crossbar authentication with proxy - node.js

Question

We are reaching a point that we need to scale crossbar to use multiple cpu cores to improve performance. Because one crossbar worker can only run one realm, the only to scale is to use proxy workers.
I tried to add proxy worker to our crossbar configuration but can't get it working.
The crossbar documentation is very poor. I can only try to figure out how to configure it from the examples the provided here: https://github.com/crossbario/crossbar-examples/tree/master/proxy/.crossbar
So far, I've made my apps successfully registered with crossbar without updating anything on the app side. But when accessing the app from the browser, there is also a direct websocket call from the browser, which is not working. Inspecting on the browser shows error explicit role <None> on realm <realm1> configured for dynamic authenticator does not exist. I think it's probably related to the dynamic authentication.
Here's my original configuration with one worker and my updated configuration with one worker and one proxy.
original config with one worker:
{
"controller": {},
"version": 2,
"workers": [
{
"realms": [
{
"name": "realm1",
"roles": [
{
"name": "backend",
"permissions": [
{
"allow": {
"call": true,
"publish": true,
"register": true,
"subscribe": true
},
"cache": false,
"disclose": {
"caller": true,
"publisher": true
},
"match": "prefix",
"uri": ""
}
]
},
{
"name": "authenticated",
"permissions": [
{
"allow": {
"call": false,
"publish": false,
"register": false,
"subscribe": true
},
"cache": false,
"disclose": {
"caller": true,
"publisher": true
},
"match": "prefix",
"uri": "organisation.file.provision"
},
{
"allow": {
"call": false,
"publish": false,
"register": false,
"subscribe": true
},
"cache": false,
"disclose": {
"caller": true,
"publisher": true
},
"match": "prefix",
"uri": "organisation.notifications.updates"
},
{
"allow": {
"call": true,
"publish": false,
"register": false,
"subscribe": false
},
"cache": false,
"disclose": {
"caller": true,
"publisher": true
},
"match": "prefix",
"uri": "organisation.model"
},
{
"allow": {
"call": true,
"publish": true,
"register": false,
"subscribe": true
},
"cache": false,
"disclose": {
"caller": true,
"publisher": true
},
"match": "prefix",
"uri": "public."
}
]
},
{
"name": "anonymous",
"permissions": [
{
"allow": {
"call": true,
"publish": false,
"register": false,
"subscribe": false
},
"cache": true,
"disclose": {
"caller": true,
"publisher": true
},
"match": "exact",
"uri": "organisation.app.meta"
},
{
"allow": {
"call": true,
"publish": false,
"register": false,
"subscribe": false
},
"cache": false,
"disclose": {
"caller": true,
"publisher": true
},
"match": "prefix",
"uri": "anon."
}
]
}
]
}
],
"transports": [
{
"endpoint": {
"port": 8080,
"type": "tcp"
},
"options": {
"access_log": true,
"hsts": true
},
"paths": {
"/": {
"directory": "../web",
"type": "static"
},
"ws": {
"auth": {
"anonymous": {
"role": "anonymous",
"type": "static"
},
"ticket": {
"authenticator": "organisation.auth.authenticate",
"type": "dynamic"
},
"wampcra": {
"type": "static",
"users": {
"1": {
"role": "backend",
"secret": "********"
},
"monitor": {
"role": "devops",
"secret": "******"
}
}
}
},
"debug": false,
"options": {
"auto_fragment_size": 65536,
"auto_ping_interval": 10000,
"auto_ping_size": 4,
"auto_ping_timeout": 5000,
"close_handshake_timeout": 1000,
"echo_close_codereason": true,
"enable_webstatus": false,
"fail_by_drop": true,
"max_frame_size": 1048576,
"max_message_size": 1048576,
"open_handshake_timeout": 2500
},
"type": "websocket"
}
},
"type": "web"
}
],
"type": "router"
}
]
}
one worker and one proxy:
{
"controller": {},
"version": 2,
"workers": [
{
"realms": [
{
"name": "realm1",
"roles": [
{
"name": "backend",
"permissions": [
{
"allow": {
"call": true,
"publish": true,
"register": true,
"subscribe": true
},
"cache": true,
"disclose": {
"caller": true,
"publisher": true
},
"match": "prefix",
"uri": ""
}
]
},
{
"name": "authenticated",
"permissions": [
{
"allow": {
"call": false,
"publish": false,
"register": false,
"subscribe": true
},
"cache": false,
"disclose": {
"caller": true,
"publisher": true
},
"match": "prefix",
"uri": "organisation.file.provision"
},
{
"allow": {
"call": false,
"publish": false,
"register": false,
"subscribe": true
},
"cache": false,
"disclose": {
"caller": true,
"publisher": true
},
"match": "prefix",
"uri": "organisation.notifications.updates"
},
{
"allow": {
"call": true,
"publish": false,
"register": false,
"subscribe": false
},
"cache": false,
"disclose": {
"caller": true,
"publisher": true
},
"match": "prefix",
"uri": "organisation.model"
},
{
"allow": {
"call": true,
"publish": true,
"register": false,
"subscribe": true
},
"cache": false,
"disclose": {
"caller": true,
"publisher": true
},
"match": "prefix",
"uri": "public."
}
]
},
{
"name": "anonymous",
"permissions": [
{
"allow": {
"call": true,
"publish": false,
"register": false,
"subscribe": false
},
"cache": true,
"disclose": {
"caller": true,
"publisher": true
},
"match": "exact",
"uri": "organisation.app.meta"
},
{
"allow": {
"call": true,
"publish": false,
"register": false,
"subscribe": false
},
"cache": false,
"disclose": {
"caller": true,
"publisher": true
},
"match": "prefix",
"uri": "anon."
}
]
}
]
}
],
"transports": [
{
"serializer": "cbor",
"type": "rawsocket"
"endpoint": {
"type": "unix",
"path": "router.sock"
},
"options": {
"access_log": true,
"hsts": true
},
"auth": {
"cryptosign-proxy": {
"type": "dynamic",
"authenticator": "organisation.auth.authenticate"
},
"options": {
"max_message_size": 1048576
},
}
],
"type": "router"
},
{
"type": "proxy",
"connections": {
"conn1": {
"transport": {
"type": "rawsocket",
"endpoint": {
"type": "unix",
"path": "router.sock"
},
"url": "ws://localhost",
"serializer": "cbor"
}
},
"auth": {
"cryptosign-proxy": {
"type": "static"
}
}
},
"routes": {
"realm1": {
"anonymous": "conn1",
"backend": "conn1",
"authenticated": "conn1"
}
},
"transports": [
{
"type": "web",
"endpoint": {
"port": 8080,
"type": "tcp",
"shared": true,
"backlog": 1024
},
"options": {
"access_log": true,
"hsts": true
},
"paths": {
"/": {
"directory": "../web",
"type": "static"
},
"ws": {
"auth": {
"anonymous": {
"role": "anonymous",
"type": "static"
},
"ticket": {
"authenticator": "organisation.auth.authenticate",
"type": "dynamic"
},
"wampcra": {
"type": "static",
"users": {
"1": {
"role": "backend",
"secret": "*******n"
},
"monitor": {
"role": "devops",
"secret": "*****"
}
}
}
},
"debug": false,
"options": {
"auto_fragment_size": 65536,
"auto_ping_interval": 10000,
"auto_ping_size": 13,
"auto_ping_timeout": 5000,
"close_handshake_timeout": 1000,
"echo_close_codereason": true,
"enable_webstatus": false,
"fail_by_drop": true,
"max_frame_size": 1048576,
"max_message_size": 1048576,
"open_handshake_timeout": 2500
},
"type": "websocket"
},
"info": {
"type": "nodeinfo"
}
},
}
]
}
]
}