I can't figure out why after deploying this template I don't see any Authorizer for this API under the "Authorizers" tab on AWS console.
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
Description here
Globals:
Function:
Timeout: 3
Resources:
ProductGet:
Type: AWS::Serverless::Function
Properties:
CodeUri: ./
Handler: product-get.lambda_handler
Runtime: python3.8
Role: "particular role here"
Events:
ProductGet:
Type: Api
Properties:
Path: /product-get
Method: post
Auth:
Authorizers:
MyCognitoAuth:
UserPoolArn: "user pool arn here"
AuthType: "COGNITO_USER_POOLS"
DefaultAuthorizer: MyCognitoAuth
Figured out it.
You cannot define authorizers in "Events" section.
If your API needs an authorizer, you'll have to define that API as a separate resource and link it to the events using APIid.
Sample code below.
MyApi:
Type: AWS::Serverless::Api
Properties:
StageName: Prod
Auth:
DefaultAuthorizer: MyCognitoAuth # OPTIONAL
Authorizers:
MyCognitoAuth:
Type: COGNITO_USER_POOLS
# Can also accept an array
UserPoolArn: "user pool arn here"
ProductGet:
Type: AWS::Serverless::Function Properties:
CodeUri: ./
Handler: product-get.lambda_handler
Runtime: python3.8
Role: 'role ARN here'
Events:
ProductGet:
Type: Api
Properties:
Path: /product-get
Method: post
RestApiId: !Ref MyApi #This is how you need to refer to your API
Auth:
Authorizer: MyCognitoAuth
Related
My Web API method returns a binary PDF file in the response body and I've set this in the swagger file in the Custom Connector of Power Automate. However, despite the output being a binary PDF file AND that the property type is "file", the Test function in the Custom Connector UI still thinks its returning a "string" even through it clearly isn't!
Question: Any ideas what I'm doing wrong to make the tester think it's a string?
Here is a screenshot of the issue:
Here is my swagger for the Web API method (take note of the 200 response of schema: {type: file, format: binary}:
swagger: '2.0'
info: {title: xxxx, version: '1.0', description: xxxx}
host: xxxx.azurewebsites.net
basePath: /api
schemes: [https]
consumes: []
produces: []
paths:
/FrontPageGenerator:
post:
description: xxxx
operationId: FrontPageGenerator
summary: FrontPageGenerator
parameters:
- name: body
in: body
required: true
schema: {type: string}
consumes: [application/json]
produces: [application/json, application/pdf]
responses:
'200':
description: Successfully generated composite PDF file
schema: {type: file, format: binary}
'400':
description: Invalid input
schema: {$ref: '#/definitions/GenericJson'}
examples:
application/json: {message: No body}
'406':
description: Not Acceptable Accept Type
schema: {$ref: '#/definitions/BasicError'}
examples:
application/json: {message: Not Acceptable}
definitions:
BasicError:
type: object
properties:
message: {type: string}
GenericJson: {type: object}
In .Net Core 3.1, I found that it could not read the optional claim from Azure AD - ipaddr. Anyone have idea?
Identity token: XXX
Identity token: System.Security.Claims.Claim[]
Claim type: acct - Claim value: 0
Claim type: http://schemas.microsoft.com/claims/authnmethodsreferences - Claim value: pwd
Claim type: auth_time - Claim value: 1592477364
Claim type: name - Claim value: tester
Claim type: http://schemas.microsoft.com/identity/claims/objectidentifier - Claim value: 9190dd08-eb99-4def-8b0e-a0a9488c650a
Claim type: sid - Claim value: dd60ea4e-cc4f-4668-aee0-393ffb3e4dc0
Claim type: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier - Claim value: IUUXhcy8YnK-X5x4Mxwvtxdi8H74eANcTnZj2ZmQxV4
Claim type: tenant_ctry - Claim value: HK
Claim type: tenant_region_scope - Claim value: AS
Claim type: http://schemas.microsoft.com/identity/claims/tenantid - Claim value: xxx30ae3-9092-49c9-bf6d-d74f680615e4
Claim type: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name - Claim value: tester01#xxx.onmicrosoft.com
Claim type: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn - Claim value: tester01#xxx.onmicrosoft.com
Claim type: uti - Claim value: YHjG3-pwckizlnGrWZhzAA
Claim type: xms_pl - Claim value: zh-HK
Claim type: xms_tpl - Claim value: en
As you see here OpenIdConnectOptions.cs, it says:
ClaimActions.DeleteClaim("ipaddr");
That means that it will be deleted by the handler. You need to do
write something like:
options.ClaimActions.Remove("ipaddr");
To make sure The OpenIDConnect handler does not remove that claim.
I have a working ELK stack connected to Redis.
I also have a working stateless Symfony 4 application and I want to send all the production logs to my Redis.
I know Monolog has a Redis handler, but I don't know how I'm supposed to tweak the config/prod/monolog.yaml file to accomplish this of if there’s another approach.
This is how it looks right now:
monolog:
handlers:
main:
type: fingers_crossed
action_level: error
handler: nested
excluded_http_codes: [404]
nested:
type: stream
path: "php://stderr"
level: debug
console:
type: console
process_psr_3_messages: false
channels: ["!event", "!doctrine"]
deprecation:
type: stream
path: "php://stderr"
deprecation_filter:
type: filter
handler: deprecation
max_level: info
channels: ["php"]
The approach I took was, first installing the predis client:
composer require predis/predis
Then create a custom service class that extends the RedisHandler class that comes with the Monolog package:
namespace App\Service\Monolog\Handler;
use Monolog\Handler\RedisHandler;
use Monolog\Logger;
use Predis\Client as PredisClient;
class Redis extends RedisHandler
{
public function __construct( $host, $port = 6379, $level = Logger::DEBUG, $bubble = true, $capSize = false)
{
$predis = new PredisClient( "tcp://$host:$port" );
$key = 'logstash';
parent::__construct($predis, $key, $level, $bubble, $capSize);
}
}
Next, activate the service we just created on the services.yml config file:
services:
monolog.handler.redis:
class: App\Service\Monolog\Handler\Redis
arguments: [ '%redis.host%' ]
Be sure the parameter redis.host is set and points to your Redis server. In my case, my parameter value is the IP of my Redis server.
I added other parameters to the class like port and log level. You can set it at the moment of instantiating your service like with the host parameter.
Finally, configure your custom log handler service in your monolog.yaml config file. In my case, I need it only the production logs with the config as follow:
handlers:
custom:
type: service
id: monolog.handler.redis
level: debug
channels: ['!event']
I have the next problem with Sonata Media:
I'm trying to use the Rackspace CDN for uploading images:
My config file looks like this based on current documentation:
cdn:
server:
path: %cdn_url%
filesystem:
local:
directory: %kernel.root_dir%/../web/uploads/media
create: false
rackspace:
url: %rackspace.opencloud.host%
secret:
username: %rackspace.opencloud.username%
apiKey: %rackspace.opencloud.api_key%
region: LON
containerName: projectName
create_container: false
replicate:
master: sonata.media.adapter.filesystem.opencloud
slave: sonata.media.adapter.filesystem.local
And on providers config:
providers:
image:
filesystem: sonata.media.filesystem.replicate
cdn: sonata.media.cdn.server
resizer: sonata.media.resizer.square
allowed_extensions: ['jpg', 'png', 'gif', 'jpeg']
allowed_mime_types: ['image/pjpeg','image/jpeg','image/png','image/x-png', 'image/gif']
The problem is(how I discovered this bug)if Rackspace is down or incorrect username/password are provided on every page of the app I'm getting this answer:
Client error response [status code] 401 [reason phrase] Unauthorized [url] https://lon.auth.api.rackspacecloud.com/v2.0/tokens
This is because Gaufrette Opencloud tries to create a connection on Kernel load.
The quickest solution as a temporary fix was to create a compiler pass and check if the authenticate method returns false then replace argument 0 for replicate definition with the local filesystem adaptor.
My questions are:
How can I avoid creating the Rackspace connection on Kernel Load?
In case Rackspace is down how can I swap between Rackspace or other adapter(local or other ftp server)
Thank you in advance and please in case there are not sufficient information provided please leave a comment.
Apparently there is a solution for lazy loading implemented in Gaufrette: https://github.com/KnpLabs/KnpGaufretteBundle/issues/72
All I had to do is:
sonata.media.adapter.open_stack:
class: OpenCloud\Rackspace
arguments: [ %rackspace.opencloud.host%, { username: %rackspace.opencloud.username%, apiKey: %rackspace.opencloud.api_key% }]
sonata.media.adapter.object_store_factory:
class: Gaufrette\Adapter\OpenStackCloudFiles\ObjectStoreFactory
arguments: [ #sonata.media.adapter.open_stack, "LON", ""]
sonata.media.adapter.filesystem.lazyopencloud:
class: Gaufrette\Adapter\LazyOpenCloud
arguments: [ #sonata.media.adapter.object_store_factory, %rackspace.opencloud.container_name%]
And change replicate master to sonata.media.adapter.filesystem.lazyopencloud
Hope it helps :)
I've defined a service to handle logging of records with specific text (e.g. "matched route" and such). I'm successfully writing those records out to a separate file.
However, what I want to avoid is writing them a second time to the primary log file. I've tried tagging my service with a channel and telling the main stream log to ignore that channel, but it occurs to me that it won't work since, in essence, the main stream logging handler matches everything.
Any advice on how to proceed?
EDIT: Here's what I have at the moment:
monolog:
channels: ['noise']
handlers:
eliminate_noise_logger:
type: service
id: common.eliminate_noise_logger
channels: ['noise']
streamed:
type: stream
level: info
path: "%kernel.logs_dir%/%kernel.environment%.log"
formatter: monolog.formatter.session_request
channels: ['!noise']
console:
type: console
verbosity_levels:
VERBOSITY_NORMAL: INFO
And my services definition:
common.eliminate_noise_logger:
class: path\to\class
arguments: ["%kernel.logs_dir%/%kernel.environment%.noise.log", ["str1", "str2", "str3"]]
tags:
- { name: monolog.logger, channel: noise }
This is how I do
#config.yml
monolog:
use_microseconds: false
channels: ['secondary']
handlers:
main:
path: %kernel.logs_dir%/%kernel.language%/%kernel.environment%.log
type : fingers_crossed
action_level : error
handler : nested
channels : ['!secondary']
secondary:
type: rotating_file
max_files: 10
path: %kernel.logs_dir%/%kernel.language%/%kernel.environment%.secondary.log
level: info
channels: [secondary]