-
Notifications
You must be signed in to change notification settings - Fork 10
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
ApiClient default HttpClient fails to connect if protocol version is not HTTP_1_1 #126
Comments
Apologies for the late reply, but @holgerstolzenberg are you able to reproduce this using the example in the repo? That uses the default Http client and client credentials. I wonder what else may be factoring in here, perhaps the spring context? |
No worries. So I do have some new findings. I tried the example you linked with JDK-17 (Liberica) set up. I can confirm the issue is still happening, but only with OIDC enabled. Disabling OIDC on the server and using no credentials on the client the calls for e.g. listing stores succeed. I have to mention that in my test setup I run OpenFGA and Keycloak behind a Traefik reverse proxy. I did a quick test connecting to OFGA directly and it also worked with disabled OIDC. I had no time to setup Keycloak without Traefik, so that might play a role here. Still - even if the error should be related to Keycloak and/or Traefik, I would expect the client to fail with a more specific error instead of blocking indefinitely. I saw the other issue with the connect timeout not honoured, I suspect this might also be an internal issue when connecting to the OIDC provider. Yet changing the default behaviour to HTTP 1.1 is a good step as it mitigates the issue. I am not sure how to proceed with this, currently have no time to really dig deeper, but maybe the findings give you some hint on where to look at. |
Thanks @holgerstolzenberg. We've received reports of encountering GOAWAY frames when using HTTP 2, so it does appear there are issues with HTTP 2 and the java http client here. We made a change in #148 to use HTTP 1.1 by default. We'll need to dig deeper on the HTTP 2 issues, but at the current time we don't have a good idea of cause/fix, and as you noted, seems there are various issues out there with java and HTTP 2. |
Closing as being fixed with v0.8.1 |
Checklist
Description
I am using the SDK to connect to an OpenFGA instance. I am using Java 21 (Liberica) and operate in a Spring Boot context.
Taken the following code:
everything works. The thing that made it working for me was setting the underlying HttpClients protocol to
HTTP_1_1
.if you replace
final var client = new OpenFgaClient(clientConfiguration, apiClient);
withfinal var client = new OpenFgaClient(clientConfiguration);
- using the defaultApiClient
and then do whatever call to OpenFGA the connection will not get established. Instead the SDK blocks the call unlimited until the server cancels the call by timeout.This is due to to an unrestricted call of the
CompletableFuture
in the functionexchangeToken()
:https://github.com/openfga/java-sdk/blob/main/src/main/java/dev/openfga/sdk/api/OpenFgaApi.java#L1165
Expectation
Not sure actually. Just wanted to bring that to the table. Maybe HTTP_1_1 should be set as default, as you can find a lot of issues regarding HTTP/2 and Java in the wild.
At least the call should not block indefinitely but rather use the configured timeouts.
Reproduction
OpenFGA SDK version
0.7.1
OpenFGA version
v1.8.0
SDK Configuration
Via Java SDK, see provided code snippets
Logs
There are no logs. The client just blocks until the server closes the connection after the server side timeout.
References
None.
The text was updated successfully, but these errors were encountered: