[BUG] Cannot access RSP Portal or Notebooks aspects

[yymao]

Describe the bug I can successfully log in to RSP using my GitHub account (@yymao; I'm already in the rubin-dp0/delegates team). However, when I click on "Portal" I just got a blank page with "403 Forbidden". When I click on "Notebooks", I got a text error message saying: {"detail":{"msg":"Token missing required scope","type":"permission_denied"}}

To Reproduce Steps to reproduce the behavior:

1. Go to RSP and log in
2. Click on Portal or Notebooks
3. See errors

Expected behavior I expect being able to access Portal and Notebooks aspects.

Screenshots

For Portal

For Notebooks

URL

• https://data.lsst.cloud/portal/app/
• https://data.lsst.cloud/nb

Desktop (please complete the following information):

• OS: Linux Mint 20.1 / Kernel 5.11
• Browser: Google Chrome
• Version: 91

But the issue seems to be independent of browser/OS

Additional context

I know @katrinheitmann is experiencing the same issue as of June 30, 11pm EDT.

[frossie]

Thanks for the report. Could you please try logging out of Github and logging back in again and let us know whether that helps.

[yymao]

I have also tried logging out of GitHub completely and log in again, but the issue persists.

[frossie]

Okay we are investigating thanks.

[frossie]

Did you get a pop-up from Github asking you to authorize the RSP to access your account?

[katrinheitmann]

yes, I got one (and then an email from github confirming that I allowed accesss)

[sidneymau]

I am just commenting to note that I am seeing the same behavior as Yao posted. I accepted the GitHub popup authorizing RSP to use my account and have tried logging out and back in.

[yymao]

Re: @frossie

Did you get a pop-up from Github asking you to authorize the RSP to access your account?

Yes I did when I logged in for the first time.

[frossie]

Alright thank you for your patience. If you have NOT yet tripped this error, I believe we should have fixed the issue, which was due to a Github Organisation security setting that was not the default behaviour when we have tested this previously.

Next reply I will explain what to do for those of you who have unfortunately already tripped this.

[frossie]

If you have already run into the problem described, here is how to recover:

1. Go to data.lsst.cloud and from the top right menu item that has your username and log out

2. Go to https://github.com/settings/applications (or if you want to navigate, go to your Github account's settings -> Applications -> Authorized OAuth Apps TAB ) and find the RSP entry and hit REVOKE on the little menu:

3. Go back to data.lsst.cloud and log in.

4. You should (a) get the Github popup asking you to authorize the application and (b) it should have a green tick next to dp-0 (and nothing else - specifically not a button saying "Grant")

And please kindly report back even if it works!

[sidneymau]

I can confirm following the above steps fixed the issue for me!

[katrinheitmann]

Same here, thanks very much!

[frossie]

Fantastic. Thank you for being early adopters and sorry for not catching this particular issue in testing.

In the future we will add code to our logout function to clear out the Github Oauth grant, so that if the process fails for some reason we will not have to talk users out of the Revoke step ahead, which is quite gnarly.

[frossie]

@yymao when you confirm it works for you, I will close the ticket.

[yymao]

Thank you @frossie. But unfortunately I still encounter the same issue after following your steps. After revoking the RSP entry, I was indeed prompted to grant permission when I logged in again to RSP:

But then I still cannot access Portal or Notebooks (same error messages as in my original post).

[pothiers]

The instructions (revoke and retry) did NOT work for me. I tried twice just in case. I get the 403 Forbidden error described in initial post.

[pothiers]

I'm suspicious that something about my email change (noao to noirlab) might be involved. I've gotten two GitHub OAuth emails about RSP. One to my personal gmail account used for my github account before joining noao, and one to my new noirlab.edu email.

[frossie]

@pothiers your problem is you are not on the delegate list whitelisted for science platform access in DP0.1 - I will inquire with the CET team your access status.

[frossie]

@yymao @jchiang87 we are working your issue - sorry for the delay

[frossie]

Okay the problem the remaining users are having (including @yymao ) is that you are all members of so many Github teams, the Github API is paginating the results and Rubin is not on the first page. Instead of trying to talk you through a work around, we are going to get the auth code fixed to deal with paginated results and roll it out, and then we have actually fixed something which is the whole point of this exercise. Sorry about that, you should be good by tomorrow.

[MelissaGraham]

@frossie, @pothiers is on the Friends team

[yymao]

Thank you for the update @frossie. Indeed I'm in 12 different GitHub Organizations now... :slightly_smiling_face:

[frossie]

@yymao Yes the issue is the number of teams (not just orgs) and lsstdesc seems to have... 130 of them... and I bet you're on more than one ... Thanks for being a good test user :-)

[frossie]

Ok @yymao has kindly helped us test the new authentication code. Yao and everyone else having a remaining problem: please follow the instructions above and report outcome.

[yymao]

Thank you @frossie -- I can confirm that both Portal and Notebooks work for me now on https://data.lsst.cloud/ after following your steps above!

[frossie]

Thank you so much for testing with us @yymao and thanks @rra for the quick turnaround on the fix.

[pothiers]

@frossie Now works for me too. Thanks for the fix and for avoiding the temptation for doing a work-around!

[frossie]

@pothiers ah yes, fyi Steve for the record your login is working because @MelissaGraham authorised me to add the dp0 friends team to the allow list. I think that brings us to 5 different root causes in one issue :-)

[jchiang87]

Hi Everyone, I confirm that I can now open a jupyter notebook and access the portal after following the steps above.

[fklich]

hello troubleshooters. Yesterday, after the DP0 session with Melissa, I tested my access to the Portal and NB and they presented just fine. This morning I am having exact same problem as described above. I have repeated the above steps twice with no success.

[frossie]

@fklich I am sorry, I don't know who you are. You are not on the delegate list I was given. Under which umbrella are you expecting access - Rubin staff, DP0.1 delegate, CET collaborator... ?

[MelissaGraham]

I sent @fklich a direct message in the Community Forum to resolve this.

[fklich]

Thanks Frossie. I read Melissa's direct message and your question and understand the situation. Ticket CLOSED!! Happy 4th. Fred Klich

---

From: Frossie @.> Sent: Friday, July 2, 2021 11:08 AM To: rubin-dp0/Support @.> Cc: Fred S. Klich @.>; Mention @.> Subject: Re: [rubin-dp0/Support] [BUG] Cannot access RSP Portal or Notebooks aspects (#1)

@fklichhttps://github.com/fklich I am sorry, I don't know who you are. You are not on the delegate list I was given. Under which umbrella are you expecting access - Rubin staff, DP0.1 delegate, CET collaborator... ?

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHubhttps://github.com/rubin-dp0/Support/issues/1#issuecomment-873106673, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AIJ7VPYCXZL36ODWTXL2LO3TVXQBDANCNFSM47TS4JMQ.

[ashruiter]

Yes this worked for me - thank you!

[frossie]

For anyone who stumbles on this ticket in the future: We have simplified the process by which you can now recover from this type of error. New users (after 2021-07-09) will be able to clear existing tokens just by logging out, greatly simplifying the process outlined above. See https://community.lsst.org/t/rsp-data-lsst-cloud-updates-2021-07-09/5633