opened
mixmind
username_0
Hi,

I'm trying to create cluster of 2 nodes with nats-streaming-server and can't add password authorization.

config of first node:
```
# Client port of 4222 on all interfaces
port: 4222

# HTTP monitoring port
monitor_port: 8222

 
cluster {
	  listen: 0.0.0.0:6222
 	  authorization: {
		user: admin
		password: changeit
		timeout: 0

	  }
	  connect_retries: 10
	  routes = [
		nats://localhost:6223
	  ]

}
streaming {
	  id: cluster
	  store: file
	  dir: /data/store
	  cluster {
		  node_id: "nats_1"
		  bootstrap: true
		  peers: ["nats_2"]
		  raft_logging: true
		  log_path: /data/logs
	  }
	  store_limits: {
		  max_age: "336h"
	  }
	  hb_interval: "5s"
	  hb_timeout: "2s"
	  hb_fail_count: 2

}
authorization: {
	user: admin
	password: changeit
	timeout: 0

}
```
config of second node:

```
# Client port of 4222 on all interfaces
port: 14222

# HTTP monitoring port
monitor_port: 18222

cluster {
	  listen: 0.0.0.0:6223
	  authorization: {
		user: admin
		password: changeit
		timeout: 0

	  }
	  connect_retries: 10
	  routes = [
		nats://localhost:6222
	  ]

}
streaming {
	  id: cluster
	  store: file
	  dir: /data1/store
	  cluster {
		  node_id: "nats_2"
		  peers: ["nats_1"]
		  raft_logging: true
		  log_path: /data1/logs
	  }
	  store_limits: {
		  max_age: "336h"
	  }
	  hb_interval: "5s"
	  hb_timeout: "2s"
	  hb_fail_count: 2

}
authorization: {
	user: admin
	password: changeit
	timeout: 0
}
```

Every time when I put authorization block into cluster block, I'll receive a batch of authentication errors like this.
First node:
![Screenshot from 2020-10-08 22-32-08](https://user-images.githubusercontent.com/33128809/95504933-2555a600-09b6-11eb-8f50-6597e65340f5.png)

Second node:
![Screenshot from 2020-10-08 22-31-42](https://user-images.githubusercontent.com/33128809/95504884-140c9980-09b6-11eb-8e15-f3a89bcc54c3.png)


Does it normal behavior? Thanks
Nats cluster authorization
issue
created
wallyqs
username_1
In the cluster auth section you need to add the credentials used for the cluster:

```hcl
 	  authorization: {
		user: admin
		password: changeit
		timeout: 0

	  }
	  routes = [
		nats://admin:changeit@localhost:6223
	  ]
```
comment
closed
kozlovic
username_2
issue
created
kozlovic
username_2
By the way, in NATS Streaming clustering mode, you should not have only 2 nodes. RAFT based implementation recommends odd numbers. So I would make it a 3 nodes cluster.
comment
created
mixmind
username_0
There is something special in nats-streaming-server configuration in case i need to use nsc and nats-account-server?
Because just adding to conf 
```
operator: /nats-cluster/nsc/accounts/nats/O/O.jwt
resolver: URL(http://localhost:9090/jwt/v1/accounts/)
```
Fails with :
![Screenshot from 2020-10-08 23-09-15](https://user-images.githubusercontent.com/33128809/95508233-55ec0e80-09bb-11eb-8fd6-951e2bcd6347.png)
comment
created
mixmind
username_0
Yes, i know. Just for testing purposes I'm trying to create with 2. Thanks
comment
created
kozlovic
username_2
You need to provide the credential files for the user the Streaming server is going to use to connect to the NATS server:
```
streaming {
  ..
  credentials: '<path to creds file>'
  ..
}
```
comment
created
mixmind
username_0
comment
created
mixmind
username_0
You helped me to solve 2 problems, and i received a new one, maybe you can help with that too?
Config of first node
`# Client port of 4222 on all interfaces
port: 4222

# HTTP monitoring port
monitor_port: 8222

operator: /nsc/accounts/nats/O/O.jwt
resolver: URL(http://nats-account-server:9090/jwt/v1/accounts/)
authorization: {
	  user: admin
	  password: changeit
}
cluster {
	  listen: 0.0.0.0:6222
	  connect_retries: 10
	  authorization: {
		user: admin
		password: changeit
		timeout: 0
	  }
	  routes = [
		nats://admin:changeit@nats-streaming-2:6222
		nats://admin:changeit@nats-streaming-3:6222
	  ]
}

streaming {
	  id: cluster
	  store: file
	  dir: /data/store
	  credentials: /nsc/nkeys/creds/O/A/U.creds
	  cluster {
		  node_id: "nats_1"
		  bootstrap: true
		  raft_logging: true
		  peers: ["nats_2","nats_3"]
		  log_path: /data/logs
	  }
	  store_limits: {
		  max_age: "336h"
	  }
	  hb_interval: "5s"
	  hb_timeout: "2s"
	  hb_fail_count: 2
	  tls {
		  client_cert: "/data/cert/server-cert.pem"
		  client_key:  "/data/cert/server-key.pem"
		  client_ca: "/data/cert/rootCA.pem"
		  insecure: true
	  }
}

tls {
	  cert_file: "/data/cert/server-cert.pem"
	  key_file:  "/data/cert/server-key.pem"
	  ca_file: "/data/cert/rootCA.pem"
	  insecure: true
}`

There is 3 node in dockers with config and different ID's in it, and it's fails when I'm adding TLS, on local machine I don't have such problem
Error:
![Screenshot from 2020-10-09 00-04-18](https://user-images.githubusercontent.com/33128809/95513444-0e698080-09c3-11eb-9385-236868e06197.png)
comment
created
kozlovic
username_2
When you use operator, you can't have local `authorization{}` block (I mean it will be ignored).
The TLS seem to be ok (handshake complete ok), but to be clear, the `tls{}` block inside the `streaming{}` block is equivalent to a TLS configuration that you would have for a client connecting to the NATS Server with `tls{}` config that is at top-level (the last block in above configuration).

I am guessing you are trying to connect clients that may not be using credentials (JWT) to connect to this server. If the server itself was not properly configured it would not have been able to start when trying to creates its internal connections to the NATS server.
comment