Problems with Islandora configuration: Cannot connect to Fedora server error

[Megan O'Neill Kudzia]

Hi all,

Apologies if there's another thread here that answers this question - I haven't been able to find it. 

My friendly neighborhood server admin and I have been trying to install and configure a new Islandora instance, but we're running into problems. We're using Fedora 3.6.2 and Drupal/Islandora 7.22 on the same Ubuntu server. 

We have installed Fedora and we have confirmed it is working as per the instructions on the wiki. We have installed Drupal and are able to log in. However, when we try to configure the Islandora module to operate across the Drupal authentication filter we get these errors in the log: 

"RepositoryException: Unauthorized in RepositoryConnection->parseFedoraExceptions() (line 227 of /var/www/sites/all/modules/islandora/lib" as well as: 

"Failed to ingest object: islandora:root

code: 410

message: Unauthorized"

We have tried multiple combinations of Fedora/Drupal versions, we have tried double- and triple-checking that all the files are where they're supposed to be, and we can't figure out what is causing this error. XACML has been turned off and we're still getting the error.

Any suggestions anybody out there in internet-land might have would be appreciated; we're pulling our hair out!

Thanks, and Cheers!

[Gary Phillips]

I think the first place to look might be <fedora_root>/server/config/filter-drupal.xml

Open it up and make sure the mysql (if that's what you are using, we use postgres) settings are correct.  One way to check is to open up a mysql command line client using the settings in the file, then try to run the sql query shown substituting a valid user/pass from your islandora set up.  If that is not working you have found your problem.  If it is, and <param name="ENFORCE-MODE" value="permit-all-requests"/> is uncommented in your fedora.fcfg, then I'm not sure where to look next.

Hope this helps.

--
You received this message because you are subscribed to the Google Groups "islandora" group.
To unsubscribe from this group and stop receiving emails from it, send an email to islandora+...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.
 
 

[Nick Ruest]

Another spot to look is iptables or selinux if you are using either.
I've lost some hair over both setting up Islandora for Fedora on an
unfamiliar serve.

Also, if you can share your install.properties file, that might help
with troubleshooting as well.

cheers!

-nruest

> <mailto:islandora%2Bunsu...@googlegroups.com>.

> For more options, visit https://groups.google.com/groups/opt_out.
>
>
>
> --
> You received this message because you are subscribed to the Google
> Groups "islandora" group.
> To unsubscribe from this group and stop receiving emails from it, send
> an email to islandora+...@googlegroups.com.
> For more options, visit https://groups.google.com/groups/opt_out.
>
>

--
-nruest

[Eddie Bachle]

Hi All,

I'm Megan's friendly neighborhood server admin.  Unfortunately these were what I expected it to be, but that unfortunately didn't seem to be the case.  The SQL query ran on the command line and returned only the expected result, and I made sure to turn of the XACML policies on this installation and checked for that XML element to be sure that it would work.  

Any other obvious things I could be missing?  

Thanks,

Eddie

[Eddie Bachle]

The friendly neighborhood server admin here again, as far as I can tell I don't think either of those should be an issue.  iptables is installed, but this is a very newly made basic Ubuntu 12.04 server on which I haven't done really anything special at this point.  Beyond that, the selinux configuration seems relatively normal and so I'm inclined to think I'm not fighting that either.  Both the Islandora/drupal and Fedora OC installations are going to be running on the same box, so most of the transmissions should just be over localhost and I can't imagine that being blocked by default.  

Also here's the install.properties file, with a couple of abstractions made in terms of hostname, usernames, and passwords.

#Install Options
#Tue Jul 09 15:16:23 EDT 2013
ri.enabled=true
messaging.enabled=true
apia.auth.required=false
database.jdbcDriverClass=com.mysql.jdbc.Driver
upstream.auth.enabled=false
ssl.available=false
database.jdbcURL=jdbc\:mysql\://localhost/fedora3?useUnicode\=true&amp;characterEncoding\=UTF-8&amp;autoReconnect\=true
messaging.uri=vm\:(broker\:(tcp\://localhost\:61616))
database.password=password
database.mysql.driver=included
database.username=user
fesl.authz.enabled=false
tomcat.shutdown.port=8005
deploy.local.services=true
xacml.enabled=false
database.mysql.jdbcDriverClass=com.mysql.jdbc.Driver
tomcat.http.port=8080
fedora.serverHost=devislandora.domain.ours
database=mysql
database.driver=included
fedora.serverContext=fedora
llstore.type=akubra-fs
tomcat.home=/usr/local/fedora/tomcat
fedora.home=/usr/local/fedora
database.mysql.jdbcURL=jdbc\:mysql\://localhost/fedora3?useUnicode\=true&amp;characterEncoding\=UTF-8&amp;autoReconnect\=true
install.type=custom
servlet.engine=included
fedora.admin.pass=password

Thanks for all of your advice!

Eddie

[Nick Ruest]

Do you have anything in here
$FEDORA_HOME/data/fedora-xacml-policies/repository-policies/default?

-nruest

> <mon...@albion.edu <javascript:>

> > send an email to islandora+...@googlegroups.com <javascript:>
> > <mailto:islandora%2Bunsu...@googlegroups.com <javascript:>>.

> > For more options, visit
> https://groups.google.com/groups/opt_out

> <https://groups.google.com/groups/opt_out>.

> >
> >
> >
> > --
> > You received this message because you are subscribed to the Google
> > Groups "islandora" group.
> > To unsubscribe from this group and stop receiving emails from it,
> send

> > an email to islandora+...@googlegroups.com <javascript:>.

> > For more options, visit https://groups.google.com/groups/opt_out

> <https://groups.google.com/groups/opt_out>.
> >
> >
>
> --
> -nruest

[Rick Sarvas]

Eddie,
Can you identify exactly what REST operation is failing in Islandora? This might help you further pinpoint the problem. For this sort of debugging I usually resort to using a packet sniffer to view the data in the server/client transactions.


Rick

[Nigel Banks]

Is this where you have installed Tuque? "/var/www/sites/all/modules/islandora/lib" 

It is typically installed here:

"/var/www/sites/all/libraries/tuque"

Not that it will solve your problem but it could have unforeseen consequences. 

[Eddie Bachle]

I do have files there, but theoretically those were disabled in the fedora.fcfg file I would think?  

Would it be advisable to move those just in case?

[Eddie Bachle]

As far as I can tell all REST operations are failing.  What I seemed to be getting back was a 401 unauthorized error which leads me to think I don't have something set up quite right with authentication.  

When I add the connection information for the Fedora installation I can tell that it sees a running service, but it doesn't have any success authorizing to it.  

One of the errors looks something like this: 

"RepositoryException: Unauthorized in RepositoryConnection->parseFedoraExceptions() (line 227 of /var/www/sites/all/modules/islandora/lib" as well as: 

"Failed to ingest object: islandora:root

code: 410

message: Unauthorized"

Thanks for your help,

Eddie 

[Nigel Banks]

Not super helpful that the HTTP status code (410) doesn't match the message. 

http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.4.11

Perhaps the problem lies with the Drupal filter. Do you have curl installed at the command line? Try interacting with the Fedora REST API directly like so:

curl -u fedoraAdmin:fedoraAdmin -X POST http://localhost:8080/fedora/objects/new\?namespace\=test

This basically says make a POST request as the user "fedoraAdmin" identified by the password "fedoraAdmin". This should create a new object in the repository with the namespace "test". So "test:1" or something like that.

[Aaron Brenner]

Megan / Eddie, 

I'm not sure if you followed my thread where I was facing a similar problem, but you may want to double-check that it's not SELinux blocking Apache's access to Fedora on port 8080, as it was in my case.  Eddie, when you say "the selinux configuration seems relatively normal," from what I can tell, 8080 *is* blocked in a normal SELinux config.  

You can quickly test this by typing 'sestatus' which should output a few lines.  Check the values of 'SELinux status' and 'Current mode'.  If they are 'enabled' and 'enforcing', respectively, try (as root) typing 'setenforce Permissive'.  You can confirm this took effect by typing 'getenforce' which should echo 'Permissive'.  Then try your Islandora operations again and see if that solves the problem. (That enforcement change is only temporary btw, you can later do various things to adjust SELinux in a more persistent way.)