Recommended Versions for Installing Apicurio Registry with PostgreSQL Persistence and Security Based on Keycloak

[ramongaldon]

Hi,

We have successfully installed version 2.6 of Apicurio Registry with Postgree persistence and secured the UI using users defined in Keycloak. However, when enabling API security, we are receiving a 401 Unauthorized error for all requests. After reviewing the documentation, we did not find any missing properties, and we believe the issue might be that we are not using the most suitable product version for our goal of securing API operations using the 3 predefined roles (sr-admin, sr-developer, and sr-readonly).

Should we be using version 3.0? We've encountered issues with Postgree persistence when using a dockerized installation of this version, but with version 2.6.x it worked almost perfectly from the start. However, securing the API and ensuring that methods can only be invoked by users with the appropriate role is crucial for us.

Could you provide guidance on this?

[carlesarnal]

Hello,

I would normally advocate for using the newest vesion, specially if you're into the exploratory phase. As for the existing options, we do have examples for this, here for 3.0 and here for 2.6.x. Let me know if anything is not working so we can go through it.

[EricWittmann]

We have successfully installed version 2.6 of Apicurio Registry with Postgree persistence and secured the UI using users defined in Keycloak. However, when enabling API security, we are receiving a 401 Unauthorized error for all requests. After reviewing the documentation, we did not find any missing properties, and we believe the issue might be that we are not using the most suitable product version for our goal of securing API operations using the 3 predefined roles (sr-admin, sr-developer, and sr-readonly).

Can you provide examples of how you are accessing the Registry that results in the 401 errors? Are you calling the REST API directly? Using the UI? Maybe trying the SDK?

What type of authentication are you using when accessing the Registry ? Are you using BASIC auth in curl? Are you using a token? How are you getting the token? If you're using a token, can you decode it and see what roles are in it?

Should we be using version 3.0? We've encountered issues with Postgree persistence when using a dockerized installation of this version, but with version 2.6.x it worked almost perfectly from the start. However, securing the API and ensuring that methods can only be invoked by users with the appropriate role is crucial for us.

I definitely recommend 3.0 unless you need to be in production immediately, then maybe 2.6 is more stable and makes more sense. But I would really like to know what problems you are having with 3.0 + Postgresql. We have a dev server that we run in this configuration and haven't had any problems with it.