Loopback.io 401 on remote method?

Question

I've defined a remote method named retrieve

and the following roles admin, barkeeper.

The model acl is

"acls": [
{
  "accessType": "*",
  "principalType": "ROLE",
  "principalId": "$everyone",
  "permission": "DENY"
},
{
  "accessType": "*",
  "principalType": "ROLE",
  "principalId": "admin",
  "permission": "ALLOW"
},
{
  "accessType": "EXECUTE",
  "principalType": "ROLE",
  "principalId": "barkeeper",
  "permission": "ALLOW",
  "property": "retrieve"
}
],

The problem is that when I'm logged in either as an admin user or a barkeeper user and call /retrieve I get 401

Any ideas?

Edit:

Loopback logs show:

loopback:security:access-context ---AccessContext---
loopback:security:access-context principals:
loopback:security:access-context principal: {"type":"USER","id":"583adfd78753a610006c586b"}
loopback:security:access-context modelName Order
loopback:security:access-context modelId undefined
loopback:security:access-context property retrieve
loopback:security:access-context method retrieve
loopback:security:access-context accessType READ
loopback:security:access-context accessToken:
loopback:security:access-context   id "wm54iPCZuOYWBYujAHFKloo4GWHq3ceDvDaRui1YjOlDLxeQWznQ3cRdolWHu0sc"
loopback:security:access-context   ttl 1209600
loopback:security:access-context getUserId() 583adfd78753a610006c586b
loopback:security:access-context isAuthenticated() true
loopback:security:role Custom resolver found for role $everyone
loopback:security:role isInRole(): admin
loopback:security:access-context ---AccessContext---
loopback:security:access-context principals:
loopback:security:access-context principal: {"type":"USER","id":"583adfd78753a610006c586b"}
loopback:security:access-context modelName Order
loopback:security:access-context modelId undefined
loopback:security:access-context property retrieve
loopback:security:access-context method retrieve
loopback:security:access-context accessType READ
loopback:security:access-context accessToken:
loopback:security:access-context   id "wm54iPCZuOYWBYujAHFKloo4GWHq3ceDvDaRui1YjOlDLxeQWznQ3cRdolWHu0sc"
loopback:security:access-context   ttl 1209600
loopback:security:access-context getUserId() 583adfd78753a610006c586b
loopback:security:access-context isAuthenticated() true
loopback:security:role isInRole(): admin
loopback:security:access-context ---AccessContext---
loopback:security:access-context principals:
loopback:security:access-context principal: {"type":"USER","id":"583adfd78753a610006c586b"}
loopback:security:access-context modelName Order
loopback:security:access-context modelId undefined
loopback:security:access-context property retrieve
loopback:security:access-context method retrieve
loopback:security:access-context accessType READ
loopback:security:access-context accessToken:
loopback:security:access-context   id "wm54iPCZuOYWBYujAHFKloo4GWHq3ceDvDaRui1YjOlDLxeQWznQ3cRdolWHu0sc"
loopback:security:access-context   ttl 1209600
loopback:security:access-context getUserId() 583adfd78753a610006c586b
loopback:security:access-context isAuthenticated() true
loopback:security:role isInRole(): barkeeper
loopback:security:access-context ---AccessContext---
loopback:security:access-context principals:
loopback:security:access-context principal: {"type":"USER","id":"583adfd78753a610006c586b"}
loopback:security:access-context modelName Order
loopback:security:access-context modelId undefined
loopback:security:access-context property retrieve
loopback:security:access-context method retrieve
loopback:security:access-context accessType READ
loopback:security:access-context accessToken:
loopback:security:access-context   id "wm54iPCZuOYWBYujAHFKloo4GWHq3ceDvDaRui1YjOlDLxeQWznQ3cRdolWHu0sc"
loopback:security:access-context   ttl 1209600
loopback:security:access-context getUserId() 583adfd78753a610006c586b
loopback:security:access-context isAuthenticated() true
loopback:security:role Role found: {"id":"583adfd78753a610006c586a","name":"admin","created":"2016-11-27T13:29:58.664Z","modified":"2016-11-27T13:29:58.664Z"}
loopback:security:role Role found: {"id":"583adfd78753a610006c586a","name":"admin","created":"2016-11-27T13:29:58.664Z","modified":"2016-11-27T13:29:58.664Z"}
loopback:security:role Role found: {"id":"583adfd78753a610006c586d","name":"barkeeper","created":"2016-11-27T13:29:58.665Z","modified":"2016-11-27T13:29:58.665Z"}
loopback:security:role Role mapping found: null
loopback:security:role isInRole() returns: null
loopback:security:role Role mapping found: null
loopback:security:role isInRole() returns: null
loopback:security:role Role mapping found: null
loopback:security:role isInRole() returns: null
loopback:security:acl The following ACLs were searched: 
loopback:security:acl ---ACL---
loopback:security:acl model Order
loopback:security:acl property *
loopback:security:acl principalType ROLE
loopback:security:acl principalId $everyone
loopback:security:acl accessType *
loopback:security:acl permission DENY
loopback:security:acl with score: 7495
loopback:security:acl ---Resolved---
loopback:security:access-context ---AccessRequest---
loopback:security:access-context  model Order
loopback:security:access-context  property retrieve
loopback:security:access-context  accessType READ
loopback:security:access-context  permission DENY
loopback:security:access-context  isWildcard() false
loopback:security:access-context  isAllowed() false
Unhandled error for request GET /Orders/retrieve?access_token=wm54iPCZuOYWBYujAHFKloo4GWHq3ceDvDaRui1YjOlDLxeQWznQ3cRdolWHu0sc: Error: Authorization Required

Why is it resolving with that ACL if the user has admin role?

Could you run set DEBUG=loopback:security:acl && node . (windows) or DEBUG=loopback:security:acl node . (Unix), then make an authenticated requests and show the output of the console ? — Overdrivr
Basically the idea is to use debug strings for figuring out what is going on. — Overdrivr
Ah sorry I meant to use a broader debug string -> set DEBUG=loopback:security:* && node . This one will display all logs under the security category — Overdrivr

Acapulco Acapulco · Accepted Answer · 2016-11-27T14:39:42

Where are you creating your admin and barkeeper roles and the RoleMappings for your users and their roles?

I.e., In the documentation example Users are created as a one-time operation, and then later the Role and RoleMappings are created.

In your logs you can see that there doesn't seem to be any RoleMapping for your user (the arrows), even though the Role is clearly there:

loopback:security:role Role found: {"id":"583adfd78753a610006c586a","name":"admin","created":"2016-11-27T13:29:58.664Z","modified":"2016-11-27T13:29:58.664Z"}
loopback:security:role Role found: {"id":"583adfd78753a610006c586a","name":"admin","created":"2016-11-27T13:29:58.664Z","modified":"2016-11-27T13:29:58.664Z"}
loopback:security:role Role found: {"id":"583adfd78753a610006c586d","name":"barkeeper","created":"2016-11-27T13:29:58.665Z","modified":"2016-11-27T13:29:58.665Z"}
loopback:security:role Role mapping found: null   <------- 
loopback:security:role isInRole() returns: null   <------- 
loopback:security:role Role mapping found: null   <------- 
loopback:security:role isInRole() returns: null   <------- 
loopback:security:role Role mapping found: null   <------- 
loopback:security:role isInRole() returns: null   <-------

Maybe there's an error with the code that assigns those RoleMappings to the Users.

Loopback.io 401 on remote method?

1 Answers