fix: allow requests to /api/* without authentication

[vincentgna]

Problem

If WebAuthentication is enabled, API Endpoints can't be hit without Basic Auth on top of API Secret.

Not sure if this is by design, but I'd assume API Tokens should be decoupled from the WebAuthentication?

Expected

curl -vH "X-Atlantis-Token: ${ATLANTIS_API_SECRET}" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json"  \
  http://localhost:4141/api/plan \
  -d '{ "repository": "...","ref":"...","type":"...","projects":["..."]}'
 > OK

Actual

curl -vH "X-Atlantis-Token: ${ATLANTIS_API_SECRET}" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json"  \
  http://localhost:4141/api/plan \
  -d '{ "repository": "...","ref":"...","type":"...","projects":["..."]}'
 > Unauthorized

Work Around:

curl -vH "X-Atlantis-Token: ${ATLANTIS_API_SECRET}" \
  -H "Authorization: Basic ${ATLANTIS_BASIC_AUTH_BASE64}" 
  -H "Accept: application/json" \
  -H "Content-Type: application/json"  \
  http://localhost:4141/api/plan \
  -d '{ "repository": "...","ref":"...","type":"...","projects":["..."]}'
> OK

Related to:

• Add a programmatic API #937
• fix: allow requests to /healthz without authentication #1896

[vincentgna]

I assumed the APIController was handling all routes prefixed with /api/ (which is the case today)

atlantis/server/server.go

Lines 829 to 830 in b15b5dc

	s.Router.HandleFunc("/api/plan", s.APIController.Plan).Methods("POST")
	s.Router.HandleFunc("/api/apply", s.APIController.Apply).Methods("POST")

but is this a safe assumption, or should we explicitly only allow api/plan and /api/apply for now? I understand the API Token authentication right now is quite KISS

[jamengual]

I think this was on purpose but it was build a while ago what do you think @lilincmu

[vincentgna]

there are no docs, so it was a bit frustrating for me trying this out :) - which is why I also linked it into the Issue tracking the feature for anyone else hitting the same problem

[jamengual]

PR to update the docs is always welcome.

…

On Wed, Aug 17, 2022 at 9:34 PM Vincent ***@***.***> wrote: there are no docs, so it was a bit frustrating for me trying this out :) - which is why I also linked it into the Issue tracking the feature for anyone else hitting the same problem — Reply to this email directly, view it on GitHub <#2455 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAQ3ERDHWVAR24ER47XNMX3VZW4PHANCNFSM563UYS3A> . You are receiving this because your review was requested.Message ID: ***@***.***>

[vincentgna]

PR to update the docs is always welcome.

I realise that, and I thought to do it in a separate PR once I got to play and understand this PoC a bit better, I went through all the discussion on the feature and I see no mention of requiring both basic auth and api token, but let's wait for @lilincmu advice on this.

but thanks for the suggestion @jamengual !

[lilincmu]

The implementation of #997 didn't take WebAuthentication into consideration, since its first draft was created before the PR of WebAuthentication. I can see the name api-secret could be confusing to users, who now might assume they only need to choose either authentication, the X-Atlantis-Token or Basic Auth, in order to make successful API requests, while in reality they have to use X-Atlantis-Token anyways if they want to make plan/apply API requests.

I think it makes sense to bypass the basic auth for plan/apply for now, since the requests will be "authenticated" by X-Atlantis-Token eventually. However, I don't know if any user would expect the opposite, i.e., when basic auth is enabled, any requests made to Atlantis, including plan/apply, should be authenticated by basic auth.

@vincentgna Maybe we can let this PR sit for a while and see what the community thinks? If no one responds by next week I can merge it in.

[vincentgna]

FYI, moving authentication (SSO) to reverse proxy kind of resolves this issue for our use case (it was a planned to do)