:
UserName: !Ref CfnUser
I was unable to reproduce this using the following template:
---
AWSTemplateFormatVersion: 2010-09-09
Description: Test QA Template
Resources:
MyInstance:
Type: AWS::EC2::Instance
Properties:
ImageId: ami-08589eca6dcc9b39c
InstanceType: t2.micro
KeyName: default
UserData:
Fn::Base64: !Sub |
#!/bin/bash -xe
/opt/aws/bin/cfn-init -s ${AWS::StackId} --resource MyInstance --region ${AWS::Region}
Metadata:
AWS::CloudFormation::Init:
config:
packages:
yum:
java-1.8.0-openjdk.x86_64: []
tomcat: []
httpd.x86_64: []
services:
sysvinit:
httpd:
enabled: true
ensureRunning: true
files:
/usr/share/tomcat/webapps/sample.zip:
source: https://s3.amazonaws.com/mybucket/sample.zip
mode: '000500'
owner: tomcat
group: tomcat
(In other words, use of the above template allowed me to install a sample.zip file using cfn-init.)
Thus there is something permissions-related in the way you're accessing the S3 bucket.
Suffice to say it is a bad practice to use Access Keys. Have a look at this document on best practices of assigning an IAM Role to an EC2 instance and then adding a Bucket Policy that grants appropriate access to that Role.
I just started a new Symfony 3.4 project with Flex.
I followed the official documentation of FOSOAuthBundle but when I want to create a token /oauth/v2/token I have this error:" Unrecognized field: randomId "
Here are my configuration files:
#config/packages/fos_oauth_server.yaml
fos_oauth_server:
db_driver: orm
client_class: App\Entity\Client
access_token_class: App\Entity\AccessToken
refresh_token_class: App\Entity\RefreshToken
auth_code_class: App\Entity\AuthCode
service:
user_provider: fos_user.user_provider.username
options:
supported_scopes: user
#config/packages/security.yaml
security:
providers:
user_provider:
id: fos_user.user_provider.username
firewalls:
oauth_token:
pattern: ^/oauth/v2/token
security: false
oauth_authorize:
pattern: ^/oauth/v2/auth
security: false
# Add your favorite authentication process here
main:
pattern: ^/
fos_oauth: true
stateless: true
anonymous: false # can be omitted as its default value
access_control:
- { path: ^/, roles: [ IS_AUTHENTICATED_FULLY ] }
#config/packages/doctrine.yaml
parameters:
env(DATABASE_URL): ''
doctrine:
dbal:
# configure these for your database server
driver: 'pdo_mysql'
server_version: '5.7'
charset: utf8mb4
# With Symfony 3.3, remove the `resolve:` prefix
url: '%env(resolve:DATABASE_URL)%'
orm:
auto_generate_proxy_classes: '%kernel.debug%'
naming_strategy: doctrine.orm.naming_strategy.underscore
auto_mapping: true
mappings:
App:
is_bundle: false
type: annotation
dir: '%kernel.project_dir%/src/Entity'
prefix: 'App\Entity'
alias: App
Do you have an idea?
I'm trying to auth API and BackOffice users of a Symfony 3 app with a combination of 3 bundles : FR3DLdapBundle, LexikJwtAuthBundle and fosUserBundle. the first step I trying to do is to integrate LexicJwtBundle with fosUserBundle as a provider but every time a 401 error "bad credentials " appear to me , here is my config file :
imports:
- { resource: parameters.yml }
- { resource: security.yml }
- { resource: services.yml }
# Put parameters here that don't need to change on each machine where the app is deployed
# https://symfony.com/doc/current/best_practices/configuration.html#application-related-configuration
parameters:
locale: en
framework:
#esi: ~
translator: ~
secret: '%secret%'
router:
resource: '%kernel.project_dir%/app/config/routing.yml'
strict_requirements: ~
form: ~
csrf_protection: ~
validation: { enable_annotations: true }
#serializer: { enable_annotations: true }
templating:
engines: ['twig']
default_locale: '%locale%'
trusted_hosts: ~
session:
# https://symfony.com/doc/current/reference/configuration/framework.html#handler-id
handler_id: session.handler.native_file
save_path: '%kernel.project_dir%/var/sessions/%kernel.environment%'
fragments: ~
http_method_override: true
assets: ~
php_errors:
log: true
# Twig Configuration
twig:
debug: '%kernel.debug%'
strict_variables: '%kernel.debug%'
# Doctrine Configuration
doctrine:
dbal:
driver: pdo_mysql
host: '%database_host%'
port: '%database_port%'
dbname: '%database_name%'
user: '%database_user%'
password: '%database_password%'
charset: UTF8
# if using pdo_sqlite as your database driver:
# 1. add the path in parameters.yml
# e.g. database_path: "%kernel.project_dir%/var/data/data.sqlite"
# 2. Uncomment database_path in parameters.yml.dist
# 3. Uncomment next line:
#path: '%database_path%'
orm:
auto_generate_proxy_classes: '%kernel.debug%'
naming_strategy: doctrine.orm.naming_strategy.underscore
auto_mapping: true
# Swiftmailer Configuration
swiftmailer:
transport: '%mailer_transport%'
host: '%mailer_host%'
username: '%mailer_user%'
password: '%mailer_password%'
spool: { type: memory }
lexik_jwt_authentication:
private_key_path: '%jwt_private_key_path%'
public_key_path: '%jwt_public_key_path%'
pass_phrase: '%jwt_key_pass_phrase%'
token_ttl: '%jwt_token_ttl%'
fos_user:
db_driver: orm # other valid values are 'mongodb', 'couchdb' and 'propel'
firewall_name: main
user_class: AppBundle\Entity\User
from_email:
address: admin200#tls.tt
sender_name: admin tls
nelmio_cors:
defaults:
allow_credentials: false
allow_origin: []
allow_headers: []
allow_methods: []
expose_headers: []
max_age: 0
hosts: []
origin_regex: false
forced_allow_origin_value: ~
security.yml :
# To get started with security, check out the documentation:
# https://symfony.com/doc/current/security.html
security:
encoders:
FOS\UserBundle\Model\UserInterface: bcrypt
# https://symfony.com/doc/current/security.html#b-configuring-how-users-are-loaded
providers:
in_memory:
memory: ~
fos_userbundle:
id: fos_user.user_provider.username
firewalls:
# disables authentication for assets and the profiler, adapt it according to your needs
dev:
pattern: ^/(_(profiler|wdt)|css|images|js)/
security: false
main:
pattern: ^/
form_login:
provider: fos_userbundle
csrf_token_generator: security.csrf.token_manager # Use form.csrf_provider instead for Symfony <2.4
logout: true
anonymous: true
# activate different ways to authenticate
# https://symfony.com/doc/current/security.html#a-configuring-how-your-users-will-authenticate
#http_basic: ~
# https://symfony.com/doc/current/security/form_login_setup.html
#form_login: ~
login:
pattern: ^/login
stateless: true
anonymous: true
provider: fos_userbundle
form_login:
check_path: /login_check
success_handler: lexik_jwt_authentication.handler.authentication_success
failure_handler: lexik_jwt_authentication.handler.authentication_failure
require_previous_session: false
api:
pattern: ^/api
stateless: true
guard:
authenticators:
- lexik_jwt_authentication.jwt_token_authenticator
access_control:
- { path: ^/api/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/api, roles: IS_AUTHENTICATED_FULLY }
- { path: ^/login$, role: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/register, role: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/resetting, role: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/admin/, role: ROLE_ADMIN }
parameters.yml
# This file is auto-generated during the composer install
parameters:
database_host: 127.0.0.1
database_port: null
database_name: jwt
database_user: root
database_password: root
mailer_transport: smtp
mailer_host: 127.0.0.1
mailer_user: null
mailer_password: null
secret: ea0a3bab6b4dc3bb4b9f8c54c5c7b6e5139ad444
jwt_private_key_path: '%kernel.root_dir%/../var/jwt/private.pem' # ssh private key path
jwt_public_key_path: '%kernel.root_dir%/../var/jwt/public.pem' # ssh public key path
jwt_key_pass_phrase: '' # ssh key pass phrase
jwt_token_ttl: 3600
routing.yml
app:
resource: '#AppBundle/Controller/'
type: annotation
api_login_check:
path: /login_check
# app/config/routing.yml
fos_user_security:
resource: "#FOSUserBundle/Resources/config/routing/security.xml"
fos_user_profile:
resource: "#FOSUserBundle/Resources/config/routing/profile.xml"
prefix: /profile
fos_user_register:
resource: "#FOSUserBundle/Resources/config/routing/registration.xml"
prefix: /register
fos_user_resetting:
resource: "#FOSUserBundle/Resources/config/routing/resetting.xml"
prefix: /resetting
fos_user_change_password:
resource: "#FOSUserBundle/Resources/config/routing/change_password.xml"
prefix: /profile
I'm testing this url : http://localhost:8000/login_check with postman to get the token but nothing work ! some help please ?
you have to send body row by json like that
{"_username":"test",
"_password":"test"}
From the screenshot, it appears you miss the underscore of _username and _password. Maybe that would be enough for the auth to succeed ?