add buddy auth

[tomatolog]

Proposal:

at the https://github.com/manticoresoftware/manticoresearch/compare/wip_auth daemon uses HTTP Basic access authentication schema. That is why Buddy can not query daemon in that version and to fix that I disabled all the authentication check for buddy requests. That check of the buddy request is done via HTTP header field User-agent: Manticore Buddy.

We need to think and implement proper access authentication for the Buddy to work with the daemon.

Checklist:

^{To be completed by the assignee. Check off tasks that have been completed or are not applicable.}

• Implementation completed
• Tests developed
• Documentation updated
• Documentation reviewed
• Changelog updated
• OpenAPI YAML updated and issue created to rebuild clients

[tomatolog]

I see the options for this feature:

• daemon generates user and password and pass it into Buddy start cli then buddy sends it as a HTTP Basic access authentication schema for every requests back into daemon.
• daemon generates Bearer token and pass it into Buddy start cli then buddy sends for every requests back into daemon.

[tomatolog]

at the manticoresoftware/manticoresearch@4ea2737 I added support of the Authorization: Bearer UTgvd8Ph+Cmwu4P9eMLBZSjYBZ4= and also fixed buddy start as:

• daemon creates system.buddy user if the daemon starts with the any user defined at the auth_user_file
• pass the token into buddy child process via environment variable BUDDY_TOKEN

daemon expect all buddy requests to have header with the Bearer auth like

Authorization: Bearer UTgvd8Ph+Cmwu4P9eMLBZSjYBZ4=

After BUddy got fixed you could disable buddy requests bypass by set env var MANTICORE_BUDDY_AUTH_CHECK=1 and starting the daemon. This way daemon will check that buddy request has auth token and the token got matched to the buddy user.

ie

• you have to create .htpasswd file with the standard linux tool and add at least one user there
• set searchd config option auth_user_file = path_to/.htpasswd
• fix the buddy to use BUDDY_TOKEN from the env variable
• make sure if the daemon starts with the env var MANTICORE_BUDDY_AUTH_CHECK=1 buddy requests got passed well

buddy should work in both modes

• if BUDDY_TOKEN at the env variable is set then add Authorization: Bearer token header to all requests
• if no BUDDY_TOKEN at the env variable is set then does not use any Authorization header

[donhardman]

Closing as done and merged

• manticoresoftware/buddy-core@ab8e9a8
• 0bfc4a6

[sanikolaev]

Reopening to complete the checklist

[donhardman]

Let's write tests to make sure it works. We can add them to the authentication pull request: manticoresoftware/manticoresearch#2828

The Buddy changes are already in master.

The flow:

1. Generate password

echo "password" | htpasswd -s -i /tmp/.htpasswd user

2. Setup daemon config to have

auth_user_file = /tmp/.htpasswd

3. Validate that Buddy requests work with AUTH enabled (auth_user_file string) and without it in daemon mode