search

ropensci-archive / rorcid

:warning: ARCHIVED :warning: A programmatic interface the Orcid.org API
Other
109 stars 13 forks source link

Unauthorized 401 When Callin ORCID API #91

Closed RealityMistic closed 3 years ago

RealityMistic commented 3 years ago

Hello, I am running an R script which uses rorcid and it is supposed to check some data with the orcid API.

I am running it on a linux server and I am getting this message Error: Unauthorized (HTTP 401)

I read the unfinished #64 thread and it seems the same problem. I checked the command curl -v -H "Authorization Bearer (...)" https://pub.orcid.org/v2.1/0000-0002-164 and it seems to work. So the token is all right, I believe. Any ideas why it might be failing?

Thanks

sckott commented 3 years ago

Thanks for reporting the issue.

In server scenarios, use a PAT. See https://docs.ropensci.org/rorcid/articles/authentication.html#computing-environments-without-browsers-1 and the 3rd option in Details section here https://docs.ropensci.org/rorcid/reference/orcid_auth.html#details

RealityMistic commented 3 years ago

Hi sckott, thanks for helping. I am not sure of what do you mean by a PAT, "Port-Address-Translator"? A network technique? How should we do that?

I managed to generate a token using the 2legged authentication function and using my client_id and my client_secret, I think the token is Ok. The ORCID_TOKEN environment variable is properly set with the token. I wondered if the problem was because of the hyphens, and I tried to add some (as it originally was without any) but same result 401.

I also checked that curl with HTTPS support is working, because I can download from the console.

Is it then a network problem? We are using port 8080 and we are behind a proxy, but we have connectivity now from R.

Any ideas?

Thanks

sckott commented 3 years ago

PAT = Personal Access Token Same as "token" in this context.

use one of the rorcid functions to get some data, and set verbose=TRUE, e.g., 

orcid_bio(orcid = "0000-0002-1642-628X", verbose = TRUE)

Does that fail? If so, there may be useful information to debug in the console output. Share it here, but make sure to obscure/remove your token

RealityMistic commented 3 years ago

orcid_bio(orcid = "0000-0002-1642-628X", verbose = TRUE)

  • Uses proxy env variable https_proxy == 'http://emcgateway:Informes2013@proxy.redinterna.age:8080'
  • Trying 10.20.5.72...
  • TCP_NODELAY set
  • Connected to proxy.redinterna.age (10.20.5.72) port 8080 (#0)
  • allocate connect buffer!
  • Establish HTTP proxy tunnel to pub.orcid.org:443 CONNECT pub.orcid.org:443 HTTP/1.1 Host: pub.orcid.org:443 User-Agent: R (3.6.3 x86_64-redhat-linux-gnu x86_64 linux-gnu) Proxy-Connection: Keep-Alive

< HTTP/1.1 200 Connection established <

< HTTP/1.1 401 Unauthorized < Date: Fri, 19 Feb 2021 16:37:44 GMT < Content-Type: application/json;charset=UTF-8 < Transfer-Encoding: chunked < Connection: keep-alive

sckott commented 3 years ago

So your token was in the Authorization: Bearer string, correct? And you just removed it here?

RealityMistic commented 3 years ago

Exactly, I removed it as you requested. This a project for the Spanish Ministry of Science and we are rather stuck here.

Thanks.

sckott commented 3 years ago

Let's try curl again to make sure that your token is working:

curl -v \
  -H 'Authorization: Bearer your-token-here' \
  -H 'Accept: application/json' \
  https://pub.orcid.org/v3.0/0000-0002-1642-628X/biography/

Does that work? Do you get:

{"created-date":{"value":1460757498851},"last-modified-date":{"value":1460757498851},"content":"http://carlboettiger.info","visibility":"public","path":"/0000-0002-1642-628X/biography"}
RealityMistic commented 3 years ago

Good morning Sckott... once again the same problem. There must be definitely something wrong with the token Thx for the support

[root@CENT81-DES-CIENCIA investigadores-ficheros_r]# curl -v -H 'Authorization: Bearer ... ' -H 'Accept: application/json' https://pub.orcid.org/v3.0/0000-0002-1642-628X/biography/

RealityMistic commented 3 years ago

By the way, I just tried the URL with the token on my Windows workstation with postman and I got the same result: invalid token.

Should I try with another ORCID account?

RealityMistic commented 3 years ago

This is how I generated the token:

two_legged_oauth <- function(client_id, client_secret) { headers <- list(Accept = "application/json", Content-Type = "application/x-www-form-urlencoded") body <- list(grant_type = "authorization_code", client_id = client_id, client_secret = client_secret) con <- crul::HttpClient$new("https://orcid.org/oauth/authorize", headers = headers) res <- con$post( body = body, encode = "form") if (res[["status_code"]] == 200 ) { tok <- res[["response_headers"]][["cf-request-id"]] return (paste0("Bearer ", tok)) } } ""

two_legged_oauth(client_id = "...", client_secret = "...")

sckott commented 3 years ago
  1. it's possible there's an issue with the proxy. I don't know anything about proxies as I never use them, so not sure what to do if that's the problem.
  2. If it is an invalid token: did you request the token on that server? Can you get a token on your local machine, then simply set it as the token on your server? Does this curl request work if you do it on your local machine without being behind a proxy?
RealityMistic commented 3 years ago
  1. We can rule out the proxy problem, I checked with postman from my personal machine (directly connected to the Internet) against the API url you proposed and it works without token (it's public) but when the token is added it says it is invalid.
  2. I tried on our server with another token generated with the ORCID credentials of a colleague of mine and the result is the same. Could it be that the token generation process is not working properly? Is there any way to circumvent the three legged authentication?
RealityMistic commented 3 years ago

By the way, my colleague generated his token on his local machine.

sckott commented 3 years ago

I just spun up a server and used my orcid token and it works. So can't re-create what's going on so far. I'm not sure what else to do. I'm asking ORCID folks

TomDemeranville commented 3 years ago

This is how I generated the token:

two_legged_oauth <- function(client_id, client_secret) { headers <- list(Accept = "application/json", Content-Type = "application/x-www-form-urlencoded") body <- list(grant_type = "authorization_code", client_id = client_id, client_secret = client_secret) con <- crul::HttpClient$new("https://orcid.org/oauth/authorize", headers = headers) res <- con$post( body = body, encode = "form") if (res[["status_code"]] == 200 ) { tok <- res[["response_headers"]][["cf-request-id"]] return (paste0("Bearer ", tok)) } } ""

two_legged_oauth(client_id = "...", client_secret = "...")

Hmm. Does your token in a format like 1bed1e13-7792-4129-9f07-aaf7b88ba88x?

If not, I think your two legged request is not quite right.

Example here: https://info.orcid.org/documentation/integration-and-api-faq/#easy-faq-2532

RealityMistic commented 3 years ago

I was definitely trying to use a function which does not generate a valid Orcid token. Could you write here the proper command line curl call with a field for client_id and client_secret, which I can substitute, so that I can get the token? I understand the production ORCID API Endpoint is https://orcid.org/oauth/token

So far I've been trying and getting {"error":"invalid_client","error_description":"Client not found: ..."} image

Please forgive me, because I am newbie to Linux and APIs...

TomDemeranville commented 3 years ago

Try something like curl -i -d 'client_id=XXX' -d 'client_secret=XXX' -d 'scope=/read-public' -d 'grant_type=client_credentials' 'https://orcid.org/oauth/token'

TomDemeranville commented 3 years ago

There is a tutorial here: https://github.com/ORCID/ORCID-Source/blob/master/orcid-api-web/tutorial/read_public.md

RealityMistic commented 3 years ago

Yes, but I also got the invalid token message. However, I just copied my ID directly from the Orcid website after login. I am also copying the password.

RealityMistic commented 3 years ago

I wish to apologize to everyone for being so rookie and for not reading the tutorials properly. I was wrongly assuming that the client_id is the same as the ORCID ID and they are not. You use your orcid account to register an application in the developers tools menu option and then it generates the client_id and the client_secret which you use to generate a token.

Thanks for your efforts, sorry again for the inconvenience and you can close this thread.

sckott commented 3 years ago

Thanks @TomDemeranville !

@drachodran no worries at all. I'm happy to help. The function https://docs.ropensci.org/rorcid/reference/orcid_auth in this package returns the token you'll need. It returns a string of the form Bearer xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx. From that, copy just the token part (ignore "Bearer ") to save as your ORCID_TOKEN environment variable.