500 on policy upload

[#1]

trying to upload a policy through this endpoint

https://api.enterprise.apigee.com/v1/organizations/zap/apis/the-API/revisions/21/policies

and getting 500 status :

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Error>
    <Code>beans.OtherValidationError</Code>
    <Message>Unexpected Validation Error null</Message>
    <Contexts/>
</Error>

thats the policy im sending

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<ServiceCallout async="false" continueOnError="true" enabled="true" name="Authenticate-Request">
    <DisplayName>Authenticate-Request</DisplayName>
    <Properties/>
    <Request clearPayload="true" variable="myRequest">
        <IgnoreUnresolvedVariables>false</IgnoreUnresolvedVariables>
        <Copy>
            <Headers>
                <Header name="mock-apps-storage"/>
            </Headers>
        </Copy>
        <Set>
            <Headers>
                <Header name="X-Request-Id">{messageid}</Header>
            </Headers>
            <Verb>POST</Verb>
        </Set>
    </Request>
    <Response>authenticationCalloutResponse</Response>
    <HTTPTargetConnection>
           <LoadBalancer>
            <Server name="applications-storage-service" />
        </LoadBalancer>

      
    </HTTPTargetConnection>
</ServiceCallout>

when i replace the loadbalncer with url property it works fine

[#2]

@Srinandan Sridhar, @YuriAbaev, @Saravanakumar Rajagopal

I have exactly the same problem. Using the UI, I can enter the <LoadBalancer> stanza and it works.

Uploading a proxy via Apigeetool fails with the same exceptions. I've taken apart the apigeetool code and it's doing the right thing; The Apigee API is throwing a 500 with

uri: https://api.enterprise.apigee.com/v1/o/{org}/apis/{proxyName}/revisions/7/policies
response body: {
  "code" : "beans.OtherValidationError",
  "message" : "Unexpected Validation Error null",
  "contexts" : [ ]
}
http status: 500

I've made apigeetool more explicit about the errors it gets.

I've just changed all my ServiceCallout HTTPTargets thus:

diff old new:
  <HTTPTargetConnection>
-   <LoadBalancer>
-     <Server name="OKTA_UK"/>
-   </LoadBalancer>
-   <Path>/api/v1/authn</Path>
+   <URL>https://xxx.okta.com/api/v1/authn</URL>
<SSLInfo>
<Enabled>true</Enabled>
...

apigeetool imports it perfectly, and the proxy works fine.

It should not be a huge issue, as we're not loadbalancing across many servers.

BUT you can't specify <Server name="OKTA"> if you use <URL>.

That only works with <LoadBalancer>

I do point OKTA_UK to different instances in dev, uat and prod, so it's important to do that in the Apigee environment and name them all OKTA_UK, as you can then upload verbatim the same proxy to different environments and they'll call out to the correct endpoints (different endpoint per env. but with same proxy text).

Having to hard-code the <URL> in this way (dev.okta.com vs uat.okta.com vs prod.okta.com) just to make apigeetool work would force us to have to edit the proxy text prior to deploy, which is poor practice.

We can't do CI/CD unless this is fixed. Or we have to create the URL in JS and then use {url} which is more brittle.

So, Apigee - could you please fix this ?

Many thanks,

Frederic Vander Elst (fve . phgroup com)

[ssvaidyanathan]

@fredericvanderelst - I just found that for the TargetServer to work, the revision needs to be deployed. The error comes if the revision is not deployed the environment where the Target Server is configured. This is applicable only when you use Target Server.

CURL:

curl -X POST \
  https://api.enterprise.apigee.com/v1/o/org/apis/myapi/revisions/1/policies \
  -H 'accept: application/xml' \
  -H 'authorization: Basic *****' \
  -H 'content-type: application/xml' \
  -d '<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<ServiceCallout async="false" continueOnError="true" enabled="true" name="Authenticate-Request">
    <DisplayName>Authenticate-Request</DisplayName>
    <Properties/>
    <Request clearPayload="true" variable="myRequest">
        <IgnoreUnresolvedVariables>false</IgnoreUnresolvedVariables>
        <Copy>
            <Headers>
                <Header name="mock-apps-storage"/>
            </Headers>
        </Copy>
        <Set>
            <Headers>
                <Header name="X-Request-Id">{messageid}</Header>
            </Headers>
            <Verb>POST</Verb>
        </Set>
    </Request>
    <Response>authenticationCalloutResponse</Response>
    <HTTPTargetConnection>
           <LoadBalancer>
            <Server name="APIFixerTS" />
        </LoadBalancer>
    </HTTPTargetConnection>
</ServiceCallout>'

I tried creating another policy (like a JavaScript policy) and updated the Service Callout to use a URL and both of them worked.

curl -X POST \
  https://api.enterprise.apigee.com/v1/o/org/apis/myapi/revisions/1/policies \
  -H 'accept: application/xml' \
  -H 'authorization: Basic ****' \
  -H 'content-type: application/xml' \
  -d '<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Javascript async="false" continueOnError="false" enabled="true" timeLimit="200" name="JavaScript-2">
    <DisplayName>JavaScript-2</DisplayName>
    <Properties/>
    <ResourceURL>jsc://JavaScript-1.js</ResourceURL>
</Javascript>'

curl -X POST \
  https://api.enterprise.apigee.com/v1/o/org/apis/myapi/revisions/1/policies \
  -H 'accept: application/xml' \
  -H 'authorization: Basic *****' \
  -H 'content-type: application/xml' \
  -d '<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<ServiceCallout async="false" continueOnError="true" enabled="true" name="Authenticate-Request">
    <DisplayName>Authenticate-Request</DisplayName>
    <Properties/>
    <Request clearPayload="true" variable="myRequest">
        <IgnoreUnresolvedVariables>false</IgnoreUnresolvedVariables>
        <Copy>
            <Headers>
                <Header name="mock-apps-storage"/>
            </Headers>
        </Copy>
        <Set>
            <Headers>
                <Header name="X-Request-Id">{messageid}</Header>
            </Headers>
            <Verb>POST</Verb>
        </Set>
    </Request>
    <Response>authenticationCalloutResponse</Response>
    <HTTPTargetConnection>
           <URL>http://example.com</URL>
    </HTTPTargetConnection>
</ServiceCallout>'

Not sure why it works only if the revision is deployed when target server is used.

[ssvaidyanathan]

@Floyd Jones @wwitman @arghya das - Is this an expected behavior?

[ssvaidyanathan]

@arghya das - any update on this ?