Disabling all auth methods except basic-auth on akhq 0.19 does not seem to be honoured

[nightswimmings]

I am trying to configure akhq so it only accepts basic-auth, and so far I assumed the proper way to do it is providing the following configuration on the helm chart

     micronaut:
        security:           # NOT HONOURED?: https://micronaut-projects.github.io/micronaut-security/2.5.0/guide/configurationreference.html
          enabled: true
          endpoints:
            login:
              enabled: false
            logout:
              enabled: false
            oauth:
              enabled: false
          oauth2:
            enabled: false
          token:
            enabled: false
            jwt:
              enabled: false
              bearer:
                enabled: false
              signatures:
                secret:
                  generator:
                    secret: thissecretisjustsetupforavoidingdefaultsecretwarningatstartup.

• akhq.security.basic-auth (...)

but It is apparently not honouring the setup. The login page shows up in the UI, and the warning message about the default secret is at startup even though i just disabled both token and jwt security.
Is this expected? Am I doing something wrong?

[tchiotludo]

You need to keep the jwt security, it's the way akhq work for all the authentication on the api side.
The default configuration is fine if you want to have only basic auth, and just add the configuration for akhq.security.basic-auth....

[tchiotludo]

no, there is no link between both of them.
But since you change the secret you will need to drop all cookie for akhq instance on your browser or use private navigation.

[ahajnal]

Thank you for the quick reply. I cleared the cookie (Chrome Dev Tools > Application > Cookies > Clear),
but it still does not work, and now I don't see new (updated) cookie among the cookies when trying re-login or reloading the UI.
Chrome incognito did not help either.
(In docker logs I see some maybe not new exception: "io.micronaut.security.errors.OauthErrorResponseException: null", but I don't have any OAuth settings.)
Sorry for the trouble.

[ahajnal]

Sorry, wait a bit, there is a warning:
2022-01-14 13:25:21,272 WARN pGroup-1-6 .s.t.j.v.JwtTokenValidator JOSEException while generating token The secret length must be at least 256 bits

My secret was too short...

[ahajnal]

It works. Thank you a lot. With a long enough secret I could log in.

ps. Congrats anyway, such a beautiful Java code, never seen before...

[tchiotludo]

Thanks @ahajnal really appreciate 👍