Hello there, anyone has experience with using a proxy in front of DataHub together with enabled

metadata_service_authentication

? I’m trying to get my recipes to use an extra header for authorization purposes. I could already confirm with the GraphQL endpoint that my headers containing the Google IAP token and the DataHub personal access token work. Example:

curl --location --request POST '<https://example.com/api/graphql>' \
  --header 'Authorization: Bearer <personal access token>' \
  --header 'Proxy-Authorization: Bearer <IAP token>' \
  --header 'Content-Type: application/json' \
  --data-raw '{"query": "{\n  me {\n    corpUser {\n        username\n    }\n  }\n}"}'

However, when trying to ingest using recipes, it seems like the emitter ignores the

extra_headers

field containing the proxy token. Example:

sink:
  type: "datahub-rest"
  config:
    server: "<https://example.com:443>"
    token: "<personal access token>"
    extra_headers:
      Proxy-Authorization: "Bearer <IAP token>"

Looking at the source code, it should be possible to set a custom header: https://github.com/datahub-project/datahub/blob/master/metadata-ingestion/src/datahub/emitter/rest_emitter.py#L82 Interestingly, the

extra_headers

field seems to work when no second (personal access) token is required and the proxy token is set as

Authorization

instead of `Proxy-Authorization`:

sink:
  type: "datahub-rest"
  config:
    server: "<https://example.com:443>"
    extra_headers:
      Authorization: "Bearer <IAP token>"

Of course, just setting the proxy token as

token

directly works too. I’m on v0.8.40.2. Any help greatly appreciated! Cheers

@big-carpet-38439 maybe you can help us with this request? 🙂

Hi there- So I'm assuming you have a proxy sitting in front of DataHub and thats what teh Proxy-Auth header is for?

Hi, yes. The Proxy-Auth header is exactly for that. It seems to work with curl, as the first example shows. However, setting the additional header for the proxy in the recipe does not.

And you're definitely pointing ingestion toward the proxy?

the

config.server

value is pointing to our proxy server which redirects than to DataHub REST API. Or what do you mean?

This looks correct

yes. so the example we used and hoped to work is the first one with

Proxy-Authorization

for our proxy. But it seemed like it does not get picked up correctly.

Can you try running with

DATAHUB_DEBUG=true

env variable @wooden-arm-26381 to see if that gives you some information about what might be going wrong here? I don't have datahub behind IAP to test this out but that env variable should print out the curl commands being used. That might help in debugging this problem further.

Running

datahub --debug ingest -c recipe.yaml

gives following output:

[2022-07-27 09:09:21,073] INFO     {datahub.cli.ingest_cli:99} - DataHub CLI version: 0.8.40.2
[2022-07-27 09:09:21,076] DEBUG    {datahub.cli.ingest_cli:105} - Using config: {'source': {'type': 'bigquery', 'config': {'project_id': 'my-gcp-project_id', 'env': 'DEV', 'include_views': False, 'table_pattern': {'deny': ['.*']}, 'include_table_lineage': False}}, 'sink': {'type': 'datahub-rest', 'config': {'server': '<https://example.com:443>', 'token': '<personal access token>', 'extra_headers': {'Proxy-Authorization': 'Bearer <IAP token>'}}}}

Looks like the recipe got rendered correctly but I’m getting this error:

[2022-07-27 09:09:21,515] ERROR    {datahub.entrypoints:165} - Unable to connect to <https://example.com:443/config> with status_code: 401. Maybe you need to set up authentication? Please check your configuration and make sure you are talking to the DataHub GMS (usually <datahub-gms-host>:8080) or Frontend GMS API (usually <frontend>:9002/api/gms).

I’m using the same URL as without metadata authentication. But accessing GraphQL with activated authentication via curl still worked.

When you are using curl for graphql (which is working) are you still going through the proxy or directly connecting to datahub without proxy?

In this case, there is no way to access the DataHub instance without going/authenticating through the proxy first, even when using curl.

Can you please share so other people in community can solve the same problem if encountered with Google IAP?