Unable to skip basic authentication for specified paths in ksqldb-server

[mpistrang]

Describe the bug
Use of the config option authentication.skip.paths does not actually allow the specified paths to skip basic authentication for ksqldb-server.

To Reproduce
Steps to reproduce the behavior, include:

1. Using this fork of confluentinc/cp-all-in-one
2. In the cp-all-in-one-community directory un docker-compose -f docker-compose.yml -f docker-compose.ksqldb-server-basic-auth.yml up -d
3. Note that in the docker-compose.ksqldb-server-basic-auth.yml override file basic auth is configured for ksqldb-server along with /healthcheck defined in the authentication.skip.paths option.

Expected behavior
The command curl localhost:8088/healthcheck with no basic auth provided returns the health check information

Actual behavior
The command curl localhost:8088/healthcheck returns an HTTP 401

Additional context
I expect there is additional configuration that I am missing here, but so far I have not found what it could be.

[suhas-satish]

@alapidas , this seems to be control plane stuff, can you take this?

[agavra]

I was able to confirm the bug, working on a patch now.

[lucasprograms]

@agavra do you expect that this will be included in the ksqldb 0.28 release?

[agavra]

yes, this should be part of the 0.28 release :)

[nmckimm]

Has anyone managed to get this working on version 0.28.2? The change has been merged but I still cant skip /heartbeat or /lag using authentication.skip.paths.

[lucasprograms]

Not working for me either - trying to use the same skip paths configuration as seen here:
https://github.com/mpistrang/cp-all-in-one/blob/ksqldb-server-basic-auth-example/cp-all-in-one-community/docker-compose.ksqldb-server-basic-auth.yml#L11

[eoc-ross]

Same here.

It appears that the config is loaded but ignored. Here's the relevant log snippet

authentication.method = BASIC
authentication.realm = KsqlServer-Props
authentication.roles = [admin]
authentication.skip.paths = [/healthcheck, /lag, /info]

Has this anything to do with the internal listener address?

[lucasprograms]

hey @agavra , possible to reopen this?

[agavra]

yeah I'll reopen this - cc @suhas-satish @alapidas

[lucasbru]

I was able to reproduce the bug on master, and yes, the parameter is completely ignored for basic auth. I will implement a fix.