feat(http source): Digest access authentication #22101
Conversation
github-actions
bot
added
domain: sources
There was a problem hiding this comment.
Thanks @average-gary for this contribution. Since there's no issue attached, can you explain the motivation for this PR in the summary? E.g. what use case does this change enable?
| } | ||
|
|
||
| tokio::time::timeout(inputs.timeout, client.send(request)) | ||
| .then({ |
There was a problem hiding this comment.
Can you extract this into a separate function? Or alternatively two, an extra one for the new is_digest block.
| /// Digest authentication. | ||
| /// | ||
| /// requires a round trip to the server to get the challenge and then send the response | ||
| Digest { |
There was a problem hiding this comment.
This is identical to Basic, I wonder if we can add a new field digest: bool that defaults to false. cc @jszwedko for UX review 🙏
There was a problem hiding this comment.
👍 The fields are identical, but given users are likely to think about these mechanisms differently (rather than digest authentication being a specialized form of basic authentication) I think having them separate makes sense.
| } | ||
| let ha1 = format!("{:x}", md5::Md5::digest(format!("{}:{}:{}", username_inner, realm, user_password_inner.inner()))); | ||
| let ha2 = format!("{:x}", md5::Md5::digest(format!("GET:{}", uri.path()))); | ||
| let cnonce = "00000001"; // TODO: use rng for client nonce |
There was a problem hiding this comment.
Do you plan to address this in this PR?
There was a problem hiding this comment.
Thank you for pointing this out. I will update to add this for this PR.
pront
added
the
meta: awaiting author
I have thousands of machines whose firmware uses this auth digest method and I wanted to see if I could make vector a viable option for scraping data/metrics from the machine. This PR was my PoC at enabling it. |
| @@ -295,6 +299,20 @@ pub enum Auth { | |||
| /// The bearer authentication token. | |||
| token: SensitiveString, | |||
| }, | |||
| /// Digest authentication. | |||
| /// | |||
| /// requires a round trip to the server to get the challenge and then send the response | |||
There was a problem hiding this comment.
| /// requires a round trip to the server to get the challenge and then send the response | |
| /// Challenge and response authentication as specified by [RFC7616](https://httpwg.org/specs/rfc7616.html). |
Summary
Adding rfc2617 to http source
Change Type
Is this a breaking change?
How did you test this PR?
The datacenter/compute infrastructure I manage uses this authentication method for its endpoint. I successfully ran vector against one of these devices and received expected results back.
Does this PR include user facing changes?
Checklist
Cargo.lock), pleaserun
dd-rust-license-tool writeto regenerate the license inventory and commit the changes (if any). More details here.References
None.