AWS Plugin - Authorization is required for this request

[LPedrosoVersed]

Greetings,

I have been trying to use the AWS Plugin for
One Identity Safeguard Secrets Broker DevOps Service, but I've been facing some issues. As soon as I try to perform the connection test the logs show:

####### LOG START #######

2023-06-16 15:44:44.239 -03:00 [INF] Executing OkObjectResult, writing value of type 'OneIdentity.DevOps.Data.Spp.A2ARetrievableAccount'.
2023-06-16 15:44:44.239 -03:00 [INF] Executed action OneIdentity.DevOps.Controllers.V1.PluginsController.PutPluginVaultAccount (SafeguardDevOpsService) in 385.1365ms
2023-06-16 15:44:44.239 -03:00 [INF] HTTP PUT /service/devops/v1/Plugins/AwsSecretsManagerVault/VaultAccount responded 200 in 385.2988 ms
2023-06-16 15:44:44.239 -03:00 [INF] Request finished HTTP/1.1 PUT https://localhost/service/devops/v1/Plugins/AwsSecretsManagerVault/VaultAccount application/json 104 - 200 336 application/json;+charset=utf-8 385.4066ms
2023-06-16 15:44:44.244 -03:00 [INF] Request starting HTTP/1.1 POST https://localhost/service/devops/v1/Plugins/AwsSecretsManagerVault/TestConnection text/plain 0
2023-06-16 15:44:44.244 -03:00 [INF] Route matched with {action = "TestPluginConnection", controller = "Plugins"}. Executing controller action with signature Microsoft.AspNetCore.Mvc.ActionResult TestPluginConnection(OneIdentity.DevOps.Logic.IPluginsLogic, System.String) on controller OneIdentity.DevOps.Controllers.V1.PluginsController (SafeguardDevOpsService).
2023-06-16 15:44:44.386 -03:00 [ERR] Failed to refresh the api key for AwsSecretsManagerVault account 3: Error returned from Safeguard API, Error: Forbidden {"Code":60108,"Message":"Authorization is required for this request.","InnerError":null}
OneIdentity.SafeguardDotNet.SafeguardDotNetException: Error returned from Safeguard API, Error: Forbidden {"Code":60108,"Message":"Authorization is required for this request.","InnerError":null}
at OneIdentity.SafeguardDotNet.A2A.SafeguardA2AContext.RetrievePassword(SecureString apiKey)
at OneIdentity.DevOps.Logic.PluginManager.GetPluginCredential(String name, String apiKey) in D:\a\1\s\SafeguardDevOpsService\Logic\PluginManager.cs:line 280
at OneIdentity.DevOps.Logic.PluginManager.SendPluginVaultCredentials(String name, String apiKey) in D:\a\1\s\SafeguardDevOpsService\Logic\PluginManager.cs:line 202
at OneIdentity.DevOps.Logic.PluginManager.RefreshPluginCredential(ISafeguardConnection sgConnection, Plugin plugin) in D:\a\1\s\SafeguardDevOpsService\Logic\PluginManager.cs:line 477
2023-06-16 15:44:44.387 -03:00 [INF] Executing BadRequestObjectResult, writing value of type 'OneIdentity.DevOps.Data.ErrorMessage'.
2023-06-16 15:44:44.387 -03:00 [INF] Executed action OneIdentity.DevOps.Controllers.V1.PluginsController.TestPluginConnection (SafeguardDevOpsService) in 142.6415ms
2023-06-16 15:44:44.387 -03:00 [INF] HTTP POST /service/devops/v1/Plugins/AwsSecretsManagerVault/TestConnection responded 400 in 143.6157 ms
2023-06-16 15:44:44.387 -03:00 [INF] Request finished HTTP/1.1 POST https://localhost/service/devops/v1/Plugins/AwsSecretsManagerVault/TestConnection text/plain 0 - 400 37 application/json;+charset=utf-8 143.7844ms

Log File:

SafeguardDevOpsService.log

####### LOG END #######

Configuration Safeguard Secrets Broker DevOps :

SPP Configuration:

[bnicholesdell]

This looks like a mis-configuration or an incomplete configuration of Secrets Broker. Are all of the three of the check icons on the main page green? Client Certificate, Web Certificate and Trusted Certificates. Did you import the trusted certificates from the Safeguard appliance and enable TLS connections? Is the Monitoring button available? If any of those things are not correctly configured, Secrets Broker will have authorization problem when trying to connect to Safeguard. According to the log messages, Secrets Broker is having issues getting the vault credential from Safeguard. Without the vault credential, it can't connect to AWS.

[LPedrosoVersed]

The tool shows as if the configuration is right, everything is green.

But I really have the feeling that the Client Certificate has a problem, because I couldn't upload any certificate, only when I used the CSR of the product itself and even so I couldn't upload that certificate in Safeguard for Privileged Passwords in the SSL/TLS Certificates tab. Have an idea what to do?

[bnicholesdell]

Take a look at the latest 7.4.0 release to see if it solved your problem. There were some bugs fixed in the area of certificate validation.