Support Basic Auth

[lukos]

The http input for logstash supports basic auth but I can't see anywhere that it can be configured in this plugin. Am I correct?

It is a nice simple way of stopping attackers spamming a logging endpoint with junk events.

[FantasticFiasco]

You should specify your own implementation of IHttpClient when configuring the sink. In that custom implementation you should configure the HTTP client to use basic authentication.

[lukos]

Thanks. Any way to do this via configuration?

[FantasticFiasco]

Of course you can. Specify the full name of the class, and an instance of that class will be created when the configuration is read.

[FantasticFiasco]

Closed due to inactivity

[tlogik]

@FantasticFiasco do you have any examples of setting up the sink for Auth - the custom implementation of the IHttpClient needs to be injected i guess, but an example would greatly speed up the process :-)

[FantasticFiasco]

There's a article in the wiki describing how one would create a custom HTTP client that implements Basic Authentication, and then injects that client when configuring the sink,

Is that the information you are requesting or is there anything I can append to the article that would help you further?

[brunorsantos]

@FantasticFiasco, can you help with as example of a custom httpclient using "Serilog.Settings.Configuration"?
I know you show in column "JSON example" how to reach the namespace. But I'm in doubt about how can be passed the parameters (username and password) to create this custom instance

[FantasticFiasco]

@brunorsantos The custom client cannot be created in code, as shown on the wiki?

[brunorsantos]

@FantasticFiasco, I was trying to include sinks.http in an application that already uses settings.configuration.
And this application has many parameters organized in appsettings.json file by enviroment.
Is it possible only to use httpClient arg in the json only with a parametersless constructor?

[FantasticFiasco]

@brunorsantos Since you are using a JSON file to configure your application I assume you're using a dependency injection container, is that correct? Is that container accessible statically, or is its scoped to the application startup?

[brunorsantos]

@FantasticFiasco, I'm using depency injection and the container is scoped to startup.

I'm thinking about a creating a pull request with a implementation enabling this option directly by configuration.
I would create two possible parameters like: basicAuthenticationUsername and basicAuthenticationPassword. Passing them to a new constructor for "DefaultHttpClient"

What do you think about it?

[FantasticFiasco]

@brunorsantos I don't think providing configuration for basic authentication is the right way to go forward. Sure, it solves your use-case, but basic authentication is just one of many means of authentication, and supporting them all using configuration alternatives would be a nightmare to maintain.

Up until now I haven't found the use-case to support the IConfiguration parameter supported by Serilog.Settings.Configuration, but I think this to be the one to build that implementation upon.

My thinking is that you will have your username and password in IConfiguration, provided by JSON or any other Microsoft.Extensions.Configuration source, and then we'll add a new method to IHttpClient that accepts the IConfiguration and you can do whatever you want with that configuration object. I think your implementation of the HTTP client would look something like this.

public class BasicAuthenticatedHttpClient : IHttpClient
{
    private readonly HttpClient client;

    public BasicAuthenticatedHttpClient()
    {
        client = new HttpClient();
    }

    public void Configure(IConfiguration configuration)
    {
        var username = configuration["MyConfiguration:Username"];
        var password = configuration["MyConfiguration:Password"];

        client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue(
            "Basic",
            Convert.ToBase64String(Encoding.ASCII.GetBytes($"{username}:{password}")));
    }

    public Task<HttpResponseMessage> PostAsync(string requestUri, HttpContent content) =>
        client.PostAsync(requestUri, content);

    public void Dispose() =>
        client.Dispose();
}

Does this seem to be an acceptable solution to you?

[FantasticFiasco]

Version 7.0.0 has been released, with improved support for custom HTTP clients defined in application settings 🎆

Please see the wiki for a complete sample on how to send log events to a basic authenticated log server.