Stuck on "Unable to connect to Fedora server" error

[Aaron Brenner]

Hi all,

I'm doing an install of the whole Islandora stack from scratch on a personal VM.  I'm currently stuck on the configuration of the Islandora core module.  Very similar to what was described in this recent thread [1].

What's working:

Fedora 3.6.2. + GSearch 2.6 + Solr 4.2.0

Drupal 7.22

Drupal servlet filter (Peter's for 3.6.2) seems to be working as I can use Drupal credentials to log into fedora admin (to ingest and purge) and API-M urls directly.

(Also to confirm servlet filter was working, I tested the MySQL credentials/query from the command-line and they worked.)

I copied the xacml policies from the islandora/policies directory to $FEDORA_HOME/data/fedora-xacml-policies/repository-policies/default

I can access content served by Fedora from within Drupal, tested by embedding one of the jpg datastreams from Fedora's sample content in a Drupal node.

What seems to not be working is the tuque connection from my Islandora install to Fedora.

Looking at the code a little bit, it seems like it's not getting past the very first step of requesting the Fedora "describe" page, which should not require authentication, right?

I turned on the access log on Fedora's tomcat to see if any requests were getting through from Islandora: yes to image embedded from within a Drupal page, no to the Islandora config testing the connection. I don't see any other errors in apache, fedora, or tomcat logs.

So I suspect the problem has to do with my install of tuque. Is there any way to test its functionality separately?  Perhaps to get a more descriptive error?  Does it have dependencies that I might not have configured correctly?

I see that there's a test suite with tuque, but being a PHP noob I'm not sure how to run it.  It looks like it requires PHPUnit, which I installed via pear according to the instructions here [2], but still get errors trying to run the tests from the command-line ("Class 'PHPUnit_Framework_TestCase' not found" -- had a whole side track adding the pear install directory to the php.ini include_path, but that didn't seem to help).

Any guidance with troubleshooting this would be appreciated!

Thanks!

[1]  https://groups.google.com/forum/#!topic/islandora/xo7gnoaDGYI

[2] http://phpunit.de/manual/3.0/en/installation.html

-AB

[Peter Murray]

As far as I can recall, in its default configuration Fedora does not require authentication for the 'describe' page, so you should be able to get to this:

http://localhost:8080/fedora/describe

What I think you are saying is that the Islandora configuration screen:

http://localhost/drupal/admin/islandora/configure

…is showing a 403 error, and something like this:

http://localhost/drupal/islandora/object/islandora:6/datastream/OBJ/view

…does give you a result (e.g. the JPEG image in a Drupal page).


Is that what you are seeing?


Peter

--
Peter Murray
Assistant Director, Technology Services Development
LYRASIS
Peter....@lyrasis.org
+1 678-235-2955
800.999.8558 x2955

[Aaron Brenner]

Hi Peter,

Yes, that's pretty much right -- the error I'm describing is on the Islandora admin config screen.  It's not necessarily a 403 error, just a "Unable to connect" string which the module returns when something fails with the tuque connection to the repository  (That's part of what I wish were more descriptive!).  From here:
https://github.com/Islandora/islandora/blob/7.x/includes/admin.form.inc#L123

Because the Islandora module can't connect to the server, I'm not getting the /islandora/object/... view that you describe, I just tested that connection with a simple img href to a Fedora-served jpg in a node body.  That worked.

--
You received this message because you are subscribed to the Google Groups "islandora" group.
To unsubscribe from this group and stop receiving emails from it, send an email to islandora+...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

[Peter Murray]

On Jul 22, 2013, at 3:44 PM, Aaron Brenner <aaronb...@gmail.com> wrote:
>
> Hi Peter,
>
> Yes, that's pretty much right -- the error I'm describing is on the Islandora admin config screen. It's not necessarily a 403 error, just a "Unable to connect" string which the module returns when something fails with the tuque connection to the repository (That's part of what I wish were more descriptive!). From here:
> https://github.com/Islandora/islandora/blob/7.x/includes/admin.form.inc#L123
>
> Because the Islandora module can't connect to the server, I'm not getting the /islandora/object/... view that you describe, I just tested that connection with a simple img href to a Fedora-served jpg in a node body. That worked.

Ah, right, yes -- that particular URL goes through Drupal -> Islandora -> Fedora, so it would fail if Tuque weren't able to connect to the repository. Looking a couple lines above in the code (https://github.com/Islandora/islandora/blob/7.x/includes/admin.form.inc#L107), it might be nice if the module reported what the problem was rather than ignoring the exception. Unless someone else gets to it first, I'll try to work up a patch that captures the exception error message and includes that in the error output.

Just to be sure, you are using the webapp context name as the URL in the admin config screen, right?

http://localhost:8080/fedora


Peter

[Aaron Brenner]

Yes, that's the URL I have in the config.

I was able to get the exception to get passed into the output on the admin screen. Here's how it starts:

exception 'HttpConnectionException' with message 'Failed to connect to ::1: Permission denied' in /var/www/html/sites/all/libraries/tuque/HttpConnection.php:402

So it seems like localhost is resolving to ::1, which from googling I see is IPv6.  Heading to apache config to see what I can do there, but any other advice is welcome :-)

[Pottinger, Hardy J.]

Hi, Aaron, if you're running a host firewall on your image, try
temporarily taking it down and see if that resolves the error message. If
so, you need to add an exception. If not, more digging is required. But,
this looks like a firewall thing to me.

--
HARDY POTTINGER <potti...@umsystem.edu>
University of Missouri Library Systems
http://lso.umsystem.edu/~pottingerhj/
https://MOspace.umsystem.edu/
"Some people, when confronted with a problem, think 'I know, I'll use
XML.' Now they have two problems." --Jamie Zawinski

On 7/23/13 8:55 AM, "Aaron Brenner" <aaronb...@gmail.com> wrote:

>Yes, that's the URL I have in the config.
>
>I was able to get the exception to get passed into the output on the
>admin screen. Here's how it starts:
>
>exception 'HttpConnectionException' with message 'Failed to connect to
>::1: Permission denied' in
>/var/www/html/sites/all/libraries/tuque/HttpConnection.php:402
>
>
>So it seems like localhost is resolving to ::1, which from googling I see
>is IPv6. Heading to apache config to see what I can do there, but any
>other advice is welcome :-)
>
>
>
>
>
>
>On Mon, Jul 22, 2013 at 5:24 PM, Peter Murray
><peter....@lyrasis.org> wrote:
>
>On Jul 22, 2013, at 3:44 PM, Aaron Brenner <aaronb...@gmail.com> wrote:
>>
>> Hi Peter,
>>
>> Yes, that's pretty much right -- the error I'm describing is on the
>>Islandora admin config screen. It's not necessarily a 403 error, just a
>>"Unable to connect" string which the module returns when something fails
>>with the tuque connection to the repository
> (That's part of what I wish were more descriptive!). From here:
>>
>https://github.com/Islandora/islandora/blob/7.x/includes/admin.form.inc#L1
>23

><https://github.com/Islandora/islandora/blob/7.x/includes/admin.form.inc#L
>123>

>>
>> Because the Islandora module can't connect to the server, I'm not
>>getting the /islandora/object/... view that you describe, I just tested
>>that connection with a simple img href to a Fedora-served jpg in a node
>>body. That worked.
>
>
>Ah, right, yes -- that particular URL goes through Drupal -> Islandora ->
>Fedora, so it would fail if Tuque weren't able to connect to the
>repository. Looking a couple lines above in the code
>(https://github.com/Islandora/islandora/blob/7.x/includes/admin.form.inc#L
>107),
> it might be nice if the module reported what the problem was rather than
>ignoring the exception. Unless someone else gets to it first, I'll try
>to work up a patch that captures the exception error message and includes
>that in the error output.
>
>Just to be sure, you are using the webapp context name as the URL in the
>admin config screen, right?
>
> http://localhost:8080/fedora
>
>
>Peter
>--
>Peter Murray
>Assistant Director, Technology Services Development
>LYRASIS
>Peter....@lyrasis.org

>+1 678-235-2955 <tel:%2B1%20678-235-2955>
>800.999.8558 x2955 <tel:800.999.8558%20x2955>

>
>
>--
>You received this message because you are subscribed to the Google Groups
>"islandora" group.
>To unsubscribe from this group and stop receiving emails from it, send an
>email to
>islandora+...@googlegroups.com

><mailto:islandora%2Bunsu...@googlegroups.com>.

>For more options, visit
>https://groups.google.com/groups/opt_out

><https://groups.google.com/groups/opt_out>.

[Aaron Brenner]

Thanks Hardy.  I disabled the firewall (best I can tell) and bounced the server again, still no luck.  Interestingly, when I change the server name in the Islandora admin config field from "localhost:8080/fedora" to "127.0.0.1:8080/fedora" the exception says 'Failed to connect to 127.0.0.1: Permission denied', so there it's not using that ipv6 version of localhost.

Next I tried a test of php curl outside of drupal. Just followed this example: http://www.php.net/manual/en/curl.examples-basic.php

<?php

$ch = curl_init("http://localhost:8080/fedora/describe");
$fp = fopen("example_homepage.txt", "w");

curl_setopt($ch, CURLOPT_FILE, $fp);
curl_setopt($ch, CURLOPT_HEADER, 0);

curl_exec($ch);
curl_close($ch);
fclose($fp);
?>

And it grabbed the page successfully.  Hmmmm.....

[Pottinger, Hardy J.]

Oh, I bet I know where the ipv6 notation is coming from. Look at your
/etc/hosts file. More info here:
https://bugzilla.redhat.com/show_bug.cgi?id=211800

--
HARDY POTTINGER <potti...@umsystem.edu>
University of Missouri Library Systems
http://lso.umsystem.edu/~pottingerhj/
https://MOspace.umsystem.edu/

"To pay attention, this is our endless and proper work." --Mary Oliver

On 7/23/13 9:31 AM, "Aaron Brenner" <aaronb...@gmail.com> wrote:

>Thanks Hardy. I disabled the firewall (best I can tell) and bounced the
>server again, still no luck. Interestingly, when I change the server
>name in the Islandora admin config field from "localhost:8080/fedora" to

>"127.0.0.1:8080/fedora <http://127.0.0.1:8080/fedora>"
> the exception says 'Failed to connect to 127.0.0.1 <http://127.0.0.1>:

>>+1 678-235-2955 <tel:%2B1%20678-235-2955> <tel:%2B1%20678-235-2955>
>>800.999.8558 x2955 <tel:800.999.8558%20x2955> <tel:800.999.8558%20x2955>

>>
>>
>>--
>>You received this message because you are subscribed to the Google Groups
>>"islandora" group.
>>To unsubscribe from this group and stop receiving emails from it, send an
>>email to
>>islandora+...@googlegroups.com
>><mailto:islandora%2Bunsu...@googlegroups.com>
>

>><mailto:islandora%2Bunsu...@googlegroups.com
>><mailto:islandora%252Buns...@googlegroups.com>>.

>>For more options, visit
>>https://groups.google.com/groups/opt_out
>
>><https://groups.google.com/groups/opt_out>.
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>--
>>You received this message because you are subscribed to the Google Groups
>>"islandora" group.
>>To unsubscribe from this group and stop receiving emails from it, send an

>>email to islandora+...@googlegroups.com

[Peter Murray]

Wow -- that is weird. Trying some PHP outside Drupal was going to be my next suggestion, so your later message with those results makes this even weirder. I'm afraid I'm out of suggestions...


Peter

[Aaron Brenner]

Thanks Hardy and Peter.  Going kinda crazy trying to figure this one out.

Should have clarified: the php-curl test script I ran worked when run from command line.  Same script when run by calling it through a browser fails.  Changing the target of the curl command to remove the :8080 works everywhere (e.g. it can grab the Drupal home page when run from both the command line and through the browser).  And I can still get to content on localhost:8080 through apache by embedding a Fedora-served jpg in html.

Hardy, I removed the ipv6 line from /etc/hosts and it didn't change the behavior except where it previously said ::1 it now says 127.0.0.1. So that may have been a red herring.

This seems to come down to php-curl being denied permission to access 8080 when being run through apache but not otherwise.  I'm stumped.  And it's not so much an Islandora thing at this point, but if this scenario rings any bells for anyone let me know.

[John MacGillivray]

 

Sent from my BlackBerry 10 smartphone on the Rogers network.

From: Pottinger, Hardy J. Sent: Tuesday, July 23, 2013 10:02 AM To: isla...@googlegroups.com Reply To: isla...@googlegroups.com Subject: Re: [islandora] Stuck on "Unable to connect to Fedora server" error

[Aaron Brenner]

...and it turned out to be selinux.  Which I didn't know much about before.  I know a lot more now :-/

(A pretty good explanation of what selinux does in relation to apache is here: http://drupalwatchdog.com/2/2/apache-selinux )

I see that this has come up a few times in this group -- might it be useful to add a "troubleshooting installation problems" page to the Installing Islandora section wiki?  I'd be happy to document the relevant parts of my experience to save others the hassle -- beats searching old threads.

Thanks again to Peter and Hardy for your help.

[Giancarlo Birello]

Hi,
here http://devbioinfo.to.cnr.it/doku.php you can find my installation steps.

About tuque I needed to make this change:

You have to disable certificate validation in Islandora module:

nano -w sites/all/modules/islandora/islandora/libraries/tuque/HttpConnection.php

  /**
   * FALSE to stop cURL from verifying the peer's certificate. (Default: TRUE)
   * @var type boolean
   */
  public $verifyPeer = FALSE;

Just another tip.

Best,
Giancarlo

[Jonathan Green]

Adding a troubleshooting section to the wiki would be fantastic Aaron. I really like that idea.

Jonathan Green
Chief Technology Officer
discoverygarden Inc.
Sims Office Suites Building, 3rd Floor, 118 Sydney Street
Charlottetown, PE C1A 1G4
902.367.3851 discoverygarden.ca
skype: jonathan.edwards.green

[Mark Leggott]

I agree :-) I've asked Melissa Anez to add that section to the project's Confluence Wiki and we will let people know when it is ready for edits. We will add the recent issues/suggestions to the list of stuff we have from previous posts as a start.

Mark

[Aaron Brenner]

Thanks, that's great!  I'll look out for it and add/review my bit.

[Peter Murray]

Congratulations! That was a particularly bothersome problem. I'm sure your experience will be useful to others; thanks for volunteering to write it up.


Peter

On Jul 23, 2013, at 10:18 PM, Aaron Brenner <aaronb...@gmail.com> wrote:
>
> ...and it turned out to be selinux. Which I didn't know much about before. I know a lot more now :-/
>
> (A pretty good explanation of what selinux does in relation to apache is here: http://drupalwatchdog.com/2/2/apache-selinux )
>
> I see that this has come up a few times in this group -- might it be useful to add a "troubleshooting installation problems" page to the Installing Islandora section wiki? I'd be happy to document the relevant parts of my experience to save others the hassle -- beats searching old threads.
>
> Thanks again to Peter and Hardy for your help.

--
Peter Murray
Assistant Director, Technology Services Development
LYRASIS
Peter....@lyrasis.org
+1 678-235-2955

800.999.8558 x2955

[Melissa Anez]

There's a brand new stub page up in the Wiki with a few recent issues/suggestions and a spot ready and waiting for your selinux experience, Aaron:

https://wiki.duraspace.org/display/ISLANDORA711/Troubleshooting+Installation

Thanks again for offering up your documentation on this.

- Melissa

[Aaron Brenner]

Thanks Melissa, this is great!  I added my part.  Here's hoping this will save people some unneeded aggravation.