* re-add the metrics that were existing prior to this PR, to keep them
for compatibility reasons with existing Grafana panels:
- opencloud_proxy_requests_total
- opencloud_proxy_errors_total
- opencloud_proxy_duration_seconds
* renamed new metric opencloud_proxy_request_total (that contains the
service label) to opencloud_proxy_service_request_total
* renamed new metric opencloud_proxy_duration_seconds (that contains
the service label) to opencloud_proxy_service_duration_seconds
Improve the metrics for the proxy service.
* extend the instrumenter middleware to add a label with the name of
the service the request is being dispatched to
* add a native Prometheus histogram that tracks the durations and also
includes a label for the name of the service the request is being
dispatched to, as well as a 'result' label ('success',
'client-error', 'server-error') based on the HTTP status code of the
response
* add per-service gauge functions to count the number of in-flight
requests
* add a counter for routing failures, for when an inbound request
cannot be mapped to a route
* extend the route.RoutingInfo struct with a service attribute, and a
Service() getter
* remove the 'routing_failure_count' metric, as it is redundant
Do not set WWW-Authenticate headers when an active signed URL
authentication attempt fails. Signed URL clients cannot respond to Basic
or Bearer challenges, and advertising them may trigger unintended
authentication prompts.
Keep returning 401 Unauthorized while preserving the existing challenge
behavior for unsigned requests and disabled signed URL mechanisms.
The legacy OC-Signature path already rejects methods outside
PRE_SIGNED_URL_ALLOWED_HTTP_METHODS, the JWT path did not. A leaked
signed download url could be used for PUT, DELETE, MOVE or PROPFIND
as the signing user for the lifetime of the signature.
This fixes error logs like
RR error when calling Createhome error="gateway: grpc failed with code CODE_INVALID_ARGUMENT" line=github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/create_home.go:87 service=proxy
e.g. during internal requests to the data provider.
This is to reduce the number of "proxy->gateway->users->ldap" roundtrips
for the tenant id mapping.
The cache currently has a non-configurable ttl of 10 min.
Related: #2310
When the tenant id coming in via the OIDC claims doesn't match the
tenant id on the provisioned user, a mapping can be configured and
resolved via the reva TenantAPI service (now started as part of the
"users" service).
Closes: #2310
When multi-tenancy is enable we now allow to specify an OIDC claim
against which the tenantid of the user resolved via CS3 apis is matched.
Partial: #2310
Alex Ababii