SYS_NO_API_PRIV while putting files in Consumer resource

[sanju timsina]

Hello,

I have set up a consumer server and provide server in two different servers.

In the provider server, I made a resource as follow:

iadmin mkresc resResc unixfilesystem resourcehost.XXX:/var/lib/irods/Vault

When I try to put the file from provider to "resResc", it works. When the user of the provider server tries to put the files, it gives the below error.

$ iput -R resResc error_21943.txt

ERROR: putUtil: put error for /arctic/home/stimsina/error_21943.txt, status = -13000 status = -13000 SYS_NO_API_PRIV

Thank you,

Sanju

[Terrell Russell]

Hi Sanju,

That error occurs when the user who tries to do something... does not have enough permission.

Can you see the error in the iRODS log on the server?

/var/lib/irods/log/rodsLog*

Terrell

--
--
The Integrated Rule-Oriented Data System (iRODS) - https://irods.org
 
iROD-Chat: http://groups.google.com/group/iROD-Chat
---
You received this message because you are subscribed to the Google Groups "iRODS-Chat" group.
To unsubscribe from this group and stop receiving emails from it, send an email to irod-chat+...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/irod-chat/29e063ea-51b4-4863-8cd6-b597ecb2bd50n%40googlegroups.com.

[sanju timsina]

Hi Terrel,

This is the error in the log file

May 12 14:38:40 pid:6156 NOTICE: remoteFilePut: rcFilePut failed for /var/lib/irods/Vault/home/stimsina/error_21943.txt

May 12 14:38:40 pid:6156 NOTICE: remoteFileUnlink: rcFileUnlink failed for /var/lib/irods/Vault/home/stimsina/error_21943.txt, status = -13000

May 12 14:38:40 pid:6156 remote addresses: 10.245.11.193, 10.245.11.232 ERROR: _rsDataObjClose - getSizeInVault failed [-13000]

Thank you,

Sanju

[James, Justin Kyle]

This seems to be an iRODS configuration issue.  I think we can remove the globus plugin from the loop.

The globus plugin uses the standard client configuration so if you can do an "ils" in the client that globus uses to connect with then the plugin should work.

Can you compare the .irods/irods_environment.json files for the clients that are connecting with iRODS to the one that is not?  

Also, are you using a self-signed cert?  If so the client should have the irods_ssl_ca_certificate_file setting.  Make sure that the file that this is set to is available for reading by the client.

---

From: irod...@googlegroups.com <irod...@googlegroups.com> on behalf of sanju timsina <timsina...@gmail.com>
Sent: Wednesday, May 12, 2021 2:39 PM
To: iRODS-Chat <irod...@googlegroups.com>
Subject: Re: [iROD-Chat:19764] SYS_NO_API_PRIV while putting files in Consumer resource

 

To view this discussion on the web visit https://groups.google.com/d/msgid/irod-chat/8597f18e-e581-4b0d-867b-d45c377f2484n%40googlegroups.com.

[Terrell Russell]

That feels like the user maybe doesn't have permission to write there, either logically... or on the disk?

A bit more of an example session might be able to help.

Share an `ils -AL` of the target collection, and then try the `iput` with a new filename.

Terrell

To view this discussion on the web visit https://groups.google.com/d/msgid/irod-chat/8597f18e-e581-4b0d-867b-d45c377f2484n%40googlegroups.com.

[James, Justin Kyle]

I think I responded to the wrong thread so ignore my previous response.  I sent it to the right thread.

---

From: irod...@googlegroups.com <irod...@googlegroups.com> on behalf of James, Justin Kyle <jja...@renci.org>
Sent: Wednesday, May 12, 2021 3:56 PM

To view this discussion on the web visit https://groups.google.com/d/msgid/irod-chat/BN8PR03MB47054F62BBCD32B34915D3AFC7529%40BN8PR03MB4705.namprd03.prod.outlook.com.

[sanju timsina]

Hi Terrell,

Please find the output below. Before creating the resource do I need to configure anything on the resource server.

$ iput -R resResc test_file.txt

remote addresses: 10.245.11.237 ERROR: putUtil: put error for /arctic/home/stimsina/test_file.txt, status = -13000 status = -13000 SYS_NO_API_PRIV

$ ils -AL

/arctic/home/stimsina:

        ACL - stimsina#arctic:own   

        Inheritance - Disabled

  stimsina          0 demoResc           32 2021-05-05.12:41 & hello.py

        generic    /var/lib/irods/Vault/home/stimsina/hello.py

        ACL - stimsina#arctic:own   

  stimsina          0 demoResc          929 2021-05-07.12:52 & simu_mat.sh

        generic    /var/lib/irods/Vault/home/stimsina/simu_mat.sh

        ACL - stimsina#arctic:own   

  C- /arctic/home/stimsina/Matlab

Thank you,

Sanju Timsina

[sanju timsina]

Hi 

I have the resource as  "arcresdev01Resource" on the consumer server on the JSON files and "demoResc" on the core.re file.

/etc/irods/server_config.json

"catalog_service_role": "consumer",

    "client_api_whitelist_policy": "enforce",

    "default_dir_mode": "0750",

    "default_file_mode": "0600",

    "default_hash_scheme": "SHA256",

    "default_resource_name": "arcresdev01Resource",

var/lib/irods/.irods/irods_environment.json

"irods_default_resource": "arcresdev01Resource",

/etc/irods/core.re

acSetRescSchemeForCreate {msiSetDefaultResc("demoResc","null"); }

acSetRescSchemeForRepl {msiSetDefaultResc("demoResc","null"); }

But the storage resource listed on the consumer server is a storage resource made on the provider server. demoResc is the storage resource on the provider server and resResc is the storage resource on the consumer server.

-bash-4.2$ ilsresc

demoResc:unixfilesystem

resResc:unixfilesystem

Do I need to change the configuration on any of these files (json or core.re) that may be causing this error?

Thank you,

Sanju

[sanju timsina]

Hi Terrell,

Changing "client_api_whitelist_policy": "enforce" to "client_api_whitelist_policy": "add" resolves this issue.

I just want to make sure if this configuration is ok to use for production.

Thank you,

Sanju

[Terrell Russell]

Hi Sanju,

I'm not sure changing that setting is the right answer.

I think we should probably talk offline and get this squared up.

Terrell

To view this discussion on the web visit https://groups.google.com/d/msgid/irod-chat/4aab8f1f-2a23-4be9-9961-7a6877dab33bn%40googlegroups.com.

[Sanju Timsina]

Hi Terrell,

Thank you so much for taking the time to look at this issue today. I removed logical quotas and metadata guards and other plugins installed from both the resource server and provider server just to make sure. The same error shows while trying to put files. 

Please find the logs on the provider server:

May 25 14:27:33 pid:31070 NOTICE: remoteFilePut: rcFilePut failed for /var/lib/irods/Vault/home/stimsina/error.txt

May 25 14:27:33 pid:31070 NOTICE: remoteFileUnlink: rcFileUnlink failed for /var/lib/irods/Vault/home/stimsina/error.txt, status = -13000

May 25 14:27:33 pid:31070 remote addresses: 10.245.11.193, 10.245.11.232, 10.245.11.94 ERROR: _rsDataObjClose - getSizeInVault failed [-13000]

Logs on the resource server:

May 25 18:27:33 pid:73640 NOTICE: rsApiHandler: User has no permission for apiNumber 518

May 25 18:27:33 pid:73640 NOTICE: rsApiHandler: User has no permission for apiNumber 506

May 25 18:27:33 pid:73640 NOTICE: rsApiHandler: User has no permission for apiNumber 510

Thank you,

Sanju

[Terrell Russell]

Ah, so it's something else entirely.

We may need another call with this stripped-down configuration.  These error messages need to be better.

Terrell

To view this discussion on the web visit https://groups.google.com/d/msgid/irod-chat/a2a5ff50-f0dd-4af8-b915-580c3f695ca7n%40googlegroups.com.

[Sanju Timsina]

Hi Terrell,

Sure! It would be great to figure out this issue soon.

Thank you,

Sanju