OAuth2ClientCredentialsAuthPlugin: fatal error: concurrent map writes

[eubaranov]

Short description

Golang version: 1.19
Lib versions the issue detected: v0.53.1, v0.59.0
Occurance: floating (rare and random)

In all occurrences, the last running goroutine stack pointed to the same place - createAuthJWT
Stack trace example report for the v0.53.1 (the trace for v0.59.0 is the same):

goroutine 298 [running]:
github.com/open-policy-agent/opa/plugins/rest.(*oauth2ClientCredentialsAuthPlugin).createAuthJWT(0xc0030eec30, 0xc002ea1890, {0x161e140, 0xc002457560})
/go/pkg/mod/github.com/open-policy-agent/[email protected]/plugins/rest/auth.go:221 +0x43d
github.com/open-policy-agent/opa/plugins/rest.(*oauth2ClientCredentialsAuthPlugin).requestToken(0xc0030eec30, {0x1cbc420, 0xc0031e4e40})
/go/pkg/mod/github.com/open-policy-agent/[email protected]/plugins/rest/auth.go:333 +0x385
github.com/open-policy-agent/opa/plugins/rest.(*oauth2ClientCredentialsAuthPlugin).Prepare(0xc0030eec30, 0xc0050b1600)
/go/pkg/mod/github.com/open-policy-agent/[email protected]/plugins/rest/auth.go:403 +0x187
github.com/open-policy-agent/opa/plugins/rest.(*Config).authPrepare(0xc002accee0?, 0x0?, 0x1722757?)
/go/pkg/mod/github.com/open-policy-agent/[email protected]/plugins/rest/rest.go:122 +0x48
github.com/open-policy-agent/opa/plugins/rest.Client.Do({0x0, 0x0, {{0xc000cd7020, 0x4}, {0xc0012c4360, 0x1b}, 0x0, 0x0, 0xc000cd7068, 0x0, ...}, ...}, ...)
/go/pkg/mod/github.com/open-policy-agent/[email protected]/plugins/rest/rest.go:303 +0x745
github.com/open-policy-agent/opa/download.(*Downloader).download(0xc00140e820, {0x1cbc420, 0xc0031e4e40}, {0x1cc2170?, 0xc004814040})
/go/pkg/mod/github.com/open-policy-agent/[email protected]/download/download.go:301 +0x837
github.com/open-policy-agent/opa/download.(*Downloader).oneShot(0xc00140e820, {0x1cbc420, 0xc0031e4e40})
/go/pkg/mod/github.com/open-policy-agent/[email protected]/download/download.go:256 +0x85
github.com/open-policy-agent/opa/download.(*Downloader).loop(0xc00140e820, {0x1cbc420, 0xc0031e4e40})
/go/pkg/mod/github.com/open-policy-agent/[email protected]/download/download.go:219 +0xc9
created by github.com/open-policy-agent/opa/download.(*Downloader).doStart
/go/pkg/mod/github.com/open-policy-agent/[email protected]/download/download.go:183 +0xca

Steps To Reproduce

N/A - The problem is floating

Expected behavior

oauth2ClientCredentialsAuthPlugin.Claims map protected with some kind of synchronization

Additional context

[srenatus]

createAuthJWT that method looks suspicious in its handling of the claims function argument. Looks like it could be a low-hanging fruit, though, would you be up to contribute a fix? 😃

[eubaranov]

yep, sure