Deploying Profile MFE on Juniper Instance

BbrSofiane · October 14, 2020, 5:53pm

I’m trying to run the profile MFE on a running Juniper instance using the role from this PR.

I cherry-picked the commits into the local configuration repo, then I run the role (had to add a handlers folder for reload nginx) and then I configured the LMS as described in the PR. When I go to the profile page I get successfully redirected to the right URL but then I get this error:

Looking at the LMS log I see:
[service_variant=lms][edx_rest_framework_extensions.auth.jwt.middleware][env:sandbox] WARNING [ip-172-31-16-169 3554] [user 12] [middleware.py:244] - Both JWT auth cookies missing. JWT auth cookies will not be reconstituted.

I’m not quite sure what to check in my JWT configuration, any pointers would be much appreciated !

(pinging you in case you’ve come across this @morenol)

morenol · October 14, 2020, 9:44pm

Hi @BbrSofiane,

I think that you can solve that by enabling the CONFIGURE_JWTS configuration in order to generate the JWT settings automatically for you in the deployment of edxapp.

github.com

edx/configuration/blob/3aff81a1b4a92085d52123e191133ea11b8a8e7b/playbooks/roles/common_vars/defaults/main.yml#L287


COMMON_DECRYPT_CONFIG_ENABLED: false
COMMON_COPY_CONFIG_ENABLED: false

# Disable logging of config rendering which has secrets
COMMON_CONFIG_NO_LOGGING: True

# Default sandbox build flag to false
SANDBOX_CONFIG: False

# Should we create the JWT settings?
CONFIGURE_JWTS: false

# Variable to control setting up the retirement services
COMMON_RETIREMENT_SERVICE_SETUP: false

# How to log in as "lms" to xqueue.
COMMON_XQUEUE_LMS_PASSWORD: password

That is enabled in the native installation playbook, so I guess that it should work:

github.com

edx/configuration/blob/e8aa4402a148af3115f71aec077f851650aff5eb/playbooks/openedx_native.yml#L36


COMMON_LMS_BASE_URL: "{{ EDXAPP_LMS_BASE_SCHEME }}://{{ EDXAPP_LMS_BASE }}"
EDXAPP_LMS_NGINX_PORT: '80'
EDX_PLATFORM_VERSION: 'master'
# Set to false if deployed behind another proxy/load balancer.
NGINX_SET_X_FORWARDED_HEADERS: True
DISCOVERY_URL_ROOT: 'http://localhost:{{ DISCOVERY_NGINX_PORT }}'
AWS_GATHER_FACTS: false
COMMON_ENABLE_AWS_ROLE: false
ecommerce_create_demo_data: true
credentials_create_demo_data: true
CONFIGURE_JWTS: true
SANDBOX_ENABLE_BLOCKSTORE: false
SANDBOX_ENABLE_DISCOVERY: true
SANDBOX_ENABLE_ECOMMERCE: true
SANDBOX_ENABLE_ANALYTICS_API: true
SANDBOX_ENABLE_INSIGHTS: true
SANDBOX_ENABLE_RABBITMQ: true
SANDBOX_ENABLE_NOTES: false
DEMO_ROLE_ENABLED: true
ECOMMERCE_ENABLE_COMPREHENSIVE_THEMING: false
EDXAPP_ENABLE_MEMCACHE: true

In the past, when I was not using the native installation I was able to generate the JWT configurations using a lms command:

python manage.py lms generate_jwt_signing_key

The output of that command should generate the missing configurations i.e. EDXAPP_JWT_SIGNING_ALGORITHM, COMMON_JWT_PUBLIC_SIGNING_JWK_SET and EDXAPP_JWT_PRIVATE_SIGNING_JWK. But I guess that with the CONFIGURE_JWT configuration that would not be necessary.

Once you add that configurations to your variables I think that with a deployment to edxapp, your problem should be solved. Let me know if that works

BbrSofiane · October 15, 2020, 10:20pm

I had a look and my JWT was configured as expected from the default install script. I had another instance on the same domain and I think that was interfering. I tried it with that other instance and it works fine.

Thanks for the work on the deployment script! It was effortless to use.

samueljacob · February 23, 2021, 12:28pm

Hi @BbrSofiane ,

Were you able to move past the Both JWT auth cookies missing. JWT auth cookies will not be reconstituted issue ?
I’m running Koa.1 on azure. And I’m facing this same issue on the basket page when trying to upgrade to verified.

Logs:
Feb 23 17:47:22 apcwokoa [service_variant=ecommerce][edx_rest_framework_extensions.auth.jwt.middleware] WARNING [apcwokoa 59199] [/edx/app/ecommerce/venvs/ecommerce/lib/python3.8/site-packages/edx_rest_framework_extensions/auth/jwt/middleware.py:245] - Both JWT auth cookies missing. JWT auth cookies will not be reconstituted.
Feb 23 17:47:22 apcwokoa [service_variant=ecommerce][edx_rest_framework_extensions.auth.jwt.middleware] INFO [apcwokoa 59199] [/edx/app/ecommerce/venvs/ecommerce/lib/python3.8/site-packages/edx_rest_framework_extensions/auth/jwt/middleware.py:70] - (‘The view BasketAddItemsView allows Jwt Authentication. The required permission class, NotJwtRestrictedApplication,’, ’ was automatically added.’)
Feb 23 17:48:46 apcwokoa [service_variant=ecommerce][edx_rest_framework_extensions.auth.jwt.middleware] WARNING [apcwokoa 59199] [/edx/app/ecommerce/venvs/ecommerce/lib/python3.8/site-packages/edx_rest_framework_extensions/auth/jwt/middleware.py:245] - Both JWT auth cookies missing. JWT auth cookies will not be reconstituted.

Any help would be deeply appreciated.

Thanks,
Samuel

BbrSofiane · February 24, 2021, 8:25am

Hi @samueljacob ,

From what I remember I had to make sure my CROSS_DOMAIN_CSRF_COOKIE_DOMAIN was configured incorrectly and it meant having a value that was ‘.your-lms-domain’.

samueljacob · February 24, 2021, 10:26am

Hi @BbrSofiane
I just reviewed my settings and noted that after a week of debugging and your advice pointing me to the right place, the issue seemed to arise from two configuration mistakes from my end :

The CROSS_DOMAIN_CSRF_COOKIE_DOMAIN should be set as the LMS domain only. [THANKS FOR YOUR HELP]
Ensure that FEATURES → ENABLE_CROSS_DOMAIN_CSRF_COOKIE: is set to true

Hope this helps others.

Thanks,
Samuel Jacob

BbrSofiane · February 24, 2021, 10:46am

Nice!

@morenol has written the instructions earlier this year so it should make things clearer for anyone else.

arbrandes · February 24, 2021, 2:42pm

A post was split to a new topic: Juniper certification?

Topic		Replies	Views
JWT and Juniper? Releases juniper	11	2818	April 23, 2020
JUNIPER.MASTER - Fresh Install: Forbidden (CSRF cookie not set.): /change_enrollment Site Operations Help	11	3040	September 3, 2020
Configuration change from Ironwood to Juniper? Site Operations Help	11	2091	January 18, 2021
Juniper Alpha basic installation Site Operators juniper	3	1181	January 10, 2020
Retirement username variables in Juniper alpha1 Site Operators juniper	11	904	February 6, 2020

Deploying Profile MFE on Juniper Instance

Related Topics