client_java icon indicating copy to clipboard operation
client_java copied to clipboard

How to provide password when using basic Auth

Open sumitbaurai opened this issue 4 years ago • 2 comments

Hi, I am trying to push metrics towards basic auth authenticated Push Gateway. But I am running into 401 - Unauthorized

So I installed a local push gateway and configured it with basic authentication:

The password is encrypted as described here : https://github.com/prometheus/exporter-toolkit/blob/master/docs/web-configuration.md#about-bcrypt

basic_auth_users:
  pushgateway: $2y$10$d6t8zGfPMZBLFLpoClFcReK6z4gxkDr2H8jnEfOaUpjpLX4.tbyTS%

In my code, I specify the username and password as follows:

this.pushGateway.setConnectionFactory(new BasicAuthHttpConnectionFactory("pushgateway","<password>"));

The password above is the one that was encrypted and put into push gateway config.

The documentation here (https://github.com/prometheus/client_java#with-basic-auth) does not mention anything about encrypting the password, the password is provided in plaintext.

Can someone please point out what am I missing?

--Regards Sumit Baurai

sumitbaurai avatar Jul 26 '21 12:07 sumitbaurai

PushGateway requires the username/password to be in cleartext.

https://github.com/prometheus/client_java/blob/master/simpleclient_pushgateway/src/main/java/io/prometheus/client/exporter/BasicAuthHttpConnectionFactory.java

The password you provided $2y$10$d6t8zGfPMZBLFLpoClFcReK6z4gxkDr2H8jnEfOaUpjpLX4.tbyTS% is not encrypted, but hashed using bcrypt so there is no way to derive the cleartext password.

You will need to use use the cleartext password and secure the configuration file using OS-specific permissions.

dhoard avatar Sep 16 '21 22:09 dhoard

No solution is available. I propose we should close this issue.

dhoard avatar Sep 16 '21 22:09 dhoard

Closing.

Per code at https://github.com/prometheus/client_java/blob/master/simpleclient_pushgateway/src/main/java/io/prometheus/client/exporter/BasicAuthHttpConnectionFactory.java PushGateway requires a plaintext password.

dhoard avatar Apr 25 '23 03:04 dhoard