Opengrok not showing projects - indexer is working.

[kasiapetka]

Hi I have a configured opengrok on docker container. I have below auth config:

/tomcat/conf/server.xml:

      <Realm className="org.apache.catalina.realm.CombinedRealm" >
        <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
             resourceName="UserDatabase"/>
        <Realm className="org.apache.catalina.realm.JNDIRealm"
              debug="99"
              digest="MD5"
              digestEncoding="UTF-8"
              connectionURL=""
              connectionName=""
              connectionPassword=""
              userBase=""
              userSearch="(uid={0})"
              userSubtree="true"
              userRoleName=""
              allRolesMode="" />
      </Realm>

/tomcat/conf/web.xml:

  <security-constraint>
        <web-resource-collection>
            <web-resource-name>API endpoints are checked separately by the web app</web-resource-name>
            <url-pattern>/api/*</url-pattern>
        </web-resource-collection>
    </security-constraint>


  <security-constraint>
      <web-resource-collection>
          <web-resource-name>OpenGrok</web-resource-name>
          <url-pattern>/*</url-pattern>
      </web-resource-collection>

      <auth-constraint>
          <role-name>*</role-name>
      </auth-constraint>

  </security-constraint>

  <login-config>
      <auth-method>BASIC</auth-method>
      <realm-name></realm-name>
  </login-config>


  <security-role>
      <description/>
      <role-name>*</role-name>
  </security-role>
  

/tomcat/conf/tomcat-users.xml:

 <role rolename="manager-gui"/>
 <user username="tomcat" password="og_s3cret" roles="manager-gui"/>
 <role rolename="opengrok"/>
 <user username="opengrok" password="opengrokcheck" roles="opengrok,tomcat,manager-script,manager-gui"/>

and readonly config:

<?xml version="1.0" encoding="UTF-8"?>
<java version="1.8.0_172" class="java.beans.XMLDecoder">
<object class="org.opengrok.indexer.configuration.Configuration" id="Configuration0">


 <void property="pluginDirectory">
  <string>/opengrok/dist/share/lib</string>
 </void>

 <void property="pluginStack">
       <void property="stack">
           <!-- get user cred from HTTP headers -->

           <void method="add">
               <object class="org.opengrok.indexer.authorization.AuthorizationPlugin">
                   <void property="name">
                       <string>opengrok.auth.plugin.UserPlugin</string>
                   </void>
                   <void property="flag">
                       <string>REQUISITE</string>
                   </void>
                   <void property="setup">
                       <void method="put">
                            <string>decoder</string>
                            <string>opengrok.auth.plugin.decoders.HttpBasicAuthHeaderDecoder</string>
                       </void>
                   </void>
               </object>
           </void>


           <void method="add">
               <object class="org.opengrok.indexer.authorization.AuthorizationPlugin">
                   <void property="forProjects">
                           <void method="add">
                               <string>opengrok</string>
                           </void>
                   </void>
                   <void property="name">
                       <string>opengrok.auth.plugin.UserWhiteListPlugin</string>
                   </void>
                   <void property="flag">
                       <string>REQUIRED</string>
                   </void>
                   <void property="setup">
                       <void method="put">
                            <string>file</string>
                            <string>/opengrok/etc/whitelist.txt</string>
                       </void>
                   </void>
               </object>
           </void>

       </void>
 </void>
</object>
</java>

Everything is applied correctly. I can authenticate to tomcat app and opengrok can do reindex. However tafter indexing there is nothing in web ui. No porjects are shown in the web page. Without authentication it works well. Do You have any suggestions or ideas how should I modify my config?

[kasiapetka]

It is weird because the debug logs show that all POST/GET/DELETE calls to localhost:8080 api are successful. Also if i curl the localhost from inside the container i can get the list of projects.

I wonder if that is because i have only basic auth configured in my read only config file?

Should I also have the LDAP plugin there? like this:
https://github.com/oracle/opengrok/wiki/Authorization-plugins#ldap-setup

I cant really understand the auth approach here.

[vladak]

Couple of notes:

• The Docker environment might obscure this.
• The LDAP is definitely not needed if you do not need LDAP based authorization.
• check whether the projects are actually marked as indexed in the web app
  • can be done via the https://opengrok.docs.apiary.io/#reference/0/project-metadata/returns-the-property-value API (indexed is the property name)
  • if a project is not marked as indexed, it will not be shown/available in the webapp
• run Tomcat with increased log level for org.opengrok and opengrok.auth and see what happens on requests from both the indexer and regular clients

[kasiapetka]

Actually i managed to fix this issue. The problem was that using Your plugin for basic auth (read only configuration file) made the change of permissions in /opengrok/etc/configuration.xml from:
-rw-r--r--
to:
-rw-------
https://github.com/oracle/opengrok/wiki/Authorization-based-on-HTTP-Basic-Authentication

it was then to possible for the tomcat app to read the projects from the configuration and how them to the screen.

Therefore exactly as in the example:
#2875

code does not work.

The issue can be closed as I just removed Your plugin and just used the setup in the tomcat (tomcat users, server and web xmls).

[vladak]

I don't think any of the plugins or tools change the permissions of the configuration file. It depends on the process umask that runs the indexer command.