Rundeck Community Welcome Project部署遇AuthorizationInterceptor授权错误

问题重现 #

克隆Rundeck Community Welcome Project后执行部署命令：

docker-compose build
docker-compose up -d

出现授权错误：

rundeck  | [2023-04-03T09:21:06,530] ERROR interceptors.AuthorizationInterceptor - (unauthenticated) UNAUTHORIZED for api/invalid

同时client容器退出，完整日志：

rundeck  | [2023-04-03T09:21:06,478] INFO  api.requests "GET /api/26/system/info" 172.22.0.3 http admin form 26  (/ ms-rest-js/1.7.0 Node/v12.20.1 OS/(x64-Linux-5.15.90.1-microsoft-standard-WSL2))
client   | Rundeck started!!!
client   | ----------------------------------
client   | Importing Users
client   | ----------------------------------
client   | ----------------------------------
client   | importing users
client   | ----------------------------------
client   | importing user: alice
client   | email: alice@rundeck.io
client   | {}
client   | importing user: bonny
client   | email: bonny@rundeck.io
client   | {}
client   | importing user: charles
client   | email: charles@rundeck.io
client   | {}
client   | importing user: donny
client   | email: donny@rundeck.io
client   | {}
client   | importing user: eliot
client   | email: eliot@rundeck.io
client   | {}
client   | importing user: fred
client   | email: fred@rundeck.io
client   | {}
rundeck  | [2023-04-03T09:21:06,530] ERROR interceptors.AuthorizationInterceptor - (unauthenticated) UNAUTHORIZED for api/invalid
rundeck  | [2023-04-03T09:21:06,531] ERROR interceptors.AuthorizationInterceptor - (unauthenticated) UNAUTHORIZED for api/invalid
rundeck  | [2023-04-03T09:21:06,531] ERROR interceptors.AuthorizationInterceptor - (unauthenticated) UNAUTHORIZED for api/invalid
rundeck  | [2023-04-03T09:21:06,532] ERROR interceptors.AuthorizationInterceptor - (unauthenticated) UNAUTHORIZED for api/invalid
rundeck  | [2023-04-03T09:21:06,534] ERROR interceptors.AuthorizationInterceptor - (unauthenticated) UNAUTHORIZED for api/invalid
rundeck  | [2023-04-03T09:21:06,535] ERROR interceptors.AuthorizationInterceptor - (unauthenticated) UNAUTHORIZED for api/invalid
client exited with code 0

环境信息 #

• Rundeck版本：4.9.0
• 系统信息：

Linux LT432629 5.15.90.1-microsoft-standard-WSL2 #1 SMP Fri Jan 27 02:56:13 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
Description:    Ubuntu 20.04.6 LTS

• Docker环境：

Docker Compose version v2.15.1
Server: Docker Desktop
 Engine:
  Version:          20.10.23
  API version:      1.41 (minimum version 1.12)
  Go version:       go1.18.10
  Git commit:       6051f14
  Built:            Thu Jan 19 17:32:04 2023
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.6.18
  GitCommit:        2456e983eb9e37e47538f59ea18f2043c9a73640
 runc:
  Version:          1.1.4
  GitCommit:        v1.1.4-0-g5fd4c4d
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

• 容器状态：
  运行中容器：

NAME                IMAGE                               COMMAND                  SERVICE             CREATED             STATUS              PORTS
ciao                brotandgames/ciao                   "./start.sh"             ciao                33 hours ago        Up 33 hours         0.0.0.0:3000->3000/tcp
mysql               mysql:8                             "docker-entrypoint.s…"   mysql               33 hours ago        Up 33 hours         3306/tcp, 33060/tcp
node1               welcome-project-community-node      "/bin/sh -c '/usr/lo…"   node                33 hours ago        Up 33 hours         0.0.0.0:58322->22/tcp
node2               welcome-project-community-node2     "/bin/sh -c '/usr/lo…"   node2               33 hours ago        Up 33 hours         0.0.0.0:58321->22/tcp
rundeck             welcome-project-community-rundeck   "/tini -- docker-lib…"   rundeck             33 hours ago        Up 33 hours         0.0.0.0:4440->4440/tcp

已停止容器：

ciao                brotandgames/ciao                   "./start.sh"             ciao                33 hours ago        Up 33 hours               0.0.0.0:3000->3000/tcp
client              welcome-project-community-client    "docker-entrypoint.s…"   client              33 hours ago        Exited (0) 33 hours ago
mysql               mysql:8                             "docker-entrypoint.s…"   mysql               33 hours ago        Up 33 hours               3306/tcp, 33060/tcp
node1               welcome-project-community-node      "/bin/sh -c '/usr/lo…"   node                33 hours ago        Up 33 hours               0.0.0.0:58322->22/tcp
node2               welcome-project-community-node2     "/bin/sh -c '/usr/lo…"   node2               33 hours ago        Up 33 hours               0.0.0.0:58321->22/tcp
rundeck             welcome-project-community-rundeck   "/tini -- docker-lib…"   rundeck             33 hours ago        Up 33 hours               0.0.0.0:4440->4440/tcp

解决方案 #

1. 核对API Token一致性 #

client容器的用户导入脚本依赖API Token认证，需确保凭证匹配：

• 进入rundeck容器查看admin用户的API Token：

docker exec -it rundeck bash
cat /home/rundeck/.rundeck/apitokens/admin.token

• 检查client容器的环境变量或配置文件中的Token值，若不一致，修改后重新启动client容器。

2. 修正API端点路径 #

日志中api/invalid提示请求路径错误，需调整client脚本的API调用：

• 进入client容器，找到用户导入脚本（如import-users.js），确认API请求路径符合Rundeck 4.9.0的v26 API规范，例如用户创建的正确端点为/api/26/users。
• 修改脚本中的错误路径后，重启client容器。

3. 调整ACL权限策略 #

确保admin用户拥有API操作权限：

• 进入rundeck容器，编辑ACL配置文件（路径通常为/home/rundeck/etc/acls/），添加或更新策略：

description: 允许admin用户执行所有API操作
context:
  application: rundeck
for:
  api:
    - allow: '*'
by:
  group: admin

• 重启rundeck容器使配置生效：

docker-compose restart rundeck

4. 重新启动client容器 #

完成上述修复后，重新启动client容器并验证：

docker-compose up -d client
# 查看容器运行日志
docker logs client

内容的提问来源于stack exchange，提问作者Marcel