How to run the Extensible Service Proxy (ESP) on flexible environment?

Fouad Almalki

unread,

Nov 17, 2016, 1:43:58 AM11/17/16

to Google Cloud Endpoints

I've been trying to use custom authentication on flex env but couldn't achieve that. Here is my REST API:

import com.google.api.server.spi.auth.EspAuthenticator;
import com.google.api.server.spi.config.Api;
import com.google.api.server.spi.config.ApiIssuer;
import com.google.api.server.spi.config.ApiIssuerAudience;
import com.google.api.server.spi.config.ApiMethod;
import com.google.api.server.spi.config.ApiMethod.HttpMethod;
import com.google.api.server.spi.config.ApiNamespace;
import com.google.api.server.spi.config.AuthLevel;
import com.google.api.server.spi.config.Named;
import net.****.server.backend.beans.Message;

import javax.servlet.http.HttpServletRequest;
import java.io.FileNotFoundException;


@Api(name = "userAPI", version = "v1", namespace = @ApiNamespace(ownerDomain = "****.net", ownerName = "****", packagePath="backend/api"),
    authenticators = EspAuthenticator.class, authLevel = AuthLevel.REQUIRED,
    issuers = @ApiIssuer(name = "****_auth", issuer = "****", jwksUri = "https://backend-dot-****-test.appspot.com/****-public-key.pem"),

    issuerAudiences = @ApiIssuerAudience(name = "****_auth", audiences = {"****_audience"}))
public class UserAPI
{
   @ApiMethod(name = "echo", path = "echo", httpMethod = HttpMethod.GET)
   public Message echo(@Named("message") String message)
   {
      Message m = new Message();
      m.setMessage(message);
      
      return m;
   }
}

and here is my swagger.yaml file:

swagger: '2.0'
info:
    version: 1.0.0
    title: backend-dot-****-test.appspot.com
host: backend-dot-****-test.appspot.com
basePath: "/_ah/api"
schemes:
- https
consumes:
- application/json
produces:
- application/json
paths:
    "/userAPI/v1/echo":
        get:
            operationId: UserAPIEcho
            parameters:
            - name: message
              in: query
              required: true
              type: string
            responses:
                '200':
                    description: A successful response
securityDefinitions:
    ****_auth:
        authorizationUrl: "https://backend-dot-****-test.appspot.com/authorize"
        flow: "implicit"
        type: "oauth2"
        # The value below should be unique
        x-issuer: "****" # issuer of the token
        x-jwks_uri: "https://backend-dot-****-test.appspot.com/****-public-key.pem" # url to the public key

and I setup a servlet listening for ("/authorize") and printing debugging information about all parameters and headers. However, this servlet is never called.

To be honest, I am not sure if I am doing it right or not. There are no examples for ESP authentications on https://github.com/GoogleCloudPlatform/java-docs-samples, and the documentations lack a lot about this topic.

I tried many configurations and none of them seems to be working. Every time I access /_ah/api/userAPI/v1/echo?message=abc it works well without any authentication information embedded with the request.

limi...@google.com

unread,

Nov 17, 2016, 3:29:58 PM11/17/16

to Google Cloud Endpoints

Hi Fouad, I saw you have "****_auth" listed in securityDefinitions, but you don't have a "x-security" section to specify where "****_auth" is used. Note that "x-security" section is required for using Endpoints auth. It can be set on the API level or method level. See an example at https://github.com/GoogleCloudPlatform/python-docs-samples/blob/master/appengine/flexible/endpoints/swagger.yaml#L46.

I do not think we have Endpoints auth sample in Java at the moment. But we do have Endpoints auth samples in Python at https://github.com/GoogleCloudPlatform/python-docs-samples/tree/master/appengine/flexible/endpoints.

Fouad Almalki

unread,

Nov 18, 2016, 7:20:19 AM11/18/16

to Google Cloud Endpoints, limi...@google.com

I tried to add x-security, but still the same behavior. Anonymous access to the API is still accepted.

Fouad Almalki

unread,

Nov 18, 2016, 8:30:27 AM11/18/16

to Google Cloud Endpoints, limi...@google.com

BTW, should I use

beta_settings:
	# Enable Google Cloud Endpoints API management.
	use_endpoints_api_management: true

in app.yaml? because whenever I use it, the endpoints API doesn't work at all. It returns HTTP 503 Service Unavailable all the time.

D. T.

unread,

Nov 18, 2016, 2:05:06 PM11/18/16

to Google Cloud Endpoints

Are you using GoogleAppEngineControlFilter in your web.xml? If so, then no, you should not use these settings. Can you enable FINE logging and see if there's anything useful? Usually the filter only falls through if it doesn't have any awareness of the request path.

Fouad Almalki

unread,

Nov 18, 2016, 3:51:23 PM11/18/16

to Google Cloud Endpoints

No, I am not using GoogleAppEngineControlFilter. Whenever I use GoogleAppEngineControlFilter or the beta setting I mentioned before, I got this error:

Error: Server Error

The service you requested is not available yet.

Please try again in 30 seconds.

and the page title is (503 Server Error), and I cannot find anything in google console logging with level WARNING or ERROR.

Also, how to change the logging level to FINE in app.yaml?

D. T.

unread,

Nov 18, 2016, 4:05:24 PM11/18/16

to Google Cloud Endpoints

If you are not using GoogleAppEngineControlFilter *or* the beta settings, then custom auth will not work. Since you're using the Java framework, you should use the former. You need to add a logging.properties file to your WEB-INF and put "com.google.api.control.level=ALL" in it. Even after you add custom auth, you need to inject a User object into your method and check it for nullness.

Given that you are getting a 503 error, it's likely your app is not starting, and the error is coming from the VM container. Do you get this error when running locally?

Fouad Almalki

unread,

Nov 18, 2016, 5:44:42 PM11/18/16

to Google Cloud Endpoints

Thank you Mr. Tang for you support, I really appreciate it. I solved the HTTP 503 error by using:

bind(GoogleAppEngineControlFilter.class).in(Scopes.SINGLETON);

This is my code (using Guice) right now:

Map<String, String> initParams = new HashMap<>();
initParams.put("endpoints.projectId", "****-test");
initParams.put("endpoints.serviceName", "backend-dot-****-test.appspot.com");

//bind(ServiceManagementConfigFilter.class).in(Scopes.SINGLETON);
bind(GoogleAppEngineControlFilter.class).in(Scopes.SINGLETON);

//filter("/_ah/api/*").through(ServiceManagementConfigFilter.class);
filter("/_ah/api/*").through(GoogleAppEngineControlFilter.class, initParams);

However, I am now getting the following error in local server (same on cloud):

java.lang.NullPointerException

at com.google.appengine.api.ThreadManager.backgroundThreadFactory(ThreadManager.java:72)

at com.google.api.control.extensions.appengine.GoogleAppEngineControlFilter.createClient(GoogleAppEngineControlFilter.java:61)

at com.google.api.control.ControlFilter.init(ControlFilter.java:128)

at com.google.inject.servlet.FilterDefinition.init(FilterDefinition.java:112)

at com.google.inject.servlet.ManagedFilterPipeline.initPipeline(ManagedFilterPipeline.java:99)

at com.google.inject.servlet.GuiceFilter.init(GuiceFilter.java:220)

at org.eclipse.jetty.servlet.FilterHolder.initialize(FilterHolder.java:137)

at org.eclipse.jetty.servlet.ServletHandler.initialize(ServletHandler.java:873)

at org.eclipse.jetty.servlet.ServletContextHandler.startContext(ServletContextHandler.java:349)

at org.eclipse.jetty.webapp.WebAppContext.startWebapp(WebAppContext.java:1404)

at org.eclipse.jetty.maven.plugin.JettyWebAppContext.startWebapp(JettyWebAppContext.java:323)

at org.eclipse.jetty.webapp.WebAppContext.startContext(WebAppContext.java:1366)

at org.eclipse.jetty.server.handler.ContextHandler.doStart(ContextHandler.java:778)

at org.eclipse.jetty.servlet.ServletContextHandler.doStart(ServletContextHandler.java:262)

at org.eclipse.jetty.webapp.WebAppContext.doStart(WebAppContext.java:520)

at org.eclipse.jetty.maven.plugin.JettyWebAppContext.doStart(JettyWebAppContext.java:398)

at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)

at org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:131)

at org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:113)

at org.eclipse.jetty.server.handler.AbstractHandler.doStart(AbstractHandler.java:61)

at org.eclipse.jetty.server.handler.ContextHandlerCollection.doStart(ContextHandlerCollection.java:161)

at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)

at org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:131)

at org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:113)

at org.eclipse.jetty.server.handler.AbstractHandler.doStart(AbstractHandler.java:61)

at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)

at org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:131)

at org.eclipse.jetty.server.Server.start(Server.java:422)

at org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:105)

at org.eclipse.jetty.server.handler.AbstractHandler.doStart(AbstractHandler.java:61)

at org.eclipse.jetty.server.Server.doStart(Server.java:389)

at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)

at org.eclipse.jetty.maven.plugin.AbstractJettyMojo.startJetty(AbstractJettyMojo.java:460)

at org.eclipse.jetty.maven.plugin.AbstractJettyMojo.execute(AbstractJettyMojo.java:328)

at org.eclipse.jetty.maven.plugin.JettyRunMojo.execute(JettyRunMojo.java:170)

at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo(DefaultBuildPluginManager.java:134)

at org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:207)

at org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:153)

at org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:145)

at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject(LifecycleModuleBuilder.java:116)

at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject(LifecycleModuleBuilder.java:80)

at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build(SingleThreadedBuilder.java:51)

at org.apache.maven.lifecycle.internal.LifecycleStarter.execute(LifecycleStarter.java:128)

at org.apache.maven.DefaultMaven.doExecute(DefaultMaven.java:307)

at org.apache.maven.DefaultMaven.doExecute(DefaultMaven.java:193)

at org.apache.maven.DefaultMaven.execute(DefaultMaven.java:106)

at org.apache.maven.cli.MavenCli.execute(MavenCli.java:863)

at org.apache.maven.cli.MavenCli.doMain(MavenCli.java:288)

at org.apache.maven.cli.MavenCli.main(MavenCli.java:199)

at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)

at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

at java.lang.reflect.Method.invoke(Method.java:498)

at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced(Launcher.java:289)

at org.codehaus.plexus.classworlds.launcher.Launcher.launch(Launcher.java:229)

at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode(Launcher.java:415)

at org.codehaus.plexus.classworlds.launcher.Launcher.main(Launcher.java:356)

at org.codehaus.classworlds.Launcher.main(Launcher.java:47)

at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)

at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

at java.lang.reflect.Method.invoke(Method.java:498)

at com.intellij.rt.execution.application.AppMain.main(AppMain.java:147)

and if I comment in ServiceManagementConfigFilter, I get the following exception:

com.google.apphosting.api.ApiProxy$CallNotFoundException: The API package 'memcache' or call 'Get()' was not found.

at com.google.apphosting.api.ApiProxy$1.get(ApiProxy.java:173)

at com.google.apphosting.api.ApiProxy$1.get(ApiProxy.java:171)

at com.google.appengine.api.utils.FutureWrapper.get(FutureWrapper.java:89)

at com.google.appengine.api.memcache.MemcacheServiceImpl.quietGet(MemcacheServiceImpl.java:26)

at com.google.appengine.api.memcache.MemcacheServiceImpl.get(MemcacheServiceImpl.java:49)

at com.google.appengine.api.appidentity.AppIdentityServiceImpl.getAccessToken(AppIdentityServiceImpl.java:286)

at com.google.api.config.ServiceConfigSupplier.getAccessToken(ServiceConfigSupplier.java:151)

at com.google.api.config.ServiceConfigSupplier.fetch(ServiceConfigSupplier.java:118)

at com.google.api.config.ServiceConfigSupplier.get(ServiceConfigSupplier.java:104)

at com.google.api.config.ServiceConfigSupplier.get(ServiceConfigSupplier.java:48)

at com.google.common.base.Suppliers$ExpiringMemoizingSupplier.get(Suppliers.java:199)

at com.google.api.config.ServiceConfigFetcher.fetch(ServiceConfigFetcher.java:41)

at com.google.api.control.ServiceManagementConfigFilter$1.load(ServiceManagementConfigFilter.java:33)

at com.google.api.control.ConfigFilter.init(ConfigFilter.java:87)