Trouble getting an access token using OnBehalfOfParameters

Hi,
Do you have an example for validating the idToken?
I have a token from the Authentication header like this: "Bearer XXXXXXXXX" and I would like to create a filter like the AADAuthenticationFilter from spring boot using the msal library but I'm not sure how can I validate the token from the client ID.
What I've seen is that I need to get the access token from my id token but how can I do that using the ConfidentialClientApplication class?
After that I can create my principal using the token information like in the samples but how can I validate my token?
Thanks!

So this is what I have:
ConfidentialClientApplication clientApplication = ConfidentialClientApplication.builder(
        clientId, ClientCredentialFactory.create(clientSecret))
            .authority(authority).build();

Set<String> scopes = new HashSet<>(Arrays.asList(scope.split(" ")));
UserAssertion assertion = new UserAssertion(idToken);

OnBehalfOfParameters params = OnBehalfOfParameters.builder(scopes, assertion).build();
CompletableFuture<AuthenticationResult> future = clientApplication.acquireToken(params);

AuthenticationResult result = future.get();

But I'm getting a Casting error:
java.lang.ClassCastException: java.util.Collections$SingletonList cannot be cast to java.lang.String
	at com.nimbusds.oauth2.sdk.util.URLUtils.serializeParameters(URLUtils.java:103) ~[oauth2-oidc-sdk-5.64.4.jar:5.64.4]
	at com.microsoft.aad.msal4j.TokenRequest.toOauthHttpRequest(TokenRequest.java:240) ~[msal4j-0.2.0-preview.jar:0.2.0-preview]
	at com.microsoft.aad.msal4j.TokenRequest.executeOauthRequestAndProcessResponse(TokenRequest.java:88) ~[msal4j-0.2.0-preview.jar:0.2.0-preview]
	at com.microsoft.aad.msal4j.ClientApplicationBase.acquireTokenCommon(ClientApplicationBase.java:249) ~[msal4j-0.2.0-preview.jar:0.2.0-preview]
	at com.microsoft.aad.msal4j.AcquireTokenByAuthorizationGrantSupplier.execute(AcquireTokenByAuthorizationGrantSupplier.java:71) ~[msal4j-0.2.0-preview.jar:0.2.0-preview]
	at com.microsoft.aad.msal4j.AuthenticationResultSupplier.get(AuthenticationResultSupplier.java:77) [msal4j-0.2.0-preview.jar:0.2.0-preview]
	at com.microsoft.aad.msal4j.AuthenticationResultSupplier.get(AuthenticationResultSupplier.java:37) [msal4j-0.2.0-preview.jar:0.2.0-preview]
	at java.util.concurrent.CompletableFuture$AsyncSupply.run$$$capture(CompletableFuture.java:1590) [?:1.8.0_202]
	at java.util.concurrent.CompletableFuture$AsyncSupply.run(CompletableFuture.java) [?:1.8.0_202]
	at java.util.concurrent.CompletableFuture$AsyncSupply.exec(CompletableFuture.java:1582) [?:1.8.0_202]
	at java.util.concurrent.ForkJoinTask.doExec(ForkJoinTask.java:289) [?:1.8.0_202]
	at java.util.concurrent.ForkJoinPool$WorkQueue.runTask(ForkJoinPool.java:1056) [?:1.8.0_202]
	at java.util.concurrent.ForkJoinPool.runWorker(ForkJoinPool.java:1692) [?:1.8.0_202]
	at java.util.concurrent.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:157) [?:1.8.0_202]
java.util.concurrent.ExecutionException: java.lang.ClassCastException: java.util.Collections$SingletonList cannot be cast to java.lang.String
	at java.util.concurrent.CompletableFuture.reportGet(CompletableFuture.java:357)
	at java.util.concurrent.CompletableFuture.get(CompletableFuture.java:1895)
	at co.com.accessmanagement.web.security.MSALAuthenticationFilter.doFilterInternal(MSALAuthenticationFilter.java:100)
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
	at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:116)
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
	at org.springframework.security.web.csrf.CsrfFilter.doFilterInternal(CsrfFilter.java:100)
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
	at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:74)
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
	at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105)
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
	at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56)
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
	at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:215)
	at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:178)
	at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:357)
	at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:270)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:99)
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:92)
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:93)
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:200)
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:200)
	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)
	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:490)
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139)
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)
	at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:408)
	at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)
	at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:834)
	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1415)
	at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
	at java.lang.Thread.run(Thread.java:748)
Caused by: java.lang.ClassCastException: java.util.Collections$SingletonList cannot be cast to java.lang.String
	at com.nimbusds.oauth2.sdk.util.URLUtils.serializeParameters(URLUtils.java:103)
	at com.microsoft.aad.msal4j.TokenRequest.toOauthHttpRequest(TokenRequest.java:240)
	at com.microsoft.aad.msal4j.TokenRequest.executeOauthRequestAndProcessResponse(TokenRequest.java:88)
	at com.microsoft.aad.msal4j.ClientApplicationBase.acquireTokenCommon(ClientApplicationBase.java:249)
	at com.microsoft.aad.msal4j.AcquireTokenByAuthorizationGrantSupplier.execute(AcquireTokenByAuthorizationGrantSupplier.java:71)
	at com.microsoft.aad.msal4j.AuthenticationResultSupplier.get(AuthenticationResultSupplier.java:77)
	at com.microsoft.aad.msal4j.AuthenticationResultSupplier.get(AuthenticationResultSupplier.java:37)
	at java.util.concurrent.CompletableFuture$AsyncSupply.run$$$capture(CompletableFuture.java:1590)
	at java.util.concurrent.CompletableFuture$AsyncSupply.run(CompletableFuture.java)
	at java.util.concurrent.CompletableFuture$AsyncSupply.exec(CompletableFuture.java:1582)
	at java.util.concurrent.ForkJoinTask.doExec(ForkJoinTask.java:289)
	at java.util.concurrent.ForkJoinPool$WorkQueue.runTask(ForkJoinPool.java:1056)
	at java.util.concurrent.ForkJoinPool.runWorker(ForkJoinPool.java:1692)
	at java.util.concurrent.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:157)

What am I doing wrong?

URLUtils.serializeParameters(URLUtils.java:103) is expecting a Map<String, String[]> and its getting a Map<String, List> thats the problem

@afrancoc2000 are you using oauth2-oidc-sdk anywhere else in your project? It looks like you are loading oauth2-oidc-sdk-5.64.4.jar:5.64.4, but you'll need to bump this up to at least 6.0 to be compatible with msal4j. Starting with 6.0, they introduced a breaking change to support multi-valued parameters. (msal4j only works with oauth2-oidc-sdk version > 6.0)

@afrancoc2000 to answer your first question, we don't have any examples for validating a token, as msal4j is about acquiring tokens for a protected resources and not protecting those resources or validating tokens. Unfortunately, we don't have a Java middleware library to perform the latter tasks at the moment. If you google around,  you'll find some third party libraries that will help out with this.

@sangonzal the code I posted above is a good example on how to do authentication using the Bearer Token, you were right, the problem was the oauth2-oidc-sdk library I removed it and the flow started working.
I can add a class to the examples folder if you'd like.
I'm still having trouble with the flow though, when I generate a token using https://login.microsoftonline.com/common/oauth2/v2.0/token with grant type client_credentials I get a "AADSTS50013: Assertion failed signature validation. [Reason - The provided signature value did not match the expected signature value." error.
And when I do the same using a Bearer Token from the frontend I get a "AADSTS50034: The user account Microsoft.AzureAD.Telemetry.Diagnostics.PII does not exist in the 9188040d-6c67-4c5b-b112-36a304b66dad directory. To sign into this application, the account must be added to the directory." error.
I have read that the AADSTS50034 is because I'm using guest users, but I need them and in the front they can authenticate so still no idea.
Do you know what my problem could be?
Thanks

@afrancoc2000 could you elaborate on what your scenario looks like ?  Can you share a code snippet and/or a fiddler trace (instructions on how to capture) that would help with debugging?

@sangonzal sure this is what I'm doing:

first I have a frontend app in angular 5 that uses msal for javascript and I'm using the wrapper for angular to intercept the calls and get authenticated in the front using this.

I have a backend app in spring boot using spring security where I have some API methods. In the app I'm adding a filter to spring security adding the "on behalf flow" to authenticate using the msal library for compatibility between the front and back.

When the frontend needs a resource from the back it sends a request to the back using an header like this: Authentication=Bearer XXXXXXXXX this header is added by the msal javascript library when I authenticate.

The idea is to build a stateless authentication using msal on the backend and create the principal get roles and stuff from the access token.
This is the code:
SecurityAdapter
@EnableWebSecurity
@EnableGlobalMethodSecurity(securedEnabled = true, prePostEnabled = true)
public class SecurityAdapter extends WebSecurityConfigurerAdapter {

    @Autowired
    private MSALAuthenticationFilter aadAuthFilter;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
           SecurityContextHolder.setStrategyName(SecurityContextHolder.MODE_INHERITABLETHREADLOCAL);

        http.authorizeRequests()
            .antMatchers("/api/**").authenticated()
            .anyRequest().permitAll();

        http.csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());

        http.logout()
                .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
                .logoutSuccessUrl("/")
                .deleteCookies("JSESSIONID")
                .invalidateHttpSession(true);

        http.addFilterBefore(aadAuthFilter, UsernamePasswordAuthenticationFilter.class);
    }
}

MSALAuthenticationFilter
public class MSALAuthenticationFilter extends OncePerRequestFilter {
    private static final Logger log = LoggerFactory.getLogger(MSALAuthenticationFilter.class);

    private static final String TOKEN_HEADER = "Authorization";
    private static final String TOKEN_TYPE = "Bearer ";

    // Properties from the application.properties file like clientId, tenant and stuff.

    private static final String CURRENT_USER_PRINCIPAL = "CURRENT_USER_PRINCIPAL";
    private static final String CURRENT_USER_ACCESS_TOKEN = "CURRENT_USER_ACCESS_TOKEN";

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,
                                    FilterChain filterChain) throws ServletException, IOException {

        final String authHeader = request.getHeader(TOKEN_HEADER);
        UserPrincipal principal = (UserPrincipal) request.getSession().getAttribute(CURRENT_USER_PRINCIPAL);

        if (authHeader != null && authHeader.startsWith(TOKEN_TYPE)) {
            try {
                final String idToken = authHeader.replace(TOKEN_TYPE, "");

                ConfidentialClientApplication clientApplication = ConfidentialClientApplication.builder(
                        clientId,
                        ClientCredentialFactory.create(clientSecret))
                        .authority(authority)
                        .build();

                Set<String> scopes = new HashSet<>(Arrays.asList(scope.split(" ")));
                UserAssertion assertion = new UserAssertion(idToken);

                OnBehalfOfParameters params = OnBehalfOfParameters.builder(scopes, assertion).build();
                CompletableFuture<AuthenticationResult> future = clientApplication.acquireToken(params);

                AuthenticationResult accessToken = future.get();

                if (principal == null) {
                    principal = principalManager.buildUserPrincipal(idToken, accessToken);

                    request.getSession().setAttribute(CURRENT_USER_PRINCIPAL, principal);
                    request.getSession().setAttribute(CURRENT_USER_ACCESS_TOKEN, accessToken);
                }
                final Authentication authentication = new PreAuthenticatedAuthenticationToken(
                        principal,
                        null,
                        convertGroupsToGrantedAuthorities(principal.getUserGroups()));

                authentication.setAuthenticated(true);
                log.info("Request token verification success. {}", authentication);
                SecurityContextHolder.getContext().setAuthentication(authentication);

            }
            catch (MalformedURLException | InterruptedException | ExecutionException ex) {
                log.error("Failed to authenticate", ex);
                throw new ServletException(ex);
            }

        }
        filterChain.doFilter(request, response);
    }
}

I'm still working on the principal and the stateless parts but that is the general idea.

I don't think the problem is in the java code though, I think its the microsoft identity server because I tested the tokens using postman directly using this and I'm getting the same errors.
I have two tests the first using the token in the Authentication header, the one like Bearer XXXXXXX that one gives me a AADSTS50034 error.
The second one I'm generating an identity token for an external app using this and it gives me an AADSTS50013 error.
I'm a little lost in here I think this should work as I can authenticate in the front and I could authenticate before from java using the oauth flow but the backend is really a web API and needs to be authenticated with the Bearer token instead, so I can't use that aproach.

@afrancoc2000 So if I'm understanding correctly, user logs-ins to the front end app, which then calls the web API. You'd like to:

Make sure that only authenticated users can access the API
Assert some claims about the user making calls to the API (roles, etc)

In this case, msal4j is not the right library to be used here for validation of tokens. msal4j is used for acquiring tokens for protected resources, but not actually protecting resources. Instead, here you would want to either validate the tokens with another third party library or do it manually. Here is some information on how to do so
Lets say that now on top of protecting your API, you have to call another API (say for instance Microsoft Graph) from your your API (instead of the front end app), on behalf of the user. This is where msal4j, and more specifically the
on-behalf-of flow, would come in handy. You would use the first bearer token, create an user assertion, and exchange it for a second access token, then used to get access the second web API (Microsoft Graph in this instance) (This is essentially what you are doing in you code sample). More info about OBO flow here
Please let me know if I'm misunderstanding your scenario.

If OBO is trying to do, make sure that your web API is registered correctly. Here is an OBO sample written in .NET, but the app registration instructions should be the same for what you are trying to do.
What is the value that you are using for authority in your code?

@sangonzal You're right what I really want is to validate the token and get the role authorities I'm going to see the code you're giving me.
I did create almost all the example of the "On behalf of" flow" so I can still create a pull request with an example if you'd like.
For the authority I'm using is https://login.microsoftonline.com/{mytenant}
Thanks!

@sangonzal going further with my example, now after I validated the token that was given to me, I need to go to the graph API to get the user groups.
I'm using as authority "https://login.microsoftonline.com/{mytenant}" and as scope "openid user.read" and I'm getting this error:
AADSTS50034: The user account XXXXX does not exist in the {mytenant} directory. To sign into this application, the account must be added to the directory.

Do I have the properties wrong?
Thanks!

@afrancoc2000 Thanks, I am currently working on updating the web sample, which will have OBO.
Regarding the error you are running into, is the account that you are using registered in {mytenant}? Is the application also registered in {mytenant}? Is this happening for all users or just a subset?

@sangonzal yes both the app and the user are registered in the tenant, the user has been already authenticated in the frontend app with msal for javascript and the token has been validated.
It happens to all users.
I checked and I have User.Read permission for the https://graph.microsoft.com/ API in Azure Active Directory > App Registrations > MyApp > Api Permissions.

@afrancoc2000 hmm as far as I'm aware, this should work. It's hard to say what could be happening without debugging.
Can you share any logs and a network trace?

sure,
I'm modifying this class from spring boot AzureADGraphClient.java to use the msal library.
This is the code I'm changing:
public AuthenticationResult acquireTokenForGraphApi(String idToken, String tenantId)
        throws MalformedURLException, ServiceUnavailableException, InterruptedException, ExecutionException {

    ConfidentialClientApplication clientApplication = ConfidentialClientApplication.builder(
            clientId,
            ClientCredentialFactory.create(clientSecret))
            .authority(aadAuthenticationProperties.getAuthority())
            .build();

    Set<String> scopes = new HashSet<>(Arrays.asList(aadAuthenticationProperties.getScope().split(" ")));
    UserAssertion assertion = new UserAssertion(idToken);

    OnBehalfOfParameters params = OnBehalfOfParameters.builder(scopes, assertion).build();
    CompletableFuture<AuthenticationResult> future = clientApplication.acquireToken(params);

    AuthenticationResult result = future.get();

    if (result == null) {
        throw new ServiceUnavailableException("unable to acquire on-behalf-of token for client " + clientId);
    }
    return result;
}

And this is the error I'm getting:
2019-05-20 20:15:23,298 [ERROR] com.microsoft.aad.msal4j.ConfidentialClientApplication [Correlation ID: a13ed17d-fed2-42e4-8fbd-96853ce1f3be] Execution of class com.microsoft.aad.msal4j.AcquireTokenByAuthorizationGrantSupplier failed.
com.microsoft.aad.msal4j.AuthenticationException: {"error_description":"AADSTS50034: The user account 0006BFFD847C5DF5 does not exist in the 8cca582e-0d23-4e13-bf43-30896ccafd4f directory. To sign into this application, the account must be added to the directory.\r\nTrace ID: 194c3a64-86d4-4894-9d7d-10e4a9dc0500\r\nCorrelation ID: a13ed17d-fed2-42e4-8fbd-96853ce1f3be\r\nTimestamp: 2019-05-21 01:15:22Z","error":"invalid_grant"}
	at com.microsoft.aad.msal4j.TokenRequest.executeOauthRequestAndProcessResponse(TokenRequest.java:169) ~[msal4j-0.2.0-preview.jar:0.2.0-preview]
	at com.microsoft.aad.msal4j.ClientApplicationBase.acquireTokenCommon(ClientApplicationBase.java:249) ~[msal4j-0.2.0-preview.jar:0.2.0-preview]
	at com.microsoft.aad.msal4j.AcquireTokenByAuthorizationGrantSupplier.execute(AcquireTokenByAuthorizationGrantSupplier.java:71) ~[msal4j-0.2.0-preview.jar:0.2.0-preview]
	at com.microsoft.aad.msal4j.AuthenticationResultSupplier.get(AuthenticationResultSupplier.java:77) [msal4j-0.2.0-preview.jar:0.2.0-preview]
	at com.microsoft.aad.msal4j.AuthenticationResultSupplier.get(AuthenticationResultSupplier.java:37) [msal4j-0.2.0-preview.jar:0.2.0-preview]
	at java.util.concurrent.CompletableFuture$AsyncSupply.run$$$capture(CompletableFuture.java:1590) [?:1.8.0_202]
	at java.util.concurrent.CompletableFuture$AsyncSupply.run(CompletableFuture.java) [?:1.8.0_202]
	at java.util.concurrent.CompletableFuture$AsyncSupply.exec(CompletableFuture.java:1582) [?:1.8.0_202]
	at java.util.concurrent.ForkJoinTask.doExec(ForkJoinTask.java:289) [?:1.8.0_202]
	at java.util.concurrent.ForkJoinPool$WorkQueue.runTask(ForkJoinPool.java:1056) [?:1.8.0_202]
	at java.util.concurrent.ForkJoinPool.runWorker(ForkJoinPool.java:1692) [?:1.8.0_202]
	at java.util.concurrent.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:157) [?:1.8.0_202]
2019-05-20 20:15:26,405 [ERROR] com.microsoft.aad.msal4j.ConfidentialClientApplication [Correlation ID: 55734d67-5e3c-46c3-b819-47ea46892f59] Execution of class com.microsoft.aad.msal4j.AcquireTokenByAuthorizationGrantSupplier failed.
com.microsoft.aad.msal4j.AuthenticationException: {"error_description":"AADSTS50034: The user account 0006BFFD847C5DF5 does not exist in the 8cca582e-0d23-4e13-bf43-30896ccafd4f directory. To sign into this application, the account must be added to the directory.\r\nTrace ID: 381fbfc9-39a1-4345-a8d6-8c7e73e90500\r\nCorrelation ID: 55734d67-5e3c-46c3-b819-47ea46892f59\r\nTimestamp: 2019-05-21 01:15:22Z","error":"invalid_grant"}
	at com.microsoft.aad.msal4j.TokenRequest.executeOauthRequestAndProcessResponse(TokenRequest.java:169) ~[msal4j-0.2.0-preview.jar:0.2.0-preview]
	at com.microsoft.aad.msal4j.ClientApplicationBase.acquireTokenCommon(ClientApplicationBase.java:249) ~[msal4j-0.2.0-preview.jar:0.2.0-preview]
	at com.microsoft.aad.msal4j.AcquireTokenByAuthorizationGrantSupplier.execute(AcquireTokenByAuthorizationGrantSupplier.java:71) ~[msal4j-0.2.0-preview.jar:0.2.0-preview]
	at com.microsoft.aad.msal4j.AuthenticationResultSupplier.get(AuthenticationResultSupplier.java:77) [msal4j-0.2.0-preview.jar:0.2.0-preview]
	at com.microsoft.aad.msal4j.AuthenticationResultSupplier.get(AuthenticationResultSupplier.java:37) [msal4j-0.2.0-preview.jar:0.2.0-preview]
	at java.util.concurrent.CompletableFuture$AsyncSupply.run$$$capture(CompletableFuture.java:1590) [?:1.8.0_202]
	at java.util.concurrent.CompletableFuture$AsyncSupply.run(CompletableFuture.java) [?:1.8.0_202]
	at java.util.concurrent.CompletableFuture$AsyncSupply.exec(CompletableFuture.java:1582) [?:1.8.0_202]
	at java.util.concurrent.ForkJoinTask.doExec(ForkJoinTask.java:289) [?:1.8.0_202]
	at java.util.concurrent.ForkJoinPool$WorkQueue.runTask(ForkJoinPool.java:1056) [?:1.8.0_202]
	at java.util.concurrent.ForkJoinPool.runWorker(ForkJoinPool.java:1692) [?:1.8.0_202]
	at java.util.concurrent.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:157) [?:1.8.0_202]
2019-05-20 20:15:26,408 [ERROR] com.microsoft.aad.msal4j.ConfidentialClientApplication [Correlation ID: 3e9924df-d2f6-48b3-8ec7-0641382cce6b] Execution of class com.microsoft.aad.msal4j.AcquireTokenByAuthorizationGrantSupplier failed.
com.microsoft.aad.msal4j.AuthenticationException: {"error_description":"AADSTS50034: The user account 0006BFFD847C5DF5 does not exist in the 8cca582e-0d23-4e13-bf43-30896ccafd4f directory. To sign into this application, the account must be added to the directory.\r\nTrace ID: 7a611ac4-fbc9-47ac-a482-20faceeb0600\r\nCorrelation ID: 3e9924df-d2f6-48b3-8ec7-0641382cce6b\r\nTimestamp: 2019-05-21 01:15:22Z","error":"invalid_grant"}
	at com.microsoft.aad.msal4j.TokenRequest.executeOauthRequestAndProcessResponse(TokenRequest.java:169) ~[msal4j-0.2.0-preview.jar:0.2.0-preview]
	at com.microsoft.aad.msal4j.ClientApplicationBase.acquireTokenCommon(ClientApplicationBase.java:249) ~[msal4j-0.2.0-preview.jar:0.2.0-preview]
	at com.microsoft.aad.msal4j.AcquireTokenByAuthorizationGrantSupplier.execute(AcquireTokenByAuthorizationGrantSupplier.java:71) ~[msal4j-0.2.0-preview.jar:0.2.0-preview]
	at com.microsoft.aad.msal4j.AuthenticationResultSupplier.get(AuthenticationResultSupplier.java:77) [msal4j-0.2.0-preview.jar:0.2.0-preview]
	at com.microsoft.aad.msal4j.AuthenticationResultSupplier.get(AuthenticationResultSupplier.java:37) [msal4j-0.2.0-preview.jar:0.2.0-preview]
	at java.util.concurrent.CompletableFuture$AsyncSupply.run$$$capture(CompletableFuture.java:1590) [?:1.8.0_202]
	at java.util.concurrent.CompletableFuture$AsyncSupply.run(CompletableFuture.java) [?:1.8.0_202]
	at java.util.concurrent.CompletableFuture$AsyncSupply.exec(CompletableFuture.java:1582) [?:1.8.0_202]
	at java.util.concurrent.ForkJoinTask.doExec(ForkJoinTask.java:289) [?:1.8.0_202]
	at java.util.concurrent.ForkJoinPool$WorkQueue.runTask(ForkJoinPool.java:1056) [?:1.8.0_202]
	at java.util.concurrent.ForkJoinPool.runWorker(ForkJoinPool.java:1692) [?:1.8.0_202]
	at java.util.concurrent.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:157) [?:1.8.0_202]
2019-05-20 20:15:26,416 [ERROR] co.com.accessmanagement.web.security.AADAuthenticationFilter Failed to acquire graph api token.
java.util.concurrent.ExecutionException: com.microsoft.aad.msal4j.AuthenticationException: {"error_description":"AADSTS50034: The user account 0006BFFD847C5DF5 does not exist in the 8cca582e-0d23-4e13-bf43-30896ccafd4f directory. To sign into this application, the account must be added to the directory.\r\nTrace ID: 381fbfc9-39a1-4345-a8d6-8c7e73e90500\r\nCorrelation ID: 55734d67-5e3c-46c3-b819-47ea46892f59\r\nTimestamp: 2019-05-21 01:15:22Z","error":"invalid_grant"}
	at java.util.concurrent.CompletableFuture.reportGet(CompletableFuture.java:357) ~[?:1.8.0_202]
	at java.util.concurrent.CompletableFuture.get(CompletableFuture.java:1895) ~[?:1.8.0_202]
	at co.com.accessmanagement.web.security.AzureADGraphClient.acquireTokenForGraphApi(AzureADGraphClient.java:175) ~[classes/:?]
	at co.com.accessmanagement.web.security.AADAuthenticationFilter.doFilterInternal(AADAuthenticationFilter.java:74) [classes/:?]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.1.5.RELEASE.jar:5.1.5.RELEASE]
	at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:116) [spring-security-web-5.1.5.RELEASE.jar:5.1.5.RELEASE]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.1.5.RELEASE.jar:5.1.5.RELEASE]
	at org.springframework.security.web.csrf.CsrfFilter.doFilterInternal(CsrfFilter.java:100) [spring-security-web-5.1.5.RELEASE.jar:5.1.5.RELEASE]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.1.5.RELEASE.jar:5.1.5.RELEASE]
	at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:74) [spring-security-web-5.1.5.RELEASE.jar:5.1.5.RELEASE]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.1.5.RELEASE.jar:5.1.5.RELEASE]
	at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105) [spring-security-web-5.1.5.RELEASE.jar:5.1.5.RELEASE]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.1.5.RELEASE.jar:5.1.5.RELEASE]
	at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56) [spring-security-web-5.1.5.RELEASE.jar:5.1.5.RELEASE]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.1.5.RELEASE.jar:5.1.5.RELEASE]
	at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:215) [spring-security-web-5.1.5.RELEASE.jar:5.1.5.RELEASE]
	at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:178) [spring-security-web-5.1.5.RELEASE.jar:5.1.5.RELEASE]
	at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:357) [spring-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
	at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:270) [spring-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.17.jar:9.0.17]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.17.jar:9.0.17]
	at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:99) [spring-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.17.jar:9.0.17]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.17.jar:9.0.17]
	at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:92) [spring-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.17.jar:9.0.17]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.17.jar:9.0.17]
	at org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:93) [spring-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.17.jar:9.0.17]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.17.jar:9.0.17]
	at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:200) [spring-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.1.6.RELEASE.jar:5.1.6.RELEASE]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.17.jar:9.0.17]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.17.jar:9.0.17]
	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:200) [tomcat-embed-core-9.0.17.jar:9.0.17]
	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96) [tomcat-embed-core-9.0.17.jar:9.0.17]
	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:490) [tomcat-embed-core-9.0.17.jar:9.0.17]
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139) [tomcat-embed-core-9.0.17.jar:9.0.17]
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92) [tomcat-embed-core-9.0.17.jar:9.0.17]
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74) [tomcat-embed-core-9.0.17.jar:9.0.17]
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343) [tomcat-embed-core-9.0.17.jar:9.0.17]
	at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:408) [tomcat-embed-core-9.0.17.jar:9.0.17]
	at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) [tomcat-embed-core-9.0.17.jar:9.0.17]
	at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:834) [tomcat-embed-core-9.0.17.jar:9.0.17]
	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1415) [tomcat-embed-core-9.0.17.jar:9.0.17]
	at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) [tomcat-embed-core-9.0.17.jar:9.0.17]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_202]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_202]
	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-embed-core-9.0.17.jar:9.0.17]
	at java.lang.Thread.run(Thread.java:748) [?:1.8.0_202]

This is the response:
{"timestamp":"2019-05-21T01:15:28.369+0000","status":500,"error":"Internal Server Error","message":"com.microsoft.aad.msal4j.AuthenticationException: {\"error_description\":\"AADSTS50034: The user account 0006BFFD847C5DF5 does not exist in the 8cca582e-0d23-4e13-bf43-30896ccafd4f directory. To sign into this application, the account must be added to the directory.\\r\\nTrace ID: 9c527d88-7965-4f72-bf4f-9d4bb9040600\\r\\nCorrelation ID: 9f312f29-3252-4191-82e7-028814c32d00\\r\\nTimestamp: 2019-05-21 01:15:25Z\",\"error\":\"invalid_grant\"}","path":"/api/country"}

I'm not seeing anything weird in the traffic just the same error calling my API

I've tried also with other authorities like this:

https://login.microsoftonline.com/{mytenant}
https://login.microsoftonline.com/common
https://login.microsoftonline.com/organizations

And for scopes I've tried:

https://graph.microsoft.com/user.read
openid user.read

Ok I interrupted the petition this is the request info:
url: https://login.microsoftonline.com/{mytenant}/oauth2/v2.0/token
method: POST
extraHeaderParams:
return-client-request-id: true
client-request-id: 0d117f3e-7a0d-43e6-9e4c-b9704f970f93
x-client-CPU: amd64
x-client-VER: 0.2.0-preview
x-client-SKU: MSAL.Java
Params:
scope: https://graph.microsoft.com/user.read
requested_token_use: on:behalf_of
client_info: 1
grant_type: urn:ietf:params:oauth:grant-type:jwt-bearer
assertion: {my-jwt}

@afrancoc2000 : what scope did you request on the front end to call your Web API? which user signed-in?

@jmprieur I have an angular 5 application and I'm using @azure/msal-angular wrapper.
This is my configuration:
  MsalModule.forRoot({
    clientID: {same-client-id},
    authority: 'https://login.microsoftonline.com/{my-tenant}',
    redirectUri: 'http://localhost:443/',
    cacheLocation : 'localStorage',
    postLogoutRedirectUri: 'http://localhost:443/',
    consentScopes: [
      'user.read',
      'openid',
      'https://myapp.onmicrosoft.com/31621f25-b1dd-4d31-b1d5-38975af8fbc3/user_impersonation',
      'https://graph.microsoft.com/user.read']
})
]

@afrancoc2000 I see the consentScopes, but not the scope.
When you write {same-client-id} do you mean that the Web API and your SPA have the same client ID?

@jmprieur yes the API and the frontend app have the same client id, they are both deployed in the same server using an ha-proxy to be exposed with the same url, they are identified by the /api/ path for everithing in the api and everything else is the frontend.
I did registered a different app in my tenant "MyAppFrontend" and authorized it in the API registration using the expose API section, but when I do that I get this different error:

java.util.concurrent.ExecutionException: com.microsoft.aad.msal4j.AuthenticationException: {"error_description":"AADSTS500131: Assertion audience does not match the Client app presenting the assertion. The audience in the assertion was '53e81585-229e-497a-b801-87fa9a5da1f6' and the expected audience is 'https://myapp.onmicrosoft.com/31621f25-b1dd-4d31-b1d5-38975af8fbc3' or one of the Application Uris of this application with App ID '8f880461-7ab4-4285-a04c-9b42f6ab0627'(MyApp).\r\nTrace ID: 01f3c4b9-8014-4ec1-b979-973d6d510500\r\nCorrelation ID: 7e9dc973-b9c9-494c-982c-945642c653f8\r\nTimestamp: 2019-05-22 12:56:43Z","error":"invalid_grant","error_uri":"https://login.microsoftonline.com/error?code=500131"}

@afrancoc2000 You should have two different client ids - one for the front end and one for the backend.
Two observations from browsing the information you have shared:

The token you are passing in here public AuthenticationResult acquireTokenForGraphApi(String idToken, String tenantId) should be an access token, and not an Id token. This should be the access token that you requested on the front end, and then included in the request to the back end. This might be what you are already doing (just might have it mislabeled), but it's worth fixing for clarity.

In the manifest you shared, "knownClientApplications" is blank. The client Id of the front end application here should be listed here, as described by the here

I would look over the instructions in that sample, starting with Register the service app (TodoListService-OBO) and ending with Configure the TodoListSPA project. This sample is very similar to your scenario, the front end is the TodoListSPA and the backend is the TodoListService (you can ignore the instructions for the TodoListClient). I think fixing your app and api registrations might help with AADSTS500131.

@sangonzal and @jmprieur , thank you for all your help, I added the client Ids to the "knownClientApplications" but still the on behalf of flow gives me problems.
I guess I do have an access token and not an Id one, it is the Bearer token generated from the frontend msal implementation, I thought it was an id token because I use it to create the UserPrincipal and it has all the claims I need for that.
I added some roles in the manifest and I'm getting them in the claims of the Bearer Token, for now I'm going to use them to recreate the UserPrincipal and the authorities and finish the authentication on the backend API without going to the graph API.
I will do more tests and tell you how it goes.

@afrancoc2000 if you want to have the same client ID for your client and the web api, I suggest you have a look at this PR: (it's for .NET, but the concepts are the same).
https://github.com/Azure-Samples/active-directory-dotnet-native-aspnetcore-v2/pull/53
Quick question: do you want to let user sign with personal accounts? or only AAD accounts?

@jmprieur Thanks I will check it out, I want the user to be able to sign in with both personal and AAD accounts, from my tenant or others.

Hello @afrancoc2000, hope you're doing alright.
I'm trying to do the same thing, an Angular front end that uses MSAL to login with B2C and then sends HTTP Requests (with an Authorization header) to a Spring Boot API that then validates the token.
The best reference on how to do this was this conversation. Did you manage to get this working? Could you please share your code?
Thanks a lot

also @afrancoc2000 are you using different client ids for frontend and backend?
Thanks

Hi @jfconavarrete I adapted the classes used to create the adal filter in springboot and changed them to use the msal library.  I couldn't make the obo flow to work but now I think I know what was the problem in my scope, I was using:
https://myapp.onmicrosoft.com/31621f25-b1dd-4d31-b1d5-38975af8fbc3/user_impersonation
but it should be
https://myapp.onmicrosoft.com/31621f25-b1dd-4d31-b1d5-38975af8fbc3/.default
What I did, that worked was to left the onBehalfOf flow behind and created roles using this article. This way you get a claim with the roles of the user and you don't need to go to microsoft graph to get the groups for the authorities.
I'm preparing a repo with an example but I haven't finished it but you can use the code here as reference for what I did.

@jfconavarrete also I used the same client ids for both the frontend and the backend. Hope it helps.

@jfconavarrete just another thing, I'm not using the azure active directory B2C service, this is just a multitenant app using the azure active directory registration, but it does work for guest users from other companies and users without a company.

@afrancoc2000 : guest accounts work for single tenant applications only. See in the Who can sign-in section.

@jmprieur the document says:

Both endpoints also accept sign-ins of guest users of an Azure AD directory for applications configured as single-tenant or for multi-tenant applications configured to point to the tenant-specific endpoint

I have tried it and it does work for guest users, I have a bunch of them authenticating in my app.

which document, @afrancoc2000 ?

Sorry @jmprieur, The link you posted :)

@afrancoc2000 :  Is everything working for you? or do you expect anything from us?

Hi @jmprieur everything is working for me thanks, I just didn't used the on behalf of flow at the end but I think I found the problem in the scopes, we can close the issue now. I just wanted to do the test with the scopes correction before closing it, but it can be closed.
Thank you very much I really appreciate your help.

Thanks for the update. @afrancoc2000. Closing it


ttyd automatically closes connection in HTTPS mode

Describe the bug
After connecting in HTTPS, the connection closes itself automatically.
This only happens in HTTPS. HTTP works fine.
The certificate is a self-signed certificate generated with openSSL.
Build is compiled from master branch.
Without the --once option, the connection regulary closes but the page automatically reloads and creates a new connection.
To Reproduce
Steps to reproduce the behavior:

Start ttyd with SSL parameters : ttyd -o -S -C cert.pem -K key.pem sh
Open the shell in your brower https://localhost:7681
After a few seconds, the socket will close itself automatically.

Screenshots
See in the picture, I did not typed anything in the browser except the enter key and the connection closes itself.

Environment:

OS: Ubuntu 20.04.1
Browser: Firefox 82.0 64-bit

exiting due to the --once option

Remove -o and try again.


Prerequisites

[X] I have searched all issues/PRs to ensure it has not already been reported or fixed.

Criteria

[X] Reasonably well-known and widely used (e.g. if it's a GitHub project, it should have at least 100 stars and/or 50 forks)
[X] English interface (or at least English documentation)
[X] Latest stable version
[X] Full version (i.e. not a trial version)
[X] Fairly standard install (e.g. uses a version-specific download URL, no elaborate pre/post install scripts)

Name
Netbird
Description
Netbird VPN
Homepage
https://netbird.io/
Download Link(s)
https://github.com/netbirdio/netbird/releases/tag/latest
Some Indication of Popularity/Repute
Start 10.1K

Relates to netbirdio/netbird#2312.


Enforce using customer_id via path for Updating Address

Description
JSON object for updating address for a customer include customer_id fields which can be manipulated to refer to a different customer, and as a result would raise SQL constraint error as the address doesn't belong to the customer under the current path.
To Reproduce

Browse to http://BASE_URL/customers/{customer_id}/addresses/{address_id}
Prepare JSON Object for a PUT request to update address information
modify customer_id within the JSON Object to refer to a customer different that in the URL.
Send PUT request.

Expected behavior
Use customer_id in the URL or Reject request
Observed behavior
SQL constraint error been thrown
Screenshots

Hey @mwj10 , can you add the description of this issue according to the Bug report template?
Also, please add the story points estimate.

Done.

Done.


Regenerate device ID on some versions.

Amplitude is using device ID (instead of user ID) for this scenario:
"The problem is that as part of our
data processing pipeline, we do a bunch of processing of the data to
ensure that the data is "clean" (deduplication, time correction, etc.).
In order to support this, we have designed our platform that all events
from the same device id (which we assume are unique to a specific
device) go to the same event processor.  In this case, where lots of
devices are going to the same event processor, it looks to our platform
like an error and/or attack.  So that device id gets throttled, and the
blocked, and we stop accepting events from it."
in version 1.4.4 of the android library - we weren't sending device id
correctly (we send build id which is NOT unique for a phone —
https://github.com/segmentio/analytics-android/blob/d33108eabc0a4132966b7a4b713c3686a482ff9d/core/src/main/java/com/segment/android/info/Device.java#L42).
So we generate a pseudo randomish id on the server and send that to
Amplitude.

cc @hankim813 @ladanazita needs tests (a fixture with analytics-android library 1.4.4 sending a generated device id)

lgtm we will merge this and ship a new pr with the test


Can't access variables when using invoke

I'm trying to run tasks like this:
task('deploy', function() {
    invoke("deploy:start-timer");
    invoke("deploy:stop-timer");
});

The first task defines a variable, the 2nd task needs to access it but I'm getting this error:
In Configuration.php line 74:

  [Deployer\Exception\ConfigurationException]
  Configuration parameter `start-time` does not exist.

Thanks

Why not just call php function? startTimer()/stopTimer()?

I am cleaning up on issues. Fill free to reopen if needed.
Also, we have a new section available: discussions.


Avoid id collisions with build_stubbed

Hi there!
Thanks for building FactoryGirl. :) We've recently had failing builds because of id collisions between records created with FactoryGirl.create and FactoryGirl.build_stubbed.
Without changing the way ids are generated by the stub strategy, this should keep us safe for a while. :)

While I'm not opposed to this from a code modification standpoint, I'm honestly interested in the issue that you were running into, mostly to try to understand why this hasn't come up before. Since there are collisions, does this indicate that you're using build_stubbed very infrequently, but when you are, it's after a total of over 1000 records have been created during the test suite run? Is there padding of the initial id for a given record that's persisted, or perhaps a different incrementing scheme?
Thanks in advance!

does this indicate that you're using build_stubbed very infrequently, but when you are, it's after a total of over 1000 records have been created during the test suite run?

Yes, that's pretty much what happened. We have a test suite for a Rails monolith (a car rental marketplace) that has about 4500 examples, and our CI runs them in four parallel containers that run about 1100 examples each.
We use FactoryGirl.create quite liberally (1898 instances in our suite), and just like most Rails applications, most of our records are linked to the users table in one way or an other, sometimes creating multiple users for a single record (i.e. an order).
We only use build_stubbed on our users table in only 74 instances, but some of them started raising one of our validation errors when a trying to book a car, since a user can't rent their own car. We checked the ids, and realized that the user created with build_stubbed had the id 1003, which was colliding with the id of the user created along with the car that we needed for that particular spec.
So yeah, nothing really special going on code-wise, we just have a lot of tests, and started running into this issue recently.
For now we added FactoryGirl::Strategy::Stub.class_variable_set(:@@next_id, 100_000) to our test setup, but we'd rather use an official fix, and save the headache to other people that might run into this as well (and also we don't mind the street cred that comes with contributing 1 line to a famous gem 😉).
I hope that helps. :)

@victormours thanks for the explanation!
Given all of that, what are your thoughts on making a few more changes and having the starting value be part of the FG configuration but defaulting to the current value 1_000? While 100k is large, we also felt like 1k was a pretty large starting ID as well, so we'd be future-proofing in this commit 😄
Thoughts?

Yep, that's an great idea. :) I'll push an update doing that in the days to come.
Thanks again for your review!

Yep, it's a good idea to add the option in the config. However, when this issue popped up, our main pain point was understanding where it came from, and then finding a (hacky) fix was rather easy.
May I suggest raising the default to 2_000? This way much fewer teams will run into the issue, while still being a reasonable number.
Regardless of the default, I'll push an update to add the start value to the configuration in the days to come. :-)
Thanks again for your review!

FYI, ran into this as well (it's not that unlikely to have 1000 instances of something in a test database that has a relationship to a mocked object) - we're planning to hack @@next_id in the same way for now.
I'd suggest using a larger number by default and letting it be configured back to 1000 if for some reason there is a dependency on mocked id's (there really shouldn't be), otherwise it's really just a matter of time before you run into obscure test failures.

I think one reason I have never come across this is that I don't tend to use build_stubbed and create in the same spec. I tend to use build_stubbed only for unit tests that don't touch the database at all.
The setting proposed in this PR may help in some cases, but even with a very large starting id it is still possible to run into this problem if using Spring. When using Spring the database ids do not reset back to 1 from one test run to another. If last user record created in one test run had id 2000, the first user record of the next test run will have id 2001.

I'd be happy to help get this PR across the line, if you're happy for me to do so @victormours?
Looks like we need to:

[ ] Rebase & resolve conflicts
[ ] Increase the default starting point as suggested by Josh in https://github.com/thoughtbot/factory_bot/pull/1002#issuecomment-300171275 (shall we say 100k?)

I think starting at a far greater starting value might help a little bit to distinguish 'real' IDs from autoincrement vs build-stubbed IDs - although it doesn't completely resolve the Spring issue:

When using Spring the database ids do not reset back to 1 from one test run to another;

also ran into an issue with this recently! Ideally we'd only be using build_stubbed in all of our tests but unfortunately with our 10 y/o codebase its a bit of a tall order.
Is there any chance that we'd be able to provide the option to have build_stubbed read from the underlying database's auto-incremented id?

Given that this is a minimal code change and seems like it will help a number of folks, I rebased on master, moved a couple things around, added some documentation, and merged as https://github.com/thoughtbot/factory_bot/commit/65e64ec2a313c67e5f0c63c4afb96234f045b92e.
Having build_stubbed read from the underlying database's auto-incremented id is a neat idea, but I think it would at a lot of additional complexity to the library and to some extent would defeat the purpose of build_stubbed (i.e. a build strategy that avoids hitting the database), so I don't plan to move forward with that idea.


Some new async APIs, small formatting and comments changes

@srirajpaul could you take a quick look at this and let me know if it looks good? most of this is formatting and comments, but there are a few new async APIs.


torchao install error from torchchat in Google colab

I was following this youtube video's intro to torchchat => https://www.youtube.com/watch?v=bIDQeC0XMQ0 and ran into the same problem the presenter described where torchao fails to build in this colab => https://drive.google.com/file/d/1eut0kyUwN7l5it6iEMpuASb0N33p9Abu/view?usp=sharing

So following that example did work well for me
To install ao you'd need to install it in this way
pip install --pre torchao-nightly --index-url https://download.pytorch.org/whl/nightly/cu121 # full options are cpu/cu118/cu121/cu124

I do see a comment on the torchchat side saying they'll fix the installation instructions here https://github.com/pytorch/torchchat/blob/main/install_requirements.sh#L74 cc @Jack-Khuu but this is gated on us providing mac binaries which don't as of now. @atalman is this is an easy change we could potentially make?

So we now have m1 support for our release binaries, as of today this 0.4 which I pushed manually. Not planning on adding nightly support until we figure out automation

Also pip install torchao-nightly installs torchao_nightly-2024.5.29-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl for me, can we fix this?


feat: Require inbound cidrs be set explicitly

This PR  requires that a value be explicitly provided for allowed_inbound_cidrs. To allow all inbound connections, the value ["*"] should be used; this is the value set in the root of the module. To restrict access to specific IPs and/or IP ranges, use CIDR notation:
allowed_inbound_cidrs = [ "x.x.x.x/32", "x.x.x.x/24" ]

This change is also reflected in the examples.

This PR is included in version 1.15.0 :tada:


failed restarting nginx ... what should i do ?

hello Github,
i couldn't restart nginx, i had this issue many many times, and followed several tutorials, this time i followed this one : How to Create a Fully Featured Mail Server using Postal
please tell me what to do i'm not a sysadmin but i really need postal
root@postal:~# systemctl restart nginx
Job for nginx.service failed because the control process exited with error code.
See "systemctl  status nginx.service" and "journalctl  -xe" for details.
root@postal:~# ^C
root@postal:~# systemctl  status nginx.service
● nginx.service - A high performance web server and a reverse proxy server
   Loaded: loaded (/lib/systemd/system/nginx.service; enabled; vendor preset: enabled)
   Active: failed (Result: exit-code) since Thu 2018-03-22 20:32:19 UTC; 4min 41s ago
     Docs: man:nginx(8)
  Process: 12252 ExecStartPre=/usr/sbin/nginx -t -q -g daemon on; master_process on; (code=exited, s
 Main PID: 11515 (code=exited, status=0/SUCCESS)
      CPU: 11ms

Mar 22 20:32:19 postal systemd[1]: Starting A high performance web server and a reverse proxy server
Mar 22 20:32:19 postal nginx[12252]: nginx: [emerg] BIO_new_file("/etc/letsencrypt/live/mail.nasdail
Mar 22 20:32:19 postal nginx[12252]: nginx: configuration file /etc/nginx/nginx.conf test failed
Mar 22 20:32:19 postal systemd[1]: nginx.service: Control process exited, code=exited status=1
Mar 22 20:32:19 postal systemd[1]: Failed to start A high performance web server and a reverse proxy
Mar 22 20:32:19 postal systemd[1]: nginx.service: Unit entered failed state.
Mar 22 20:32:19 postal systemd[1]: nginx.service: Failed with result 'exit-code'.

At a glance I would say that it seems your certificate file is missing. Please try running nginx -t and reply with the output to confirm what is wrong.

i did install let's Encrypt certificate but doesn't seem to exist when i checked through the ftp ... and the command u asked for :
root@postal:~# nginx -t nginx: [emerg] BIO_new_file("/etc/letsencrypt/live/mail.nasdaily.us/fullchain.pem") failed (SSL: error:02001002:system library:fopen:No such file or directory:fopen('/etc/letsencrypt/live/mail.nasdaily.us/fullchain.pem','r') error:2006D080:BIO routines:BIO_new_file:no such file) nginx: configuration file /etc/nginx/nginx.conf test failed

I would imagine the certbot process did not complete successfully. If you re run the command it should tell you what went wrong or if it succeeded.
The instructions you linked to are not official but I believe its possible that you need to stop the nginx service before trying the standalone method from certbot.

i just checked the dns settings was incorrect, now after restarting nginx successfully i get a 502 Bad Gateway
nginx/1.12.1 (Ubuntu)
how to debug or find out the problem please ? thank you

here is what the log says about nginx :
rsa-key-20180313@postal:~$ tail -f /var/log/nginx/error.log 2018/03/22 21:12:26 [error] 2366#2366: *2 connect() failed (111: Connection refused) while connecting to upstream, client: <IP_ADDRESS>, server: mail.nasdaily.us, request: "GET / HTTP/1.1", upstream: "http://<IP_ADDRESS>:5000/", host: "<IP_ADDRESS>" 2018/03/22 21:12:54 [notice] 2410#2410: signal process started 2018/03/22 21:12:57 [error] 2411#2411: *2 connect() failed (111: Connection refused) while connecting to upstream, client: <IP_ADDRESS>, server: mail.nasdaily.us, request: "GET / HTTP/1.1", upstream: "http://<IP_ADDRESS>:5000/", host: "<IP_ADDRESS>" 2018/03/22 21:13:07 [error] 2411#2411: *6 connect() failed (111: Connection refused) while connecting to upstream, client: <IP_ADDRESS>, server: mail.nasdaily.us, request: "GET / HTTP/1.1", upstream: "http://<IP_ADDRESS>:5000/", host: "mail.nasdaily.us" 2018/03/22 21:16:58 [error] 2411#2411: *10 connect() failed (111: Connection refused) while connecting to upstream, client: <IP_ADDRESS>, server: mail.nasdaily.us, request: "GET / HTTP/1.1", upstream: "http://<IP_ADDRESS>:5000/", host: "mail.nasdaily.us" 2018/03/22 21:17:00 [error] 2411#2411: *10 connect() failed (111: Connection refused) while connecting to upstream, client: <IP_ADDRESS>, server: mail.nasdaily.us, request: "GET / HTTP/1.1", upstream: "http://<IP_ADDRESS>:5000/", host: "mail.nasdaily.us" 2018/03/22 21:17:02 [error] 2411#2411: *10 connect() failed (111: Connection refused) while connecting to upstream, client: <IP_ADDRESS>, server: mail.nasdaily.us, request: "GET / HTTP/1.1", upstream: "http://<IP_ADDRESS>:5000/", host: "mail.nasdaily.us" 2018/03/22 21:17:18 [error] 2411#2411: *14 connect() failed (111: Connection refused) while connecting to upstream, client: <IP_ADDRESS>, server: mail.nasdaily.us, request: "GET / HTTP/1.1", upstream: "http://<IP_ADDRESS>:5000/", host: "mail.nasdaily.us" 2018/03/22 21:18:25 [error] 2411#2411: *16 connect() failed (111: Connection refused) while connecting to upstream, client: <IP_ADDRESS>, server: mail.nasdaily.us, request: "GET / HTTP/1.1", upstream: "http://<IP_ADDRESS>:5000/", host: "mail.nasdaily.us" 2018/03/22 21:20:17 [error] 1093#1093: *1 connect() failed (111: Connection refused) while connecting to upstream, client: <IP_ADDRESS>, server: mail.nasdaily.us, request: "GET / HTTP/1.1", upstream: "http://<IP_ADDRESS>:5000/", host: "mail.nasdaily.us"

502 means that postal is not running or is not accessible to nginx.
Run postal status to verify what is happening.

yess thank you so much, postal wasn't running, quick question i need to use other port other than 25, for sending, since this is a test envirement on google cloud i want to use it for now .. how can i change the port ? from postal.yml ? or other configuration file
will this help ?
iptables -t nat -A PREROUTING  -p tcp --dport 25 -j DNAT --to-destination IP_OF_EXTERNAL_MTA:2525

iptables will help you if you want to run on both 2525 and 25 simultaneously, have a look at https://github.com/atech/postal/issues/212#issuecomment-306161864
If you want to run only on 2525, you will have to set that in your postal.yml, here is the default value: https://github.com/atech/postal/blob/master/config/postal.defaults.yml#L67
If google cloud will not let you connect to your Postal server on port 25 then iptables is your answer.
If your postal cannot send emails for a similar reason, you can ignore the iptables and just change the config.


[BUG]: Local segment manager memory leak fix

Description of changes
Closes #3336
Summarize the changes made by this PR.

Improvements & Bug fixes

Fixes the memory leak issue by replacing close_persistent_index with close which also unsubscribes the segment from Embeddings Queue
Makes the LRUCache thread-safe
Adds an evict func to manually remove segments that have been deleted

Test plan
How are these changes tested?

[x] Tests pass locally with pytest for python, yarn test for js, cargo test for rust

Documentation Changes
N/A

[!WARNING]
This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

#3340  👈 (View in Graphite)
#3297
main

This stack of pull requests is managed by Graphite. Learn more about stacking.


[REQUEST] Import from Mapgenie Account

It seems that pre-existing found locations are not transfered when using the extension (chrome). Is it posible to import progress from the logged in account? I found/installed this extension after hitting the 100 location limit.

yeah should be possible, Was initially a planned feature in v1 but as I also wanted my progress to be transferred, but while developing this extension lost my progress anyway so never really started working on this feature, But can be useful as many new people probably download this after hitting the locations cap.

I know this is probably in the works for a future version, but here's my current band-aid for this (v2.0.6):

Disable the extension (so you can access your MapGenie account normally) and make sure you're signed in properly
Open the map you want to transfer data for
Run this snippet in your browser console (modified from the snippet listed in #48):

window.localStorage.setItem("fmg:game_" + game.id + ":map_" + mapData.map.id + ":user_-1", JSON.stringify({
    "locationIds": Object.keys(user.locations).map(Number),
    "categoryIds": [],
    "notes": [],
    "presets": [],
    "presetOrder": [],
    "visibleCategoriesIds": []
}));

(If you're not using "mock user" mode, replace the ":user_-1" part with ":user_" + user.id.)
This should transfer your existing locations into the extension format, such that when you re-enable the extension, it should use the locations from your account as a starting point. I highly recommend making a JSON backup after loading it for the first time!


Delete individual posts server side

As of now you can only delete all your posts. Add functionality allowing you to delete individual ones. Perhaps implement this on some backend server as it takes a long time to compute

100


[bug] unknown attribute error on selected news heading in trending section.

Have a look at this news.It is throwing attribute error.
This news is listed in trending section.
URL:http://www.newscout.in/news/article/michael-avenatti-granted-90-day-release-from-manhattan-jail-after-raising-concerns-about-coronavirus-1520249/

Duplicate of issue #454, for now closing this issue


Plots are a bit constrained

On a separate note (and not the fault of Hydrogen), matplotlib should still by default respond with rich output if it can for all frontends. :tired_face:

Hmm, it's weird that it placed that bubble there. It should have been placed at the end of the selected area (by .plot()) and been much wider. Not sure why this is getting cut off.
I found that limiting the size of the bubbles was necessary to keep large images/videos/stacktraces from filling the entire screen — any clever ideas about a better solution?

The way I was going to lay it out was with a separate pane or tab that can be moved around (the way Atom script was initially created). It would be nice to be able to dock it. One flow that I've considered is a swipable collection of outputs though I really like the output next to run line UI.

Yeah, I've been playing around with designs for throwing the output into a
separate pane (maybe more like a normal REPL pane, maybe something else)
but I haven't landed on anything I really like yet.
I will be adding support for opening multiline results in a new Editor
pane, but that doesn't improve images. Maybe with some fiddling the UI for
images will be good enough as-is.
On Mon, May 18, 2015 at 1:13 PM Kyle Kelley<EMAIL_ADDRESS>wrote:

The way I was going to lay it out was with a separate pane or tab that can
be moved around (the way Atom script was initially created). It would be
nice to be able to dock it. One flow that I've considered is a swipable
collection of outputs though I really like the output next to run line
UI.
—
Reply to this email directly or view it on GitHub
https://github.com/willwhitney/hydrogen/issues/3#issuecomment-103137925.

At least for me, I'm going to want a pane so that I can interact with widgets, Bokeh plots, etc.
There's always the option of making alternative UIs (in separate packages), but sharing common components. Beyond just the Jupyter stuff, some of the code I looked over in Hydrogen is the same stuff we had to do in atom script for contextual running of code (selection, whole file, temp file). Making a Jupyter package for Atom has been high on my list to break away from the script package, so I'm super excited you've gotten this going.

I don't think this particular bug is happening any more, so I'll close the issue.
Still thinking about ways to build a good two-pane experience though.

After the latest upgrade, I'm still seeing a plot like this:

This is probably because two mimetypes are being displayed instead of just image/png.

Ah, I see what's going on. The kernel is sending two separate messages, an execute_result and a display_data.  Showing both of them is OK (actually necessary; hard to determine which results to ignore, and doing it wrong is deadly). The issue is that the image was being displayed inline instead of block, so it got pushed . Fix coming.

Closed by 6592b3b6bd00ee134d968f18d15e7c48ce8f9bd6


Watch and rebuild css when using yarn start

I've been using yarn build-css-from-scss manually, would be nice to include this automatically when the source files change.

Before this is fixed, you can just invoke yarn and the CSS will be rebuilt.


#254 fixed.

#254 fixed

Add change to Github
There are 236 files changed in this PR. Among them, only 2 files (organization-list.component.html, and organization-list.component.ts) are what you actually changed.

"git status": Lists you files that have been updated.
"git add": Only add the files you actually changed. Ignore other files listed in "git status"
Let me know when you doubt on whether to add a file or not when you run "git add"

tslint
When you run "npm start", you might see the WARNINGs from tslint that is yellow color. You need to fix them before submitting the PR. The fix should be very straight forward.

I have fixed, merged and closed the PR, instead of letting you fix the PR yourself, so that we can shorten the turn around time.


refactor!: change yaml format of acquisition

The previous format introduced by commit
bfe0178454b772d8c4c8b54edace6e2518f9e4c0 was a very temporary format, but still can be improved somewhat without reinventing Metadata Encoding and Transmission StandardMETS and Preservation Metadata: Implementation StrategiesPREMIS
The core change is to rename Acquisition to ArchiveUnit to reflect what we upload to digital storage better. The type of ArchiveUnit is acquisition.

Thank you for reviewing


Furnace burning time desynchronization

Mod Version: v10.4
Game Version: v2.02
Launcher: Steam
Additional mods installed: No
Perspective: Both
Description
Me and my friend were in the Camp Office and I lit the stove, burning time was 2 hours, then I started reading a book for one hour, after that burning time became 1 hour, but my friend still had 2 hours of oven burning time.
How to reproduce

Being host.
On region 'Mistery Lake (Camp Office)'
Do  'fire up the stove, remember burning time for you and your friend, read the book or do something that takes time, then check burning time for both of you'
It works wrong.

Expected behavior
I expected, that reading the book will not affect to burning time, or will affect for both of us, not only for me.

This not a bug, YOUR fire on YOUR local timeline, not on global timeline, to avoid abuse of sleeping, because else, you would be able to cook, and sleep without wasting of time. Everything works as intended.

There no plans to rewrite fire on global timeline, because it case to large balance problems that will require remake cooking and sleeping in real time to make it work properly. Also waiting HOURS in real time is not fun. So this logical game compromise we end up with.


Update official Vercel docs

Once we feel good about this package, I can update the docs!

Name has been updated in docs.


LESS Parse Error

Parse error: Unrecognised input
(~".flip-counter.@{className} .digit") {        position: relative;
I cant get it to work

I also had this issue. What was your work-around?

Sorry about that, just updated to work with newer LESS versions.


Potentially add performance testing.

Might have to create a test outside of the javascript framework. Potentially trigger the test on merge requests? maybe trigger manually?

[ ] Ran performance tests with large file with the version attribute at the bottom of the root node


DHCP Gateway Option severely broken since 0.43

/kind bug

What happened:
In one of the commits in this range https://github.com/kubevirt/kubevirt/compare/v0.43.0...v0.43.1-rc.1 the gateway IP address that ends up at: pkg/network/dhcp/server/server.go#L117 is no longer been treated with .To4(). This leads to the address being converted to a byte array of a IPv6 address, such as [0 0 0 0 0 0 0 0 0 0 255 255 169 254 1 1].
On the wire, this looks like: Default-Gateway Option 3, length 16: <IP_ADDRESS>,<IP_ADDRESS>,<IP_ADDRESS>,<IP_ADDRESS>.
Linux DHCP client handles this correctly, and strips out the first entries. Windows DHCP clients however reject these as invalid. This means that Windows Pod networking has been broken since 0.43 in bridge mode. I have not tested masquerade.
The mixup likely happened in one of @AlonaKaplan's refactors, such as https://github.com/kubevirt/kubevirt/commit/aa96d31c79f30ffe96ea1fc30706f80d9b532da8. I have not been able to pin down the specific commit. The funny thing is, the original implementor of pod networking in kubevirt seems to also have run into this: https://github.com/kubevirt/kubevirt/pull/2837#issuecomment-553793026.
Please note that the ClasslessRoutes are correct. Regretfully, there is no test for the regular gateway option in: https://github.com/kubevirt/kubevirt/blob/main/pkg/network/dhcp/server/server_test.go which is why this was not caught there.
This is very likely the cause of: https://github.com/kubevirt/kubevirt/issues/6448
What you expected to happen:
The DHCP server should only send out 4 a 32 bit byte array.
How to reproduce it (as minimally and precisely as possible):
Any VM with bridge pod networking.
Anything else we need to know?:
We have implemented a fix for this in: https://github.com/coreweave/kubevirt/commit/eec14088923d994ad8b3e25df36bbde34548e5ce. I do not know if this is the right place to do this conversion, but it works.
Environment:

KubeVirt version (use virtctl version): 0.43.0 to master
Kubernetes version (use kubectl version): 1.18
VM or VMI specifications: Pod networkin in bridge mode
Cloud provider or hardware configuration:
OS (e.g. from /etc/os-release):
Kernel (e.g. uname -a):
Install tools:
Others:

/assign @phoracek

/assign @AlonaKaplan


template ignores conf/userstyle.css

Exactly as the title states.  Changes to the global conf/userstyle.css are not reflected in the template.  I note the existence of a local userstyle.css, but changes here will likely be wiped out on update.

Hi! This theme doesn't handle userstyle.css directly, It is handled by DokuWiki itself.
I've tested conf/userstyle.css myself and it worked fine in my local env.
Some googling showed caching might be the cause. Could you try clearing your browser cache and DokuWiki cache?
Dokuwiki's cache should be cleared by saving the DokuWiki configuration.

Yeah, that seems to have done the trick.  Thanks, and sorry to bother you with this rookie mistake.


Patterns don't use /

According to the examples I've seen on mailing lists, JSON Schema's patterns look like this:
{
    "type": "string",
    "pattern": "^[a-zA-Z]*$"
}

Your tests assume they start and end with a slash.

+1 on the need

Even if there is a good solution to this problem, I don't know the odds of it getting merged in after 9 months. I'll try to stay hopeful though.

Still hopeful after 2 years 3 months?

Backticks don't have any special meaning within the regex AND can be used as delimiters (if escaped), therefore I believe this code should work:
if (!preg_match('' . str_replace('', '`', $schema->pattern) . '`', $entity)) {
Forked/fixed/tested here: https://github.com/shrm-org/php-json-schema


Eslint and stylelint

I introduced some css linting, see https://github.com/stylelint/stylelint-config-standard
Also I replaced jshint with eslint which is the defactor standard right now and easy to adjust the rules. I added some rules based on what makes sense + the feedback of @oliverdunk, see package.json in this pull request for details.
@erwindon Do you agree with these linting rules? Feel free to adjust in this pull request. When agreed, could you merge?

The css checker works for me --> good
I see no problems with the added checks and all failure are already resolved --> good
I tested it with some re-introduced code --> good
One small problem left: yarn.lock should not be in git; thus it should be in .gitignore.
Note that I already added yarn-error.log to the .gitignore in branch jobid.

Hi @erwindon
I think yarn.lock SHOULD be in git. This ensures all dependencies of dependencies to be exactly the ones where we write software with.

If yam.lock is present on purpose, it's ok.
My remark was based only on fact that it is a generated file.
And I see too many cases in my other work where .gitignore is never updated and files are accidentally added.


Update AppVeyor configuration to enhance security and functionality

User description

Resolves #ISSUE_NUMBER

Before the change?

After the change?

Pull request checklist

[ ] Tests for the changes have been added (for bug fixes/features)
[ ] Docs have been reviewed and added/updated if needed (for bug fixes/features)

Does this introduce a breaking change?

[ ] Yes
[ ] No

Description

Removed the SONAR_TOKEN from the AppVeyor environment variables for security or configuration reasons.
Updated the dotnet_csproj settings to ensure proper patching of .csproj files.

Changes walkthrough 📝
Relevant filesConfiguration changes

appveyor.ymlUpdate AppVeyor configuration to remove SONAR_TOKEN

appveyor.yml
Removed SONAR_TOKEN from the environment variables.  Updated the configuration for dotnet_csproj.

+0/-2

Summary by CodeRabbit

Chores

Removed SONAR_TOKEN from the configuration, simplifying the build process.
Retained existing environment variables for Codacy and CodeClimate.
Adjusted build script to exclude SONAR_TOKEN when local pull requests are detected.

:white_check_mark: Build Sankhya-SDK-dotnet 3.0.802 completed (commit https://github.com/guibranco/Sankhya-SDK-dotnet/commit/306718dfb8 by @guibranco)


nix: fix shellrc PATH word splitting in bash

Summary
Fix the loop in shellrc.tmpl so that devbox shell doesn't end up with a broken PATH delimited by spaces instead of colons. This was due to a subtle bug related to how bash and zsh do word splitting differently. Read on for an in-depth explanation.
We fix up the PATH in shellrc.tmpl by looping over each PATH directory. To get each dir, we set IFS=: and rely on the shell's word splitting to loop over PATH. A caveat to this approach is that zsh doesn't follow the POSIX behavior for word splitting. Here's an example showing the difference:
bash:
bash$ export x=a:b:c
bash$ export IFS=:
bash$ echo $x
a b c

zsh:
zsh$ export x=a:b:c
zsh$ export IFS=:
zsh$ echo $x
a:b:c

To workaround this, we use command substitution to force zsh to word split:
zsh$ export x=a:b:c
zsh$ export IFS=:
zsh$ echo $(echo $x)
a b c

There's a subtle bug here that causes the splitting to break in bash because the splitting happens too soon (note the single quotes around the first echo output):
bash$ export x=a:b:c
bash$ export IFS=:
bash$ set -x; echo $(echo $x)
++ echo a b c
+ echo 'a b c' a b c

The subshell splits $x, resulting in 'a b c'. The parent shell doesn't split 'a b c' because it has already been split and doesn't have any colons. This doesn't happen in zsh, because zsh doesn't split unquoted variables. Quoting $x stops bash from splitting in the subshell, fixing this for both shells:
bash$ export x=a:b:c
bash$ export IFS=:
bash$ set -x; echo $(echo "$x")
++ echo a:b:c
+ echo a b c a b c

Fixes #175.
How was it tested?
Launched a devbox shell in bash and zsh and made sure both PATHs were correct.

@loreto this is probably hotfix worthy.

Yeah, we should do another release today so it includes this PR.

@gcurtis As a separate PR, is there a test we could add that would have caught this?

We should add some unit tests that exercise the shell script(s). The existing tests didn't catch it because the shellrc isn't run in non-interactive terminals.


Skip http://pie.dev tests when offline

Codecov Report

Merging #1072 (de2512d) into master (0e556ec) will decrease coverage by 0.06%.
The diff coverage is 86.36%.

@@            Coverage Diff             @@
##           master    #1072      +/-   ##
==========================================
- Coverage   95.88%   95.82%   -0.07%
==========================================
  Files          61       61
  Lines        4012     4024      +12
==========================================
+ Hits         3847     3856       +9
- Misses        165      168       +3

Impacted Files
Coverage Δ

tests/utils/__init__.py
88.46% <ø> (-0.08%)
:arrow_down:

tests/conftest.py
86.36% <76.92%> (-13.64%)
:arrow_down:

tests/test_tokens.py
100.00% <100.00%> (ø)

tests/test_uploads.py
100.00% <100.00%> (ø)

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 0e556ec...de2512d. Read the comment docs.


NEXT-10889 - Change German translations for "valid", closes #1294

1. Why is this change necessary?
The german "Valide" is educational language.
We should move to "gültig".
See #1294
2. What does this change do, exactly?

changed usage of "valid" to "gültig"

3. Describe each step to reproduce the issue or behaviour.
4. Please link to the relevant issues (if any).
https://issues.shopware.com/issues/NEXT-10889
5. Checklist

[x] I have written tests and verified that they fail without my change
[x] I have squashed any insignificant commits
[x] I have created a changelog file with all necessary information about my changes
[x] I have written or adjusted the documentation according to my changes
[x] This change has comments for package types, values, functions, and non-obvious lines of code
[x] I have read the contribution requirements and fulfil them.

@GitEvil Any news? :-)

@GitEvil ping

Hello,
thank you for creating this pull request.
I have opened an issue on our Issue Tracker for you. See the issue link: https://issues.shopware.com/issues/NEXT-12417
Please use this issue to track the state of your pull request.

Thank you for your contribution @tinect :grin:


Support binary data files

Please add support for parquet and similar file formats for data analysis.

Thank you for filing this feature request, out of curiosity, what happens when you do try to use such a file in your prompt?

@biiiipy I managed to replicate this issue and believe we have a solution for this.

@biiiipy please do try the new version and please let me know if this works or not, I've tested this at my end and it works


v5 Offcanvas: Not visible on page load with show class

Operating system and version: Windows 10
Browser and version: Firefox 86.0 and Chome 89.0.4389.82
I'm trying out the new offcanvas component, which is great, but when I have show as part of the initial classes, the menu doesn't open on page load. It may be something I'm doing wrong, but I think I've followed the setup correctly for the current Bootstrap from GitHub.
<!doctype html>

        <meta charset="utf-8">
        <meta name="viewport" content="width=device-width, initial-scale=1">
        <link rel="stylesheet" href="css/bootstrap.css">
        <title>Offcanvas test</title>

Offcanvas

        <button class="btn" type="button" data-bs-toggle="offcanvas" data-bs-target="#app-menu">
            Open menu
        </button>

Expected behaviour: On load, the offcanvas is opened, and the document obscured by the overlay.
Actual behaviour: No offcanvas shown. Clicking the button the first time does nothing (it toggles the show class off), then the second time it shows the offcanvas and the document is obscured.
Moving the script tag to the top of the document or into the head seems to make no difference.

/CC @GeoSot

@iainhallam please can you attach a living example that replicates the issue?

https://codepen.io/iainhallam/pen/XWNQZRV replicates for me. The CSS and JS in that are taken from the dist/ directory of a Git checkout of main at commit e153e5f5b2b82ad09a9874b8ff1dfca986790f76 after running npm run dist. The show class is present in the HTML, but the offcanvas isn't shown until the button has been clicked twice to remove the class then re-add it again.


[5.1 early] [test] Disable verify_all_overlays.py for watchOS

watchOS behaves differently when building against the Apple-internal SDK. The differences have been worked out on master, but there have been other changes in the mean time that make cherry-picking more trouble than it's worth. Just disable this test on watchOS until the rebranch.
rdar://problem/48766205

cc @stephentyrone, @shahmishal, @slavapestov
@swift-ci Please test


OpenSearchCon 2023 - Get a sneak peek inside

Describe the blog post your would like to write
Provides updates on everything we have planned for OpenSearchCon 2023.
What is the title of the blog post?
OpenSearchCon 2023
Who are the authors?
@jhmcintyre @krisfreedain
What is the proposed posting date?
August 23, 2023

thanks @pajuric

Reviewed and through editorial process - will create a PR and get this published

resolved / published in https://github.com/opensearch-project/project-website/pull/1909


User Created Event Loop Not Logging

When the user creates an event loop and runs their function code in it, logs are not generated for functions called within the event loop.
For example, the following code would not log the line Python timer trigger function ran at ...:
import datetime
import logging
import asyncio

import azure.functions as func

async def log_timer_triggered():
    asyncio.sleep(1)
    utc_timestamp = datetime.datetime.utcnow().replace(
        tzinfo=datetime.timezone.utc).isoformat()

    logging.info('Python timer trigger function ran at %s', utc_timestamp)

def main(mytimer: func.TimerRequest) -> None:
    if mytimer.past_due:
        logging.info('The timer is past due!')

    logging.info('main')
    loop = asyncio.SelectorEventLoop()
    asyncio.set_event_loop(loop)
    loop.run_until_complete(log_timer_triggered())
    loop.close()
    logging.info('main done')

However, the following will work fine and logs will be present:
async def log_timer_triggered():
    asyncio.sleep(1)
    utc_timestamp = datetime.datetime.utcnow().replace(
        tzinfo=datetime.timezone.utc).isoformat()

    logging.info('Python timer trigger function ran at %s', utc_timestamp)

def main(mytimer: func.TimerRequest) -> None:
    if mytimer.past_due:
        logging.info('The timer is past due!')

    logging.info('main')
    await log_timer_triggered()
    logging.info('main done')

The former is an async pattern that we do not currently handle as we expect users to run within the loop that we provide. Possible solutions would include either (a) handling user provided event loops or (b) surfacing warnings after detecting this pattern.

Hello,
The above is a rare example of async Azure Python Functions on the internet. All examples I've seen of the async pattern seems to use the main() function differently than I'm used to.
Instead of the synchronous pattern of:
import azure.functions as func

def main(mytimer: func.TimerRequest) -> None:

#---- Define functions----

    def do_a(arg_a):
        # Insert work here
        return foo

    def do_b(arg_b):
        # Insert work here
        return bar

#---- Define variables----

    arg_a = 'yay'
    arb_b = 'yea'

#---- Call functions----

    a = do_a(arg_a)
    b = do_b(arg_b)

Aside from the Azure-python-sdk examples (which all show this method too), is there any documentation on why the main() function is used in such a way?
The Azure Function docs say "Use async" and the examples show it, but I would love to hear why. Especially when there appear to be "things" going on behind the scenes that are not apparent.


How to ensure a blank line between standard, prefix and default?

Nevermind this appears an issue with golangci-lint


added "Export" button to Connections to export network diagram as PNG

added "Export" button to Connections to export network diagram as PNG using save-svg-as-png

Looks ok to me, other then need to rebuild lock file.  @31453 ?

Awesome!!
On Thu, Sep 13, 2018 at 1:39 PM, SG<EMAIL_ADDRESS>wrote:

added "Export" button to Connections to export network diagram as PNG
using save-svg-as-png
You can view, comment on, or merge this pull request online at:
https://github.com/aol/moloch/pull/912
Commit Summary

added "Export" button to Connections to export network diagram as
PNG using save-svg-as-png

File Changes

M viewer/package.json
https://github.com/aol/moloch/pull/912/files#diff-0 (1)
M viewer/vueapp/src/components/connections/Connections.vue
https://github.com/aol/moloch/pull/912/files#diff-1 (15)

Patch Links:

https://github.com/aol/moloch/pull/912.patch
https://github.com/aol/moloch/pull/912.diff

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
https://github.com/aol/moloch/pull/912, or mute the thread
https://github.com/notifications/unsubscribe-auth/AOjHrkRTLXZ8cDR3-DFawvKKY87T7ybfks5uamABgaJpZM4WnRj6
.


SHACL - Bulk validation should not load data into the addedStatements MemoryStore

Currently the ShaclSailConnection does not check if bulk validation is enabled before loading data into the addedStatements MemoryStore. This is particularly expensive if the RDFS reasoner is invoked.
Since bulk validation is meant to revalidate the entire database there should be no reason to use the addedStatements MemoryStore.
We need to add/update our low-memory benchmarks.

Duplicate of #3232


fixes color support for fly cli on windows 10

See issue: https://github.com/concourse/concourse/issues/1090
It looks like the fly cli uses os.Stdout for all of its write operations instead of using colorable.NewColorableStdout().
The windows terminal needs to have Ansi Escape Sequences enabled and the go-colorable package does this with the colorable.NewColorableStdout() function or the color.Output field.

HI @patrickhuber , thanks for submitting the PR! I've scheduled this as Ready to Work under our UX project, someone on our engineering team should be looking at this soon!

Thanks for the PR @patrickhuber.
We noticed an issue on Windows 10 where the colors are no longer displayed in cmd.exe or PowerShell:

What version of Windows 10 are you using?
systeminfo

I'll try on my laptop to see if I get different behavior.

@patrickhuber we are running a VM in VirtualBox downloaded from https://developer.microsoft.com/en-us/microsoft-edge/tools/vms. The OS version is 10.0.15063.

@patrickhuber since we haven't heard back in a while I'm going to close this PR. If you have more information for @mhuangpivotal please feel free to re-open!


How to filter a QueryRecyclerAdapter with a SearchView?

I want to replace my current RecyclerView.Adapter with requery's QueryRecyclerAdapter, but I cannot figure out how to do the filtering.
With my existing adapter I just filter the master list (from RxSearchView.queryTextChangeEvents) into a new list and assign that to the adapter.
I'm populating the RecyclerView with these
// adapter
  override fun performQuery(): Result<MyClass> {
            return mPresenter.getMyClassResults()
  }

//presenter
override fun getMyClassResults(): Result<MyClass> = datasource.getMyClassResults()

// repository
override fun getMyClassResults(): Result<MyClass> {
        return (data select (MyClass::class) orderBy MyClass::column_name.lower()).get()
    }

Do I need to implement Filterable, if so how do I link it to the Search View. Or is there something else I need to do?

You can transform your query to a list and keep using your current adapter or you can extend the requery adapter and implement the filtering interface and then call QueryRecyclerAdapter.setResults in the publishResults call. It seems like there are multiple ways to do this on Android RecyclerView doesn't seem to prescribe doing it a certain way.

Thanks, I'll play around with it. I was already doing the first option, but I thought that QueryRecyclerAdapter would add something. I think I'll stick to my existing adapter as it works, but loading thousands of items is something I wish to avoid.


(Updates/New) Asset Governance

Thanks for contributing to the Harness Developer Hub! Our code owners will review your submission.
Description

Please describe your changes: _________ Modified Title for an Article as it did not match the internal descriptor
Added a new article about modifying existing rules as customer did not how to do so
Jira/GitHub Issue numbers (if any): _________  https://harnesssupport.zendesk.com/agent/tickets/68957
Preview links/images (Internal contributors only): __________________

PR lifecycle
We aim to merge PRs within one week or less, but delays happen sometimes.
If your PR is open longer than two weeks without any human activity, please tag a code owner in a comment.
PRs must meet these requirements to be merged:

[ ] Successful preview build.
[ ] Code owner review.
[ ] No merge conflicts.
[ ] Release notes/new features docs: Feature/version released to at least one prod environment.

 Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.You have signed the CLA already but the status is still pending? Let us recheck it.

Please check the Execution Link of the Pipeline for the Website Draft URL. This is located in the Preview Step behind the Harness VPN and also is available in #hdh_alerts. E.g Website Draft URL: https://unique-id--harness-developer.netlify.app. Current Draft URL is: https://66e35257e8639539beb28ec0--harness-developer.netlify.app

@nikunj-badjatya @joeyouss @Rohit-Kaliki @navaneeth @rdsoze , please approve

This pull request has been automatically closed due to 30 days of inactivity. If you believe this was done in error, please feel free to reopen the PR or reach out to the BT team for further assistance. Thank you for your contributions!

Please check the Execution Link of the Pipeline for the Website Draft URL. This is located in the Preview Step behind the Harness VPN and also is available in #hdh_alerts. E.g Website Draft URL: https://unique-id--harness-developer.netlify.app. Current Draft URL is: https://671b00bca2c727c3edfe9393--harness-developer.netlify.app

@nikunj-badjatya @joeyouss @Rohit-Kaliki @navaneeth @rdsoze , please approve

@abhinav-harness @svmav , can either of you please approve/merge

This pull request has been automatically closed due to 30 days of inactivity. If you believe this was done in error, please feel free to reopen the PR or reach out to the BT team for further assistance. Thank you for your contributions!

Please check the Execution Link of the Pipeline for the Website Draft URL. This is located in the Preview Step behind the Harness VPN and also is available in #hdh_alerts. E.g Website Draft URL: https://unique-id--harness-developer.netlify.app. Current Draft URL is: https://67604df28996fd00f039ec2c--harness-developer.netlify.app


Signal [1] is defined more than once. (Example included) #628

Extension to issue #628 #622
Source verilog file:
http://www.clifford.at/papers/2016/malicious-lut/example.v
Expected blif format that abc can read and compute  Miter.
Thanks
@cliffordwolf  I am sorry for inconvenience. I should have given the source verilog.

I can't reproduce any issue with the information provided here and in #628 and #622. Using current git head:
$ yosys -qp "hierarchy; proc -global_arst reset; flatten; techmap; ice40_unlut; opt_clean; abc -script +strash;ifraig;scorr;retime;strash; clean; write_blif example.blif" example.v

$ yosys-abc
UC Berkeley, ABC 1.01 (compiled Mar  7 2019 08:49:50)
abc 01> read_blif example.blif
abc 02> ***EOF***

$ yosys-abc
UC Berkeley, ABC 1.01 (compiled Mar  7 2019 08:49:50)
abc 01> miter example.blif example.blif
abc 02> ***EOF***

So I'm closing this issue now.
I don't know what expectations OP has here, considering that the issue neither contains the ABC error message they see, nor the ABC commands they run. Obviously it's hard to reproduce anything without this kind of information.


Performance viewer: Fix crash when object is empty

See https://forum.babylonjs.com/t/open-source-multiplayer-3d-rpg-using-colyseus/35733/206

Please make sure to label your PR with "bug", "new feature" or "breaking change" label(s).
To prevent this PR from going to the changelog marked it with the "skip changelog" label.

Snapshot stored with reference name:
refs/pull/14250/merge
Test environment:
https://babylonsnapshots.z22.web.core.windows.net/refs/pull/14250/merge/index.html
To test a playground add it to the URL, for example:
https://babylonsnapshots.z22.web.core.windows.net/refs/pull/14250/merge/index.html#WGZLGJ#4600
Links to test babylon tools with this snapshot:
https://playground.babylonjs.com/?snapshot=refs/pull/14250/merge
https://sandbox.babylonjs.com/?snapshot=refs/pull/14250/merge
https://gui.babylonjs.com/?snapshot=refs/pull/14250/merge
https://nme.babylonjs.com/?snapshot=refs/pull/14250/merge
To test the snapshot in the playground with a playground ID add it after the snapshot query string:
https://playground.babylonjs.com/?snapshot=refs/pull/14250/merge#BCU1XR#0


Header links not working on deployed documentation

https://geolytix.github.io/xyz/mapp/

The deployed documentation does not use the /docs path.

Also updated the express and api/README.md paths to use /xyz/


API - add project level tokenization handling

Right now the API is per user.  It may be nice, and likely critical to, ultimately add a project level token/access to the API.  Thoughts @LocoDelAssembly?

Revisiting this now.  I think perhaps we should not use a api_access_token for projects, but rather just open/shut the project using a key in project.preferences.

Counter to prior comment, implemented project token.  It should be usef for tracking at various levels.  It also lets us reference a project without the use of project_id, which might be nice in some cases.


create milestones

let's create milestones for when you believe these issues will be complete.
milestone names should be: YYYY_MM_DD
let's restrict milestones to the 15th and the last of the months
eg, 2015_12_31 is a good one that i am using.
2016_01_15 is another good one.
you choose when they will be done, but please do add milestones to each issue.
thank you!

OK basic plan is
January - Finish all validation
February - Finish all image analysis (in CLARITYDataAnalysis repo)
March - Finish all Documentation and Webservice

cool, let's create the milestones in github later today when i'm there
(12-3).
On Thu, Dec 17, 2015 at 10:24 AM, kkutten1<EMAIL_ADDRESS>wrote:

Closed #11 https://github.com/openconnectome/ndreg/issues/11.
—
Reply to this email directly or view it on GitHub
https://github.com/openconnectome/ndreg/issues/11#event-494798246.

--
the glass is all full:  half water, half air.
neurodata.io