Working behind a corporate proxy

[nicoduj]

Hi,

we are trying to use FGA in node.js behind a corporate proxy. After setting HTTP_PROX / HTTPS_PROXY env variables, we still have issues on certificate chain validation.

Is there any documentation / way to set correctly the proxy (credentials and certificate chain to trust) ?

Thanks for any help on this.

[ewanharris]

Hey @nicoduj, based on the statusText being handshakeFailed I think you might also need to provide the CA cert that your proxy uses via the NODE_EXTRA_CA_CERTS environment variable.

I would also suggest only setting the HTTPS_PROXY environment variable as I believe that it's possible for axios to have issues when setting both

[rhamzeh]

@nicoduj would doing the following (with no changes to the SDK) work for you:

export NODE_EXTRA_CA_CERTS=~/PATH/TO/custom_certificate.cer

[nicoduj]

Hi, like I said providing through node env variable the certificate does not work. I only manage to make it through a custom https agent by code, and thus modifying the SDK in order to handle it .

[nicoduj]

Hi,
I made more tests, and can't provide through env variable to axios the certs. Moreover, since our proxy is http , we are suffering from this bug axios/axios#6320

I decided to go the long way and to create an instance of Axios myself, using also https-proxy-agent to workaround the issue.

However , inside FGA, it seems that a custom axios instance is not used / propagated to credentials.js, that also used always the default axios instance to get the token.

I will try to do a pull request as soon as I have time to validate the whole thing.

[nicoduj]

I did not notice but it is an auto genertaed sdk .. so It will be harder than I expected and won't have time to get into it .

[nicoduj]

Ok, I managed to have something working but I had to change auto generated code ...

What I did on my side :

1/ Create my own instanc eof axios, with httpsProxyAgent and the ca file

  let caCrt = '';
  try {
    caCrt = fs.readFileSync('./ca-bundle3.crt')
  } catch (err) {
    console.log('Make sure that the CA cert file is named ca.crt', err);
  }

  const httpsAgent = new HttpsProxyAgent("http://proxy.matmut.fr:80", { ca: caCrt, keepAlive: true });
  const myAxios = axios.default.create({
    httpsAgent
  });
  const fgaClient = new OpenFgaClient(fgaClientConfig, myAxios);

2/Modify base.js to pass this instance to credentials object creation

this.credentials = credentials_1.Credentials.init(this.configuration, axios);

3/Modify Credential init static method to allow passthrough of the instanc to the constructor

    static init(configuration, axios = axios_1.default) {
        return new Credentials(configuration.credentials, axios);
    }
    constructor(authConfig, axios) {
        this.authConfig = authConfig;
        this.axios = axios;
        this.initConfig();
        this.isValid();
    }

4/ Modify RefreshAccessToken method to use the axios class instance and not the default one

                const response = yield (0, common_1.attemptHttpRequest)({
                    url: `https://${clientCredentials.apiTokenIssuer}/oauth/token`,
                    method: "post",
                    data: {
                        client_id: clientCredentials.clientId,
                        client_secret: clientCredentials.clientSecret,
                        audience: clientCredentials.apiAudience,
                        grant_type: "client_credentials",
                    },
                    headers: {
                        "Content-Type": "application/x-www-form-urlencoded"
                    }
                }, {
                    maxRetry: 3,
                    minWaitInMs: 100,
                }, this.axios);