Authorization Credentials Stripped --- django, elastic beanstalk, oauth

Question

I implemented a REST api in django with django-rest-framework and used oauth2 for authentication.

I tested with:

curl -X POST -d "client_id=YOUR_CLIENT_ID&client_secret=YOUR_CLIENT_SECRET&grant_type=password&username=YOUR_USERNAME&password=YOUR_PASSWORD" http://localhost:8000/oauth2/access_token/

and

curl -H "Authorization: Bearer <your-access-token>" http://localhost:8000/api/

on localhost with successful results consistent with the documentation.

When pushing this up to an existing AWS elastic beanstalk instance, I received:

{ "detail" : "Authentication credentials were not provided." }

You are my hero. I have wasted many hours on this but I'm sure you saved me many more! — Steven, Apr 11 '14 at 03:21
You should answer your question yourself, so it doesn't appear on the unanswered list :) — , Sep 12 '14 at 21:31
I have no idea how much time of mine this would have eaten up, but I'm pretty sure it would have been a while. Life saver. — Tom Manterfield, Dec 18 '14 at 15:12
You saved my time. I don't know how many days I really stayed up all night. Ha... thank you very much. Have a nice day, I really love you. Still saving hours and hours in 2020 July !!!!!!!!!! lol — Tim, Jul 01 '20 at 23:47

score 67 · Answer 1 · answered Dec 15 '15 at 15:01

67

I like the idea of just having some extra configuration on the standard place. In your .ebextensions directory create a wsgi_custom.config file with:

files:
  "/etc/httpd/conf.d/wsgihacks.conf":
    mode: "000644"
    owner: root
    group: root
    content: |
      WSGIPassAuthorization On

As posted here: https://forums.aws.amazon.com/message.jspa?messageID=376244

answered Dec 15 '15 at 15:01

Manel Clos

1,577
1
14
14

7

this is a clean solution. it does work when you change environment variables and it doesn't keep adding the same line into a config file every time you deploy. – Mike Placentra May 31 '17 at 21:38
Getting this error : `not authorized to perform: rds:DescribeDBEngineVersions` – Chirag Maliwal Jan 25 '18 at 09:24

score 34 · Answer 2 · edited Mar 13 '15 at 12:48

34

I thought the problem was with my configuration in django or some other error type instead of focusing on the differences between localhost and EB. The issue is with EB's Apache settings.

WSGIPassAuthorization is natively set to OFF, so it must be turned ON. This can be done in your *.config file in your .ebextensions folder with the following command added:

container_commands:
  01_wsgipass:
    command: 'echo "WSGIPassAuthorization On" >> ../wsgi.conf'

Please let me know if I missed something or if there is a better way I should be looking at the problem. I could not find anything specifically about this anywhere on the web and thought this might save somebody hours of troubleshooting then feeling foolish.

edited Mar 13 '15 at 12:48

asontu

4,264
1
17
25

answered Sep 16 '14 at 07:02

sahutchi

2,043
17
20

5

Seems I spoke too soon in my above comment. Whilst this DOES work for an initial deployment, if you change something in your environment (e.g. add a new variable), this isn't ran when those changes are applied, and the wsgi.conf is still regenerated it seems. Don't suppose you know of any app config that is ran every time a change occurs? – Tom Manterfield Dec 19 '14 at 15:32
I include this in every git aws.push. But yes, I lose css sometimes when I change parameters. Would anything break in your app if after making a change to your environment you re-deployed the last push via the ui in the environment - application version menu? – sahutchi Dec 20 '14 at 03:33
It looks like this fix is now out of date. The runner up answer from Rubén Durá Tarí works (if you fix the typo) and seems on the face of it to be more robust. – skolsuper Nov 17 '15 at 09:41
@skolsuper what's the typo? – Nate Jan 28 '16 at 17:55
1

@Nate there isn't one. When I tested it, I had an unrelated problem that I inadvertently fixed at the same time as "correcting" the typo. Rubén has edited his answer back to a working state since my buffoonery. – skolsuper Jan 29 '16 at 02:10

Rubén Durá Tarí · Accepted Answer · 2017-07-21T11:55:08.287

31

I use a slightly different approach now. sahutchi's solution worked as long as env variables were not changed as Tom dickin pointed out. I dug a bit deeper inside EB and found out where the wsgi.conf template is located and added the "WSGIPassAuthorization On" option there.

commands:
  WSGIPassAuthorization:
    command: sed -i.bak '/WSGIScriptAlias/ a WSGIPassAuthorization On' config.py
    cwd: /opt/elasticbeanstalk/hooks

That will always work, even when changing environment variables. I hope you find it useful.

Edit: Seems like lots of people are still hitting this response. I haven't used ElasticBeanstalk in a while, but I would look into using Manel Clos' solution below. I haven't tried it personally, but seems a much cleaner solution. This one is literally a hack on EBs scripts and could potentially break in the future if EB updates them, specially if they move them to a different location.

edited Jul 21 '17 at 11:55

answered Mar 13 '15 at 11:58

Rubén Durá Tarí

992
9
17

This is nice. Now that awsebcli has eb ssh I've found its easier to be lazy on dev-ops and do clean-up by hand. – sahutchi Mar 13 '15 at 19:42
3

Still relevant answer. Wanted to add that (as a newbie aws user) you can just add the commands tag to your .ebextensions .config files, on top of your container_commands, and it will work. More on all the tags that are processed here: [link](http://docs.aws.amazon.com/elasticbeanstalk/latest/dg/customize-containers-ec2.html#linux-commands) – sean.hudson Mar 28 '17 at 05:47
Two issues with this: 1) only works on second and subsequent deploys, 2) sed keeps piling on that same line into the config file each time you deploy. The solution by Manel Clos (creating a new file in Apache's conf.d) does not suffer from these issues, and it also works when you change environment variables. – Mike Placentra May 31 '17 at 21:32
1

I haven't used EB in a while, but I do agree that his solution is cleaner and more elegant. I would probably use that if it works properly, which it should. – Rubén Durá Tarí Jun 05 '17 at 13:49
You saved my teams weekend. Thanks a lot! – Atul Mishra Apr 06 '18 at 14:05
Where is located this file that I have to put this code ? – rayashi Jul 31 '18 at 10:59
@rayashi Please check manel-clos answer below for a better solution – Rubén Durá Tarí Aug 01 '18 at 14:03

score 0 · Answer 4 · answered May 07 '15 at 19:12

Though the above solution is interesting, there is another way. Keep the wsgi.conf VirtualHost configuration file you want to use in .ebextensions, and overwrite it in a post deploy hook (you can't do this pre-deploy because it will get re-generated (yes, I found this out the hard way). If you do this, to reboot, make sure to use the supervisorctl program to restart so as to get all your environment variables set properly. (I found this out the hard way as well.)

cp /tmp/wsgi.conf /etc/httpd/conf.d/wsgi.conf
 /usr/local/bin/supervisorctl -c /opt/python/etc/supervisord.conf restart httpd
exit 0

01_python.config:

05_fixwsgiauth:
    command: "cp .ebextensions/wsgi.conf /tmp"

Authorization Credentials Stripped --- django, elastic beanstalk, oauth

4 Answers4

Linked

Related