Basic auth not working - Orleans 7

[iamsamcoder]

Hello,

I've recently upgraded to Orleans 7.1.0 and I've updated Dashboard to 7. 2.0. I've configured the dashboard to use basic auth with username and password.

Program.cs configuration

siloBuilder.UseDashboard(options =>
                {
                    options.Username = "username";
                    options.Password = "password";
                });

Startup.cs configuration

app.Map("/dashboard", x => x.UseOrleansDashboard());

Dashboard works, but doesn't require the password. I'm running this locally in docker and live in Azure container apps.

Am I missing something for the configuration to require username and password?

[richorama]

I have just tried Orleans 7.1.0 with dashboard 7.2.0 and I can't reproduce the fault. This is my config:

using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Hosting;
using Orleans;
using Orleans.Configuration;
using Orleans.Hosting;
using System.Net;
using TestGrains;

namespace TestHost
{
    public static class Program
    {
        private static readonly int GatewayPort = 30000;
        private static readonly int SiloPort = 11111;
        private static readonly IPAddress SiloAddress = IPAddress.Loopback;

        public static void Main(string[] args)
        {
            //
            // In this sample we let the dashboard host kestrel and the backend services.
            // 
            Host.CreateDefaultBuilder(args)
                .UseOrleans((_, builder) =>
                {
                    builder.UseDevelopmentClustering(options => options.PrimarySiloEndpoint = new IPEndPoint(SiloAddress, SiloPort));
                    builder.UseInMemoryReminderService();
                    builder.AddMemoryGrainStorageAsDefault();
                    builder.ConfigureEndpoints(SiloAddress, SiloPort, GatewayPort);
                    builder.Configure<ClusterOptions>(options =>
                    {
                        options.ClusterId = "helloworldcluster";
                        options.ServiceId = "1";
                    });

                    builder.UseDashboard(options =>
                    {
                        options.HostSelf = true;
                        options.Username = "test";
                        options.Password = "test";
                    });
                })
                .ConfigureServices(services =>
                {
                    services.AddSingleton<IHostedService, TestGrainsHostedService>();
                })
                .Build()
                .Run();
        }
    }
}

Are you able to provide a failing example?

[clement128]

I think the problem is only happen if we disable self hosting

[iamsamcoder]

I was using the following, but password was not working when deployed. In Program hostbuilder: siloBuilder.UseDashboard(options => { options.Username = "username"; options.Password = "qwerty-safe"; }); And in Startup.cs Configure: app.Map("/dashboard", x => x.UseOrleansDashboard());

…

On Mon, May 1, 2023 at 4:25 AM Clement Tan ***@***.***> wrote: I think the problem is only happen if we disable self hosting — Reply to this email directly, view it on GitHub <#393 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AB3BOUUSXPMPKYFFM4SFFN3XD6MQ5ANCNFSM6AAAAAAVRWTEFA> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[clement128]

You can not use app.Map("/dashboard", x => x.UseOrleansDashboard()); as it will go to your application request pipeline, it is not self hosting

[iamsamcoder]

Hello @clement128 and @richorama

I'm sorry for not responding sooner, I had other aspects of our Orleans project prioritized. I'm back to trying to get basic auth working for Orleans.

I'm still not able to get basic auth working locally. I'm trying the following as a simple spike to test it out, but I'm still able to access the dashboard without a prompt for authentication. I access dashboard at the application port https://localhost:44393/dashboard.

"OrleansDashboard" Version="7.2.2"
"Microsoft.Orleans.Core" Version="7.2.1"

var builder = WebApplication.CreateBuilder(args);

builder.Host.UseOrleans(siloBuilder =>
{
    siloBuilder.UseLocalhostClustering();
    siloBuilder.UseDashboard(options =>
    {
        options.HostSelf = true;
        options.Username = "test";
        options.Password = "test";
    });
});

// Add services to the container.

builder.Services.AddControllers();
// Learn more about configuring Swagger/OpenAPI at https://aka.ms/aspnetcore/swashbuckle
builder.Services.AddEndpointsApiExplorer();
builder.Services.AddSwaggerGen();

var app = builder.Build();

app.Map("/dashboard", x => x.UseOrleansDashboard());

// Configure the HTTP request pipeline.
if (app.Environment.IsDevelopment())
{
    app.UseSwagger();
    app.UseSwaggerUI();
}

//app.UseHttpsRedirection();

//app.UseAuthorization();

app.MapControllers();

app.Run();

I've tried also with HostSelf = false and without app.Map("/dashboard", x => x.UseOrleansDashboard()); but the page is not accessible.

[iamsamcoder]

You can not use app.Map("/dashboard", x => x.UseOrleansDashboard()); as it will go to your application request pipeline, it is not self hosting

Sorry @clement128, were you saying basic auth doesn't work when you use app.Map()?

I was able to get basic auth without using app.Map().

[jsteff]

@richorama

I am experiencing the same issue with Orleans 8.2.0 on .NET 8

    var builder = WebApplication.CreateBuilder(args);

    builder.Host.UseOrleans((ctx, orleansBuilder) =>
    {
        if (ctx.HostingEnvironment.IsDevelopment())
        {
            orleansBuilder
                .UseLocalhostClustering()
                .AddMemoryGrainStorage("grains")
                .UseDashboard(options =>
                {
                    options.HostSelf = false;
                }); 
        }
    });

    builder.Services.AddControllers();

    var app = builder.Build();

    app.UseAuthorization();

    app.UseStaticFiles();

    app.MapControllers();

    app.UseOrleansDashboard(new OrleansDashboard.DashboardOptions
    {
        BasePath = "/orleans/dashboard",
        Username = "test",
        Password = "test"
    });

    app.Run();

It seems that UseOrleansDashboard is using the DashboardMiddleware which doesn't check the username and password at all. When the dashboard is self-hosted it is working as expected.