RDepot API Authentication Issue: 401 Unauthorized Error with Access Token

Hello,

I have successfully installed RDepot using a docker-compose file on a test server – everything works fine, thank you. I’m now trying to work with the API, but I’m stuck because all my attempts result in a 401 error (both via Swagger and when using a curl command from the server).

{"status":"ERROR","code":401,"message":"Cannot perform this request because user is not authenticated.","messageCode":"error.user.not.authenticated","data":null}

My first question is: is the expected request as follows?

curl -X GET 'http://xx.xx.xx.xx.xx/backend/api/v2/manager/repository-maintainers?page=0&size=20' \
  -H 'accept: application/json' \
  -H 'X-Auth-Token: <my_token>'

or should it be this one?

curl -X GET 'http://xx.xx.xx.xx.xx/backend/api/v2/manager/repository-maintainers?page=0&size=20' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer <my_token>'

My second question is: does the <my_token> correspond to an “access token” generated from the web interface?

Below is the docker-compose file I’m using:

services:
  proxy:
    image: nginx:alpine
    container_name: oa-rdepot-proxy
    restart: unless-stopped
    volumes:
    - ./docker/compose/proxy/nginx.conf:/etc/nginx/nginx.conf:ro
    - ./docker/compose/proxy/rdepot.conf:/etc/nginx/sites-enabled/rdepot:ro
    - ./repository:/opt/rdepot/repo/:ro
    - ./logs:/var/log/nginx/
    ports:
    - ${RDEPOT_PORT:-80}:80
    depends_on:
    - backend
    - repo
    - frontend
    networks:
    - oa-rdepot
  db:
    image: postgres:alpine
    restart: unless-stopped
    hostname: oa-rdepot-db
    container_name: oa-rdepot-db
    environment:
    - POSTGRES_DB=rdepot
    - POSTGRES_USER=rdepot
    - POSTGRES_PASSWORD=mysecretpassword
    networks:
    - oa-rdepot
    volumes:
    - ./pgdata:/var/lib/postgresql/data
  backend:
    image: openanalytics/rdepot-app:2.5.1
    restart: unless-stopped
    hostname: oa-rdepot-backend
    container_name: oa-rdepot-backend
    user: "2000:2000"
    volumes:
    - ./repositories:/opt/rdepot/repositories/
    - ./snapshots:/opt/rdepot/generated/
    - ./queue:/opt/rdepot/new/
    - ./repository/declared_repositories:/opt/rdepot/declared_repositories
#    - ./repository:/opt/rdepot/
    - ./docker/compose/backend/application.yaml:/opt/rdepot/application.yml
    networks:
    - oa-rdepot
    depends_on:
    - db
    environment:
    - DB_URL=jdbc:postgresql://oa-rdepot-db:5432/rdepot
    - DB_USERNAME=rdepot
    - DB_PASSWORD=mysecretpassword
    - ALLOWED-ORIGIN=http://xx.xx.xx.xx.xx:${RDEPOT_PORT:-80}
    healthcheck:
      test: ["CMD-SHELL", "if [ \"$$(curl -I localhost:8080/backend 2>/dev/null | grep HTTP/1.1 | cut -d\" \" -f2)\" != \"302\" ]; then exit 1; else exit 0; fi;"]
      interval: 10s
      timeout: 10s
      retries: 10
  repo:
    user: "2000:2000"
    image: openanalytics/rdepot-repo:2.5.1
    restart: unless-stopped
    hostname: oa-rdepot-repo
    container_name: oa-rdepot-repo
    volumes:
    - ./repository:/opt/rdepot/
    - ./docker/compose/repo/application.yaml:/opt/repo/application.yml
    networks:
    - oa-rdepot
  frontend:
    container_name: oa-rdepot-frontend
    image: openanalytics/rdepot-client:2.5.1
    restart: unless-stopped
    networks:
    - oa-rdepot
    environment:
    - VITE_DEV_MODE=false
    - VITE_LOGIN_SIMPLE=true
    - VITE_LOGIN_OIDC=false
    - VITE_URL_PREFIX=/
    - VITE_SERVER_ADDRESS=http://xx.xx.xx.xx.xx:${RDEPOT_PORT:-80}/backend
networks:
  oa-rdepot:

And here is the backend/application.yml I am using:

api-token:
  secret: SecretKeyToGenJWTs
  issuer: RDepot
  audience:
  - RDepot
  lifetime: 60

allowed-origin: "*"

server:
  servlet:
    context-path: /backend

default-user-configuration:
  language: en-US
  theme: dark
  page-size: 10
  supported-languages:
  - en-US
  - pl-PL
  supported-themes:
  - light
  - dark

declarative: true
additional-repository-configs:
  paths:
  - /opt/rdepot/declared_repositories

logging:
  level:
    eu:
      openanalytics:
        rdepot: INFO

# Email related properties
email:
  enabled: false
  password:
  username:
  from:
  smtp:
    host:
    port:
    auth:
    starttls:

# Authentication related properties
app:
  authentication: simple
  simple:
    users:
    - login: einstein
      password: testpassword
      name: Albert Einstein
    - login: tesla
      password: testpassword
      name: Nicolas Tesla
    - login: galieleo
      password: testpassword
      name: Galileo Galilei
    - login: newton
      password: testpassword
      name: Isaac Newton
    - login: newbie
      password: testpassword
      name: New User
    - login: doe
      password: testpassword
      name: John Doe
    default:
      admins:
      - einstein

# Database related properties
db:
  driver: org.postgresql.Driver
  url: jdbc:postgresql://oa-rdepot-db:5432/rdepot
  username: rdepot
  password: mysecretpassword

# Hibernate related properties
hibernate:
  dialect: org.hibernate.dialect.PostgreSQLDialect
  show_sql: false

# Liquibase related properties
spring:
  liquibase:
    url: jdbc:postgresql://oa-rdepot-db:5432/rdepot
    user: rdepot
    password: mysecretpassword
    enabled: true

springdoc:
  pathsToMatch: /api/v2/**
  api-docs:
    path: /v2/api-docs
  swagger-ui:
    path: /docs/api.html
    disable-swagger-default-url: false
    url: /v2/api-docs
    display-query-params: true
  default-produces-media-type: application/json

Thank you for your help.

Hi Vincent,

In order to use the API with RDepot-managed access tokens (i.e. generated from the web interface), the API expects the token to be used as the password, using HTTP basic authentication.

Can you try the following:

curl -X GET 'http://xx.xx.xx.xx.xx/backend/api/v2/manager/repository-maintainers?page=0&size=20' \
  -H 'accept: application/json' \
  -H 'Authorization: Basic <username_token_base64>'

where <username_token_base64> corresponds to username:token base64 encoded.

For example, a user with username my_user and token value abc123 will need to use:

curl -X GET 'http://xx.xx.xx.xx.xx/backend/api/v2/manager/repository-maintainers?page=0&size=20' \
  -H 'accept: application/json' \
  -H 'Authorization: Basic bXlfdXNlcjphYmMxMjM='

Kind regards,
Jonas

We added some documentation on the authentication options for the API here: API | RDepot.

Hope this helps!

Kind regards,
Jonas

thanks I will have a look !

regards