question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Import fails for resource-servers containing too many (over 20) scopes.

See original GitHub issue

Description

Import fails for resource-servers containing too many scopes.

Reproduction

We have API definition similar to this

`
{
  "name": "SomeAPI",
  "identifier": "https://someapi.io",
  "signing_alg": "RS256",
  "skip_consent_for_verifiable_first_party_clients": true,
  "enforce_policies": true,
  "scopes": [
    {
      "value": "read:keys",
      "description": "Read or get an encryption key"
    },
    ....  20 more scopes
    {
      "value": "read:data",
      "description": "Read data"
    }
  ]
}
`

(the scopes are of course correct). When importing, we end up with error Payload validation error: 'Expected type object but found type string' on property scopes[21]. (also) Payload validation error: 'Expected type object but found type string' on property scopes[20]. (this is deployment setup that used to work for years, but now suddenly fails. It also works fine when calling the management API directly, through curl or the API web).

I’ve debugged the code locally and I think I found the culprit, though I am not sure who is the guilty party here (CLI, auth0 package, or their dependencies). Basically, the CLI uses the auth0 library’s rest client, which in turns uses superagent, and that internally uses fast-safe-stringify package to serialize the json data. This is called with default options, which include edgesLimit set to 20, and thus the json is serialized like this "{\"name\":\"SomeAPI\",\"signing_alg\":\"RS256\",\"skip_consent_for_verifiable_first_party_clients\":true,\"enforce_policies\":true,\"scopes\":[{\"value\":\"read:keys\",\"description\":\"Read or get an encryption key\"},......{\"value\":\"lastWorkingScope\",\"description\":\"LastWorkingScope\"},\"[...]\",\"[...]\"]}" (i.e. the last 2 entries get replaced with "[...]")

Environment

auth0-deploy-cli@7.2.1 auth0@2.36.1 superagent@5.3.1 fast-safe-stringify@2.1.0

Node version 12.18.2 running on windows (local test) or linux (CI)

Issue Analytics

  • State:closed
  • Created 2 years ago
  • Comments:5

github_iconTop GitHub Comments

1reaction
j-m-xcommented, Sep 7, 2021

This: https://github.com/davidmarkclements/fast-safe-stringify/issues/57 seems to be the problem, hopefully a new release will come soon, till then, simply revert back to fast-safe-stringify@2.0.8 locally, a bit of hack, but it works.

0reactions
Wintermoosecommented, Sep 9, 2021

I guess no special action in this repo is needed, so I am closing this. Thanks!

Read more comments on GitHub >

github_iconTop Results From Across the Web

Document env variable format #173 - auth0/auth0-deploy-cli
I considered the workaround of creating a temporary config.json file with values from the environment variables. This fails due to #172.
Read more >
mapping OAuth2 claims with roles to secure Resource Server ...
So I'm using the Spring Boot 2.1.8.RELEASE which for instance uses Spring Security 5.1.6.RELEASE . As Authorization Server I'm using Keycloak.
Read more >
Using Spring Boot for OAuth2 and JWT REST Protection - Toptal
Let's now move on the original problem to set up an application implementing OAuth2 and JWT with Spring Boot. While multiple server-side OAuth2...
Read more >
Spring Security with JWT: OAuth 2 Resource Server
Typically the endpoints of a resource server are protected based on the Oauth2 scopes and user roles. Please refer to this for more...
Read more >
Import/Export Tenant Configuration to Directory Structure - Auth0
Learn how to use the directory option for importing and exporting tenant configurations with the Auth0 Deploy CLI Tool.
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found