home list archives users mailing list
 

Subject: Re: running examples in v. 3.0 GT

Date view Thread view Subject view Author view Attachment view

From: Steve White (swhite@aip.de)
Date: May 30, 2008 14:44

Ally,

It still fails, but I think it does so correctly now.
This helps a lot, thanks!

$ java uk.org.ogsadai.client.toolkit.gt.example.GTSecureSQLClient -u \
https://>:8443/wsrf/services/dai/ -d rftDatabase \
-q "SELECT * FROM request" -tls
=================================================================
DRER ID: DataRequestExecutionResource
Data Resource ID: rftDatabase
Base Services URL: https://astrodata07.gac-grid.org:8443/wsrf/services/dai/
SQLQuery: SELECT * FROM request
Transport level security with integrity
A problem has occured...
[1212154161316:3] uk.org.ogsadai.client.toolkit.REQUEST_ERROR : ogsadai-11a3a04a7a2
[1212154161316:4] uk.org.ogsadai.GENERAL_REQUEST_USER_EXCEPTION
[1212154161316:5] uk.org.ogsadai.GENERAL_ACTIVITY_USER_EXCEPTION
[1212154161316:6] uk.org.ogsadai.RESOURCE_UNKNOWN_ERROR : rftDatabase
=================================================================

Of course, the database isn't available to this user.

Cheers!

On 30.05.08, Ally Hume wrote:
> Steve,
>
> Just to confirm that you haven't unluckly missed the correct one of
> many combination! I think the following line is what you want:
>
> java uk.org.ogsadai.client.toolkit.gt.example.GTSecureSQLClient -u
> http://FULL_HOST_NAME:8443/wsrf/services/dai/ -d rftDatabase
> -q "SELECT * FROM request" -tls
>
> Does this fail? If so what is the error.
>
> If that fails try dropping the / after services/dai and see if that
> makes any difference.
>
> Ally
>
> 2008/5/30 Steve White <swhite@aip.de>:
> > Ally,
> >
> > I later read the line
> > "Note that because host authorization is used the client must specify the full name of the server and cannot use localhost."
> >
> > But that didn't help either. Substituting the proper address for localhost
> > gave the same results.
> >
> >
> > On 30.05.08, Steve White wrote:
> >> Ally,
> >>
> >> On 30.05.08, Ally Hume wrote:
> >> >
> >> > Ok so you are using transport level security with GT.
> >> >
> >> > > SERVICES_BASE_URL="http://localhost:8443/wsrf/services/dai/"
> >> >
> >> > This should be https.
> >> >
> >> I tried that farther down in my message.
> >>
> >> > But I think your problem is that the client you are using does not
> >> > support transport level security. The only OGSA-DAI client we have
> >> > written that supports GT security is
> >> > uk.org.ogsadai.client.toolkit.gt.example.GTSecureSQLClient. The
> >> > uk.org.ogsadai.client.toolkit.example.ServerClient does not support GT
> >> > security.
> >> >
> >> I see. So this example program wouldn't have worked anyway.
> >>
> >> So, I tried GTSecureSQLClient, with no luck.
> >>
> >> Many variations on commands from
> >>
> >> http://www.ogsadai.org.uk/documentation/ogsadai3.0/ogsadai3.0-gt/CheckServerCH.html#ExampleClients
> >>
> >> like
> >>
> >> $ java uk.org.ogsadai.client.toolkit.gt.example.GTSecureSQLClient \
> >> -u http://localhost:8443/wsrf/services/dai/ \
> >> -d rftDatabase \
> >> -q "SELECT * FROM request" \
> >> -secconv encrypt
> >>
> >> I tried https; it failed. I tried altering the last line as shown on
> >> the document page; it failed.
> >>
> >> Output looked like this
> >> ===================================================================
> >> DRER ID: DataRequestExecutionResource
> >> Data Resource ID: rftDatabase
> >> Base Services URL: http://localhost:8443/wsrf/services/dai/
> >> SQLQuery: SELECT * FROM request
> >> Transport level security with integrity
> >> Exception in thread "main" uk.org.ogsadai.client.toolkit.exception.ServerURLInvalidException: A problem occured initialising the server.
> >> at uk.org.ogsadai.client.toolkit.ServerFactory.getWSDL(Unknown Source)
> >> at uk.org.ogsadai.client.toolkit.ServerFactory.getServer(Unknown Source)
> >> at uk.org.ogsadai.client.toolkit.ServerProxy.getServer(Unknown Source)
> >> at uk.org.ogsadai.client.toolkit.ServerProxy.getDataRequestExecutionResource(Unknown Source)
> >> at uk.org.ogsadai.client.toolkit.example.SQLClient.execute(Unknown Source)
> >> at uk.org.ogsadai.client.toolkit.gt.example.GTSecureSQLClient.main(Unknown Source)
> >> Caused by: java.net.SocketException: Connection reset
> >> at java.net.SocketInputStream.read(SocketInputStream.java:168)
> >> at java.io.BufferedInputStream.fill(BufferedInputStream.java:218)
> >> at java.io.BufferedInputStream.read1(BufferedInputStream.java:256)
> >> at java.io.BufferedInputStream.read(BufferedInputStream.java:313)
> >> at sun.net.www.http.HttpClient.parseHTTPHeader(HttpClient.java:606)
> >> at sun.net.www.http.HttpClient.parseHTTP(HttpClient.java:554)
> >> at sun.net.www.http.HttpClient.parseHTTP(HttpClient.java:571)
> >> at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:939)
> >> at java.net.URL.openStream(URL.java:1007)
> >> ... 6 more
> >> ===================================================================
> >>
> >> > We really ought to write a version of ServerClient that supports GT
> >> > security. I applogise that we have not done this. Hopefully we can
> >> > add it to the next release. In the mean time I hope GTSecureSQLClient
> >> > will help you test that your service is running.
> >> >
> >> > If you wish hack source code yourself I think you would just need to
> >> > add static call to registerTransport somewhere in your code, e.g..
> >> > static { Util.registerTransport(); }
> >> >
> >> No time, unfortunately.
> >>
> >> Thanks!
> >>
> >>
> >> > 2008/5/30 Steve White <swhite@aip.de>:
> >> > > Hi,
> >> > >
> >> > > I seem to have deployed OGSA-DAI 3.0 (GT) on a Scientific Linux 4.6 system
> >> > > with GT v. 4.0.6, and JDK 1.5.0_07.
> >> > >
> >> > > To check it, I tried some of the example clients, but they haven't worked.
> >> > >
> >> > > On starting the Globus container, I see
> >> > >
> >> > > ==============================================================
> >> > > [48]: https://astrodata07.gac-grid.org:8443/wsrf/services/dai/DataRequestExecutionService
> >> > > [49]: https://astrodata07.gac-grid.org:8443/wsrf/services/dai/DataResourceInformationService
> >> > > [50]: https://astrodata07.gac-grid.org:8443/wsrf/services/dai/DataSinkService
> >> > > [51]: https://astrodata07.gac-grid.org:8443/wsrf/services/dai/DataSourceService
> >> > > [52]: https://astrodata07.gac-grid.org:8443/wsrf/services/dai/RequestManagementService
> >> > > [53]: https://astrodata07.gac-grid.org:8443/wsrf/services/dai/SessionManagementService
> >> > > ==============================================================
> >> > >
> >> > > As a user with full credentials and a grid proxy, I set up my environment
> >> > > like this:
> >> > >
> >> > > $ source setenv.sh
> >> > > $ export SERVICES_BASE_URL="http://localhost:8443/wsrf/services/dai/"
> >> > >
> >> > > (The latter isn't so clear: should it be http or https? I tried both.)
> >> > >
> >> > > Then
> >> > >
> >> > > $ java uk.org.ogsadai.client.toolkit.example.ServerClient -u $SERVICES_BASE_URL -c getVersion
> >> > >
> >> > > results in:
> >> > > ==============================================================
> >> > > Exception in thread "main" uk.org.ogsadai.client.toolkit.exception.ServerURLInvalidException: A problem occured initialising the server.
> >> > > at uk.org.ogsadai.client.toolkit.ServerFactory.getWSDL(Unknown Source)
> >> > > at uk.org.ogsadai.client.toolkit.ServerFactory.getServer(Unknown Source)
> >> > > at uk.org.ogsadai.client.toolkit.ServerProxy.getServer(Unknown Source)
> >> > > at uk.org.ogsadai.client.toolkit.ServerProxy.getVersion(Unknown Source)
> >> > > at uk.org.ogsadai.client.toolkit.example.ServerClient.execute(Unknown Source)
> >> > > at uk.org.ogsadai.client.toolkit.example.ServerClient.main(Unknown Source)
> >> > > Caused by: java.net.SocketException: Connection reset
> >> > > at java.net.SocketInputStream.read(SocketInputStream.java:168)
> >> > > at java.io.BufferedInputStream.fill(BufferedInputStream.java:218)
> >> > > at java.io.BufferedInputStream.read1(BufferedInputStream.java:256)
> >> > > at java.io.BufferedInputStream.read(BufferedInputStream.java:313)
> >> > > at sun.net.www.http.HttpClient.parseHTTPHeader(HttpClient.java:606)
> >> > > at sun.net.www.http.HttpClient.parseHTTP(HttpClient.java:554)
> >> > > at sun.net.www.http.HttpClient.parseHTTP(HttpClient.java:571)
> >> > > at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:939)
> >> > > at java.net.URL.openStream(URL.java:1007)
> >> > > ... 6 more
> >> > > ==============================================================
> >> > >
> >> > > The Globus container.log has
> >> > > ==============================================================
> >> > > 2008-05-28 17:29:53,468 ERROR container.GSIServiceThread [ServiceThread-11,process:141] Error processing request
> >> > > java.io.IOException: Token length 1195725856 > 33554432
> >> > > at org.globus.gsi.gssapi.net.impl.GSIGssInputStream.readToken(GSIGssInputStream.java:93)
> >> > > at org.globus.gsi.gssapi.net.impl.GSIGssInputStream.readHandshakeToken(GSIGssInputStream.java:54)
> >> > > at org.globus.gsi.gssapi.net.impl.GSIGssSocket.readToken(GSIGssSocket.java:60)
> >> > > at org.globus.gsi.gssapi.net.GssSocket.authenticateServer(GssSocket.java:122)
> >> > > at org.globus.gsi.gssapi.net.GssSocket.startHandshake(GssSocket.java:142)
> >> > > at org.globus.gsi.gssapi.net.GssSocket.getOutputStream(GssSocket.java:161)
> >> > > at org.globus.wsrf.container.GSIServiceThread.process(GSIServiceThread.java:98)
> >> > > at org.globus.wsrf.container.ServiceThread.run(ServiceThread.java:291)
> >> > > 2008-05-28 17:29:53,476 ERROR container.GSIServiceThread [ServiceThread-12,process:141] Error processing request
> >> > > java.io.IOException: Token length 1195725856 > 33554432
> >> > > at org.globus.gsi.gssapi.net.impl.GSIGssInputStream.readToken(GSIGssInputStream.java:93)
> >> > > at org.globus.gsi.gssapi.net.impl.GSIGssInputStream.readHandshakeToken(GSIGssInputStream.java:54)
> >> > > at org.globus.gsi.gssapi.net.impl.GSIGssSocket.readToken(GSIGssSocket.java:60)
> >> > > at org.globus.gsi.gssapi.net.GssSocket.authenticateServer(GssSocket.java:122)
> >> > > at org.globus.gsi.gssapi.net.GssSocket.startHandshake(GssSocket.java:142)
> >> > > at org.globus.gsi.gssapi.net.GssSocket.getOutputStream(GssSocket.java:161)
> >> > > at org.globus.wsrf.container.GSIServiceThread.process(GSIServiceThread.java:98)
> >> > > ==============================================================
> >> > >
> >> > > The bit about token length reminded me of something about https vs http
> >> > > so I tried:
> >> > >
> >> > > $ export SERVICES_BASE_URL="http://localhost:8443/wsrf/services/dai/"
> >> > >
> >> > > Now the same java command gives
> >> > > ==============================================================
> >> > > Exception in thread "main" uk.org.ogsadai.client.toolkit.exception.ServerURLInvalidException: A problem occured initialising the server.
> >> > > at uk.org.ogsadai.client.toolkit.ServerFactory.getWSDL(Unknown Source)
> >> > > at uk.org.ogsadai.client.toolkit.ServerFactory.getServer(Unknown Source)
> >> > > at uk.org.ogsadai.client.toolkit.ServerProxy.getServer(Unknown Source)
> >> > > at uk.org.ogsadai.client.toolkit.ServerProxy.getVersion(Unknown Source)
> >> > > at uk.org.ogsadai.client.toolkit.example.ServerClient.execute(Unknown Source)
> >> > > at uk.org.ogsadai.client.toolkit.example.ServerClient.main(Unknown Source)
> >> > > Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
> >> > > at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:150)
> >> > > at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1518)
> >> > > at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:174)
> >> > > at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:168)
> >> > > at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:848)
> >> > > at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:106)
> >> > > at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:495)
> >> > > at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:433)
> >> > > at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:818)
> >> > > at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1030)
> >> > > at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1057)
> >> > > at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1041)
> >> > > at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:402)
> >> > > at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:170)
> >> > > at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:916)
> >> > > at sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:234)
> >> > > at java.net.URL.openStream(URL.java:1007)
> >> > > ... 6 more
> >> > > Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
> >> > > at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:221)
> >> > > at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:145)
> >> > > at sun.security.validator.Validator.validate(Validator.java:203)
> >> > > at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:172)
> >> > > at com.sun.net.ssl.internal.ssl.JsseX509TrustManager.checkServerTrusted(SSLContextImpl.java:320)
> >> > > at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:841)
> >> > > ... 18 more
> >> > > Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
> >> > > at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:236)
> >> > > at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:194)
> >> > > at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:216)
> >> > > ... 23 more
> >> > > ==============================================================
> >> > >
> >> > > The container.log has
> >> > > ==============================================================
> >> > > 2008-05-28 17:34:51,535 ERROR container.GSIServiceThread [ServiceThread-12,process:141] Error processing request
> >> > > Authentication failed
> >> > > . Caused by
> >> > > Failure unspecified at GSS-API level
> >> > > . Caused by
> >> > > COM.claymoresystems.ptls.SSLCaughtAlertException: Unknown certificate processing problem
> >> > > at COM.claymoresystems.ptls.SSLRecordReader.processAlert(SSLRecordReader.java:153)
> >> > > at COM.claymoresystems.ptls.SSLRecordReader.readRecord(SSLRecordReader.java:90)
> >> > > at COM.claymoresystems.ptls.SSLHandshake.recvHandshakeToken(SSLHandshake.java:177)
> >> > > at COM.claymoresystems.ptls.SSLHandshakeServer.processTokens(SSLHandshakeServer.java:179)
> >> > > at COM.claymoresystems.ptls.SSLHandshake.processHandshake(SSLHandshake.java:135)
> >> > > at org.globus.gsi.gssapi.GlobusGSSContextImpl.acceptSecContext(GlobusGSSContextImpl.java:284)
> >> > > at org.globus.gsi.gssapi.net.GssSocket.authenticateServer(GssSocket.java:124)
> >> > > at org.globus.gsi.gssapi.net.GssSocket.startHandshake(GssSocket.java:142)
> >> > > at org.globus.gsi.gssapi.net.GssSocket.getOutputStream(GssSocket.java:161)
> >> > > at org.globus.wsrf.container.GSIServiceThread.process(GSIServiceThread.java:98)
> >> > > at org.globus.wsrf.container.ServiceThread.run(ServiceThread.java:291)
> >> > > ==============================================================
> >> > >
> >> > > Somebody asked about this years ago on the mailing list, but got no answer.
> >> > > http://archives.ogsadai.org.uk/users/0892.html
> >> > >
> >> > > The Globus on this system is otherwise working well, with users gsissh'ing,
> >> > > and submitting jobs.
> >> > >
> >> > > So, what should I try next?
> >> > >
> >> > > Cheers!
> >> > >
> >> > > - - - - - - - - - - - - - - - - - - - - - - - - -
> >> > > Steve White +49(331)7499-202
> >> > > e-Science / AstroGrid-D Zi. 35 Bg. 20
> >> > > - - - - - - - - - - - - - - - - - - - - - - - - -
> >> > > Astrophysikalisches Institut Potsdam (AIP)
> >> > > An der Sternwarte 16, D-14482 Potsdam
> >> > >
> >> > > Vorstand: Prof. Dr. Matthias Steinmetz, Peter A. Stolz
> >> > >
> >> > > Stiftung privaten Rechts, Stiftungsverzeichnis Brandenburg: III/7-71-026
> >> > > - - - - - - - - - - - - - - - - - - - - - - - - -
> >> > >
> >> >
> >> > The University of Edinburgh is a charitable body, registered in
> >> > Scotland, with registration number SC005336.
> >> >
> >>
> >> --
> >> - - - - - - - - - - - - - - - - - - - - - - - - -
> >> Steve White +49(331)7499-202
> >> e-Science / AstroGrid-D Zi. 35 Bg. 20
> >> - - - - - - - - - - - - - - - - - - - - - - - - -
> >> Astrophysikalisches Institut Potsdam (AIP)
> >> An der Sternwarte 16, D-14482 Potsdam
> >>
> >> Vorstand: Prof. Dr. Matthias Steinmetz, Peter A. Stolz
> >>
> >> Stiftung privaten Rechts, Stiftungsverzeichnis Brandenburg: III/7-71-026
> >> - - - - - - - - - - - - - - - - - - - - - - - - -
> >
> > --
> > - - - - - - - - - - - - - - - - - - - - - - - - -
> > Steve White +49(331)7499-202
> > e-Science / AstroGrid-D Zi. 35 Bg. 20
> > - - - - - - - - - - - - - - - - - - - - - - - - -
> > Astrophysikalisches Institut Potsdam (AIP)
> > An der Sternwarte 16, D-14482 Potsdam
> >
> > Vorstand: Prof. Dr. Matthias Steinmetz, Peter A. Stolz
> >
> > Stiftung privaten Rechts, Stiftungsverzeichnis Brandenburg: III/7-71-026
> > - - - - - - - - - - - - - - - - - - - - - - - - -
> >
>
>
>
> --
> ----------------------------------------------------------
> Ally Hume
> Software Architect
> EPCC, The University of Edinburgh
> Tel: +44 131 651 3397
>
> The University of Edinburgh is a charitable body, registered in
> Scotland, with registration number SC005336.
> 

-- 
-  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  - 
Steve White                                             +49(331)7499-202
e-Science / AstroGrid-D                                   Zi. 35  Bg. 20
-  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  - 
Astrophysikalisches Institut Potsdam (AIP)
An der Sternwarte 16, D-14482 Potsdam
Vorstand: Prof. Dr. Matthias Steinmetz, Peter A. Stolz
Stiftung privaten Rechts, Stiftungsverzeichnis Brandenburg: III/7-71-026
-  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -  -
Date view Thread view Subject view Author view Attachment view