I am a newbie with Tyk. Trying to make a demo project with set of products (i use docker to make setup more visualised for presentation, so it’s easy to try for others):
- tykio/tyk-gateway:latest
- tykio/tyk-pump-docker-pub:latest
- tyk-identity-broker:latest
Seems that products are very good, but i face some lack of just working examples (docker-compose files, configs) in addition to documentation, which contain too long texts. Working examples could make start process many times faster as well as could help to share best practices provided by vendor.
My use case:
I want to authorise user against of LDAP, generate a temporary token and forward authorised request to secured page “http://${BASE_URL}/?success=true”, where
BASE_URL=http://localhost:8080
I do not use dashboard so most probably because of this I face lack of good and working examples, and do not plan to use it future, so face now problems with “IdentityHandlerConfig”, because most of examples have only dashboard identity handler.
My profiles.json:
[
{
“ActionType”: “GenerateTemporaryAuthToken”,
“ID”: “1.0”,
“IdentityHandlerConfig”: {
“TokenAuth”: {
“BaseAPIID”: “app”,
“RedirectURI”: “${BASE_URL}/?success=true”
}
},
“MatchedPolicyID”: “it-was-ldap-auth”,
“OrgID”: “org-id”,
“ProviderConfig”: {
“FailureRedirect”: “${BASE_URL}/?fail=true”,
“LDAPAttributes”: [],
“LDAPPort”: “389”,
“LDAPServer”: “ldap.forumsys.com”,
“LDAPUserDN”: “cn=read-only-admin,dc=example,dc=com”
},
“ProviderName”: “ADProvider”,
“ReturnURL”: “${BASE_URL}/?success=true”,
“Type”: “redirect”
}
]
my tib.conf:
{
“HttpServerOptions”: {
“UseSSL”: false,
“CertFile”: “./certs/server.pem”,
“KeyFile”: “./certs/server.key”
},
“BackEnd”: {
“Name”: “in_memory”,
“IdentityBackendSettings”: {
“Hosts” : {
“redis”: “6379”
},
“Password”: “”,
“Database”: 0,
“EnableCluster”: false,
“MaxIdle”: 1000,
“MaxActive”: 2000,
“UseSSL”: false,
“SSLInsecureSkipVerify”: false
}
},
“TykAPISettings”: {
“GatewayConfig”: {
“Endpoint”: “${BASE_URL}”,
“Port”: “8080”
}
}
}
and it fails on the token generating after authorisation through LDAP:
tyk-identity | time="2020-05-14T18:04:18Z" level=info msg="Search: starting..." prefix="AD AUTH"
tyk-identity | time="2020-05-14T18:04:18Z" level=info msg="Running LDAP search" DN="cn=read-only-admin,dc=example,dc=com" Filter="(objectclass=*)" prefix="AD AUTH"
tyk-identity | time="2020-05-14T18:04:18Z" level=warning msg="User email not found, generating from username" prefix="AD AUTH"
tyk-identity | time="2020-05-14T18:04:18Z" level=info msg="Starting Token Flow..." prefix="TYK ID HANDLER"
tyk-identity | time="2020-05-14T18:04:18Z" level=error msg="Failed to create request" error="parse :/api/keys: missing protocol scheme" prefix="TYK_API"
tyk-identity | 2020/05/14 18:04:18 http: panic serving 172.25.0.1:58932: runtime error: invalid memory address or nil pointer dereference
tyk-identity | goroutine 69 [running]:
tyk-identity | net/http.(*conn).serve.func1(0xc000188c80)
tyk-identity | /usr/local/go/src/net/http/server.go:1769 +0x139
tyk-identity | panic(0x88b380, 0xcff8f0)
tyk-identity | /usr/local/go/src/runtime/panic.go:522 +0x1b5
tyk-identity | github.com/TykTechnologies/tyk-identity-broker/tyk-api.(*TykAPI).DispatchDashboard(0xd0d900, 0x90a0ad, 0x9, 0x908d0d, 0x4, 0x0, 0x0, 0x9aeb20, 0xc000146600, 0x17, ...)
tyk-identity | /src/github.com/TykTechnologies/tyk-identity-broker/tyk-api/tyk_api.go:145 +0x2f9
tyk-identity | github.com/TykTechnologies/tyk-identity-broker/tyk-api.(*TykAPI).DispatchAndDecode(0xd0d900, 0x90a0ad, 0x9, 0x908d0d, 0x4, 0x908da5, 0x4, 0x8495e0, 0xc00012eea0, 0x0, ...)
tyk-identity | /src/github.com/TykTechnologies/tyk-identity-broker/tyk-api/tyk_api.go:268 +0x6a0
tyk-identity | github.com/TykTechnologies/tyk-identity-broker/tyk-api.(*TykAPI).RequestStandardToken(0xd0d900, 0xc000177bf4, 0x6, 0xc000177c00, 0x10, 0xc000177c79, 0x7, 0x0, 0x0, 0xe10, ...)
tyk-identity | /src/github.com/TykTechnologies/tyk-identity-broker/tyk-api/tyk_api.go:513 +0x944
tyk-identity | github.com/TykTechnologies/tyk-identity-broker/tap/identity-handlers.(*TykIdentityHandler).CompleteIdentityActionForTokenAuth(0xc000242000, 0x9b7a60, 0xc00023c000, 0xc0001fe300, 0x8f7120, 0xc000288000, 0xc000177bf0, 0x3, 0xc000177bf4, 0x6, ...)
tyk-identity | /src/github.com/TykTechnologies/tyk-identity-broker/tap/identity-handlers/tyk_handler.go:429 +0x3b8
tyk-identity | github.com/TykTechnologies/tyk-identity-broker/tap/identity-handlers.(*TykIdentityHandler).CompleteIdentityAction(0xc000242000, 0x9b7a60, 0xc00023c000, 0xc0001fe300, 0x8f7120, 0xc000288000, 0xc000177bf0, 0x3, 0xc000177bf4, 0x6, ...)
tyk-identity | /src/github.com/TykTechnologies/tyk-identity-broker/tap/identity-handlers/tyk_handler.go:486 +0x146
tyk-identity | github.com/TykTechnologies/tyk-identity-broker/providers.(*ADProvider).Handle(0xc000240000, 0x9b7a60, 0xc00023c000, 0xc0001fe300)
tyk-identity | /src/github.com/TykTechnologies/tyk-identity-broker/providers/active_directory.go:317 +0xcb7
tyk-identity | main.HandleAuth(0x9b7a60, 0xc00023c000, 0xc0001fe300)
tyk-identity | /src/github.com/TykTechnologies/tyk-identity-broker/http_handlers.go:138 +0x83
tyk-identity | net/http.HandlerFunc.ServeHTTP(0x927550, 0x9b7a60, 0xc00023c000, 0xc0001fe300)
tyk-identity | /usr/local/go/src/net/http/server.go:1995 +0x44
tyk-identity | github.com/TykTechnologies/tyk-identity-broker/vendor/github.com/gorilla/mux.(*Router).ServeHTTP(0xc000178410, 0x9b7a60, 0xc00023c000, 0xc0001fe300)
tyk-identity | /src/github.com/TykTechnologies/tyk-identity-broker/vendor/github.com/gorilla/mux/mux.go:114 +0xdb
tyk-identity | net/http.serverHandler.ServeHTTP(0xc00019c680, 0x9b7a60, 0xc00023c000, 0xc0001fe100)
tyk-identity | /usr/local/go/src/net/http/server.go:2774 +0xa8
tyk-identity | net/http.(*conn).serve(0xc000188c80, 0x9b89e0, 0xc00017c2c0)
tyk-identity | /usr/local/go/src/net/http/server.go:1878 +0x851
tyk-identity | created by net/http.(*Server).Serve
tyk-identity | /usr/local/go/src/net/http/server.go:2884 +0x2f4
Any ideas how to reconfigure IdentityHandlerConfig to register token and redirect it to the “${BASE_URL}/?success=true” or respond client with json token ?