Permissions issues when trying to use this via entitlements-config

[wwsean08]

When investigating using this for managing github org membership for a new github org that my team is looking to make. In our case we are getting the output below. The github PAT I am using I've given all possible permissions just to validate that it is not the issue. I have uploaded my configs here, https://github.com/sean-smith-test/entitlements/tree/test-config in case that would help, and have verified that the GITHUB_API_BASE base is set.

Any assistance in understanding the permissions issue would be greatly appreciated.

Top level ::CompositeIO is deprecated, require 'multipart/post' and use `Multipart::Post::CompositeReadIO` instead!
Top level ::Parts is deprecated, require 'multipart/post' and use `Multipart::Post::Parts` instead!
D, [2022-08-19T12:07:19.491235 #77990] DEBUG -- : Loading people from "config/orgchart.yaml"
D, [2022-08-19T12:07:19.491624 #77990] DEBUG -- : Begin prefetch and validate for all groups
D, [2022-08-19T12:07:19.491864 #77990] DEBUG -- : Begin prefetch and validate for sean-smith-test
D, [2022-08-19T12:07:19.491954 #77990] DEBUG -- : Loading organization members and roles for sean-smith-test
D, [2022-08-19T12:07:19.492015 #77990] DEBUG -- : Setting up GitHub API connection to https://api.github.com/
WARNING: Unexpected middleware set after the adapter. This won't be supported from Faraday 1.0.
D, [2022-08-19T12:07:19.872553 #77990] DEBUG -- : Currently sean-smith-test has 0 admin(s) and 0 member(s)
D, [2022-08-19T12:07:19.872983 #77990] DEBUG -- : Finished prefetch and validate for sean-smith-test in 0.381097
D, [2022-08-19T12:07:19.873150 #77990] DEBUG -- : Finished all prefetch and validate in 0.381486
D, [2022-08-19T12:07:19.873214 #77990] DEBUG -- : Begin all calculations
D, [2022-08-19T12:07:19.873320 #77990] DEBUG -- : Calculating all groups for sean-smith-test
D, [2022-08-19T12:07:19.874561 #77990] DEBUG -- : Calculating members from /Users/sesmith/git/entitlements-config/github.com/sean-smith-test/org/member.txt
D, [2022-08-19T12:07:19.882282 #77990] DEBUG -- : Calculating members from /Users/sesmith/git/entitlements-config/github.com/sean-smith-test/org/member.yaml
D, [2022-08-19T12:07:19.884808 #77990] DEBUG -- : Calculating members from /Users/sesmith/git/entitlements-config/github.com/sean-smith-test/org/admin.txt
D, [2022-08-19T12:07:19.889698 #77990] DEBUG -- : Calculating members from /Users/sesmith/git/entitlements-config/github.com/sean-smith-test/org/admin.yaml
E, [2022-08-19T12:07:20.179811 #77990] ERROR -- : Got HTTP 401 POSTing to https://api.github.com/graphql
E, [2022-08-19T12:07:20.179916 #77990] ERROR -- : {"message":"Bad credentials","documentation_url":"https://docs.github.com/graphql"}
F, [2022-08-19T12:07:20.179985 #77990] FATAL -- : Abort due to GraphQL failure on "{\norganization(login: \"sean-smith-test\") {\npendingMembers(first: 100) {\nedges {\nnode {\nlogin\n}\ncursor\n}\n}\n}\n}"
Traceback (most recent call last):
        30: from ./bin/deploy-entitlements:29:in `<main>'
        29: from ./bin/deploy-entitlements:29:in `load'
        28: from /Users/sesmith/git/entitlements-config/vendor/gems/ruby/2.7.0/gems/entitlements-0.1.7/bin/deploy-entitlements:16:in `<top (required)>'
        27: from /Users/sesmith/git/entitlements-config/vendor/gems/ruby/2.7.0/gems/contracts-0.16.0/lib/contracts/method_handler.rb:138:in `block in redefine_method'
        26: from /Users/sesmith/git/entitlements-config/vendor/gems/ruby/2.7.0/gems/contracts-0.16.0/lib/contracts/call_with.rb:79:in `call_with'
        25: from /Users/sesmith/git/entitlements-config/vendor/gems/ruby/2.7.0/gems/contracts-0.16.0/lib/contracts/method_reference.rb:43:in `send_to'
        24: from /Users/sesmith/git/entitlements-config/vendor/gems/ruby/2.7.0/gems/entitlements-0.1.7/lib/entitlements/cli.rb:34:in `run'
        23: from /Users/sesmith/git/entitlements-config/vendor/gems/ruby/2.7.0/gems/contracts-0.16.0/lib/contracts/method_handler.rb:138:in `block in redefine_method'
        22: from /Users/sesmith/git/entitlements-config/vendor/gems/ruby/2.7.0/gems/contracts-0.16.0/lib/contracts/call_with.rb:79:in `call_with'
        21: from /Users/sesmith/git/entitlements-config/vendor/gems/ruby/2.7.0/gems/contracts-0.16.0/lib/contracts/method_reference.rb:43:in `send_to'
        20: from /Users/sesmith/git/entitlements-config/vendor/gems/ruby/2.7.0/gems/entitlements-0.1.7/lib/entitlements.rb:390:in `calculate'
        19: from /Users/sesmith/git/entitlements-config/vendor/gems/ruby/2.7.0/gems/entitlements-0.1.7/lib/entitlements.rb:390:in `map'
        18: from /Users/sesmith/git/entitlements-config/vendor/gems/ruby/2.7.0/gems/entitlements-0.1.7/lib/entitlements.rb:390:in `each'
        17: from /Users/sesmith/git/entitlements-config/vendor/gems/ruby/2.7.0/gems/entitlements-0.1.7/lib/entitlements.rb:391:in `block in calculate'
        16: from /Users/sesmith/git/entitlements-config/vendor/gems/ruby/2.7.0/gems/contracts-0.16.0/lib/contracts/method_handler.rb:138:in `block in redefine_method'
        15: from /Users/sesmith/git/entitlements-config/vendor/gems/ruby/2.7.0/gems/contracts-0.16.0/lib/contracts/call_with.rb:79:in `call_with'
        14: from /Users/sesmith/git/entitlements-config/vendor/gems/ruby/2.7.0/gems/contracts-0.16.0/lib/contracts/method_reference.rb:43:in `send_to'
        13: from /Users/sesmith/git/entitlements-config/plugins/backend/github_org/controller.rb:85:in `calculate'
        12: from /Users/sesmith/git/entitlements-config/vendor/gems/ruby/2.7.0/gems/contracts-0.16.0/lib/contracts/method_handler.rb:138:in `block in redefine_method'
        11: from /Users/sesmith/git/entitlements-config/vendor/gems/ruby/2.7.0/gems/contracts-0.16.0/lib/contracts/call_with.rb:79:in `call_with'
        10: from /Users/sesmith/git/entitlements-config/vendor/gems/ruby/2.7.0/gems/contracts-0.16.0/lib/contracts/method_reference.rb:43:in `send_to'
         9: from /Users/sesmith/git/entitlements-config/plugins/backend/github_org/controller.rb:251:in `changes'
         8: from /Users/sesmith/git/entitlements-config/vendor/gems/ruby/2.7.0/gems/contracts-0.16.0/lib/contracts/method_handler.rb:138:in `block in redefine_method'
         7: from /Users/sesmith/git/entitlements-config/vendor/gems/ruby/2.7.0/gems/contracts-0.16.0/lib/contracts/call_with.rb:79:in `call_with'
         6: from /Users/sesmith/git/entitlements-config/vendor/gems/ruby/2.7.0/gems/contracts-0.16.0/lib/contracts/method_reference.rb:43:in `send_to'
         5: from /Users/sesmith/git/entitlements-config/plugins/backend/github_org/provider.rb:79:in `pending_members'
         4: from /Users/sesmith/git/entitlements-config/vendor/gems/ruby/2.7.0/gems/contracts-0.16.0/lib/contracts/method_handler.rb:138:in `block in redefine_method'
         3: from /Users/sesmith/git/entitlements-config/vendor/gems/ruby/2.7.0/gems/contracts-0.16.0/lib/contracts/call_with.rb:79:in `call_with'
         2: from /Users/sesmith/git/entitlements-config/vendor/gems/ruby/2.7.0/gems/contracts-0.16.0/lib/contracts/method_reference.rb:43:in `send_to'
         1: from /Users/sesmith/git/entitlements-config/plugins/service/github.rb:109:in `pending_members'
/Users/sesmith/git/entitlements-config/plugins/service/github.rb:288:in `pending_members_from_graphql': GraphQL query failure (RuntimeError)

[DanHoerst]

@wwsean08 thanks for the report. I'm going to try to reproduce this and I'll get back to you.

[DanHoerst]

I created a brand new test organization danhoerst-test, and a PAT with the following scopes:

I then ran the query from above:

{
  organization(login: "danhoerst-test") {
    pendingMembers(first: 100) {
      edges {
        node {
          login
        }
        cursor
      }
    }
  }
}

and I get a successful response.

I did not configure my test org to use SSO. If you are requiring SSO, you'll need to also configure the new PAT for SSO to the org. You can do that in the same PAT settings where you created the PAT.

@wwsean08 if you're familiar with querying GraphQL directly, you could run the above query - substituting your test org in the login field - and verify your PAT that way.

I'm also going to try an entitlements run with my test org and PAT to verify that way.

[DanHoerst]

Using the same PAT as above, I configured my entitlements.yaml with:

  github.com/danhoerst-test/teams:
    addr: <%= ENV["GITHUB_API_BASE"] %>
    base: ou=teams,ou=github,ou=GitHub,dc=github,dc=com
    dir: github.com/danhoerst-test/org
    org: danhoerst-test
    token: <%= ENV["GITHUB_ORG_TOKEN"] %>
    type: "github_org"

and was able to run an entitlements run successfully:

I, [2022-08-23T12:16:30.845407 #36114]  INFO -- : CHANGE cn=admin,ou=teams,ou=github,ou=GitHub,dc=github,dc=com in github.com/danhoerst-test/teams
I, [2022-08-23T12:16:30.845460 #36114]  INFO -- : .  + rick
I, [2022-08-23T12:16:31.107575 #36114]  INFO -- : Successfully applied 2 change(s)!

I pushed a PR here with the config I'm using: github/entitlements-config#22

@wwsean08 are you able to double check the PAT has the correct permissions, is SSO'ed to the org (if necessary), and that your config points to the correct org?

[wwsean08]

I'm in meetings basically all day, but will try to circle back on this and give it a shot today.

[wwsean08]

Finally got around to retrying today after regenerating this PAT and the same issue. This is a brand new org for testing that doesn't have SSO configured so that wouldn't be the issue, and it does have all the required permissions and then some. I also realized the repo I linked was private so I made it public.

A colleague of mine was able to replicate and get around it in a fresh application. They replicated the error with faraday (>= 0.17.3, < 0.18), but when using octokit with faraday (< 3, >= 1) everything worked, so that may be what is causing it for me, though I don't know enough ruby to feel too comfortable saying that 100% is the issue.

[DanHoerst]

@wwsean08 thanks for the version breadcrumbs. I was able to replicate this as a problem with octokit (4.22.0).

I changed github/entitlements-config#22 to use octokit 4.22.0 and it failed. I reinstalled octokit 4.21.0 and it was successful.

I pulled down your branch at https://github.com/sean-smith-test/entitlements/tree/test-config but it did not have any plugins installed. I installed the entitlements-github-plugin, substituted in my github.com folder, and was able to replicate there as well. I then changed the octokit version to 4.21.0 and it was successful.

For an immediate fix, you can change octokit to 4.21.0 in your Gemfile.lock and run bundle install which should resolve your issue.

I'm going to go through our plugins and entitlements-app and make sure we're pinning the version there as well.

[wwsean08]

Thanks, I did that and validated the workaround worked.

[DanHoerst]

@wwsean08 we just pushed new gems - entitlements (0.1.8) and entitlements-github-plugin (0.0.2) - which solve this issue in a more permanent manner.

Thanks for reporting this issue and helping us out with troubleshooting!