Running the same job twice without a sec delay we get Rundeck returns StatusCode: 403, ReasonPhrase: 'Forbidden' with the message that admin is not authorized for the job

[eran grin]

Hi,

We trying to call rundeck api for the same job with other options and get this error :

Rundeck returns StatusCode: 403, ReasonPhrase: 'Forbidden' with the message that admin is not authorized for the job.

If we wait for a sec all is ok

But we can wait a sec each time

Please advice

We are using the community edition. 

[rac...@rundeck.com]

Hi,

Could you elaborate? Which Rundeck version are you using? Please share the API call to take a look.

By executing the same job like this example (on Rundeck 4.16):

curl -H "Accept: application/json" -X POST --data-urlencode "argString=-opt1 hello" http://localhost:4440/api/45/job/4e117fcf-33a7-4626-91d0-be767af031b7/run?authtoken=KUiUUSZ87KbbHG4AfAFUb6xhGA5MyeKC | jq curl -H "Accept: application/json" -X POST --data-urlencode "argString=-opt1 world" http://localhost:4440/api/45/job/4e117fcf-33a7-4626-91d0-be767af031b7/run?authtoken=KUiUUSZ87KbbHG4AfAFUb6xhGA5MyeKC | jq

You will obtain the following message:

{ "errorCode": "api.error.execution.conflict", "apiversion": 45, "error": true, "message": "Execution had a conflict: Job \"HelloWorld\" {{Job 4e117fcf-33a7-4626-91d0-be767af031b7}}: Limit of running executions has been reached." }

So, the second job needs the first execution to start normally (becuase by default the job doesn’t admit multiple executions).

To avoid this and, if you need multiple executions capability on your job: Edit your job, go to the “other” tab, click “yes” on the “Multiple execitions” section, and save the job.

Regards.

​

[eran grin]

Hi

Yes I know this issue of Multiple execitions 

And we change it to Yes.

In the log of the service we see something like this :

[2023-08-28T08:53:52,407] ERROR interceptors.AuthorizationInterceptor - admin UNAUTHORIZED for execution/apiExecutionOutput

Like I mention before if I wait a sec between each one it's work ok

I'm using rundeck community edition version

4.11.0-20230313 (2023-03-13)

ב-יום שני, 28 באוגוסט 2023 בשעה 16:53:06 UTC+3, rac...@rundeck.com כתב/ה:

[rac...@rundeck.com]

Could you share how are you calling the API to take a look (a minimal reproducible example). I tried to reproduce it on 4.11 unsuccessfully. Thanks!

[eran grin]

Hi

doing simple get and post like:

curl -X POST \

  -H "Content-Type: application/json" \

  -H "X-Rundeck-Auth-Token: qLio5mLk8r4683628223113131133j" \

  -d '{

        "options": {

            "RangeId": "cv8145",

            "Json": "{\"key1\": \"value1\", \"key2\": \"value2\"}",

            "Region": "eu-central-1"

        }

      }' \

  http://localhost:4440/api/44/job/d83a11d2-d305-477f-83aa-14a429c6f6e4/run

curl -s -X GET "http://localhost:4440/api/41/execution/310/output" --header 'Accept: application/json' --header 'X-Rundeck-Auth-Token: qLio5mLk8r4683628223113131133j'

ב-יום שני, 28 באוגוסט 2023 בשעה 20:50:33 UTC+3, rac...@rundeck.com כתב/ה:

[HYUNWOO OH]

hi, is there any update on this issue? I got same problem here. thx

2023년 8월 29일 화요일 오후 3시 48분 1초 UTC+9에 eran grin님이 작성:

[rac...@rundeck.com]

Hi,

Can you post your script to test it? Also, which Rundeck version are you using? Did you test with the last version? Usually, a short time between execution is good to avoid some "burst" call problems.

Regards.

[HYUNWOO OH]

Rundeck Version: 5.0.1

I call the API in the console app using multi threading. I log the every call and error(except error message. error message is as same as in this post:  admin is not authorized for the job)
error is occurred in the line over the message(over this error occurred), and except this line, every call is successful. [33] is thread number


2025-01-22T10:26:50.117 [33] {MyRundecIP}/api/34/job/bbe9eec4-8fdb-4805-960e-b1c2378aa634/run
2025-01-22T10:26:50.128 [41] {MyRundecIP}/api/34/job/307be818-8a20-493b-9dc9-96a252f5f77e/run
2025-01-22T10:26:50.132 [32] {MyRundecIP}/api/34/execution/151782
2025-01-22T10:26:50.155 [33] {MyRundecIP}/api/34/execution/151783
2025-01-22T10:26:50.203 [28] {MyRundecIP}/api/34/job/a94d36f8-2aa0-4d63-93e6-c803c4bb0459/run
2025-01-22T10:26:50.236 [28] {MyRundecIP}/api/34/execution/151784
2025-01-22T10:26:50.276 [33] {MyRundecIP}/api/34/execution/151782
2025-01-22T10:26:50.303 [33] @@@@@@@@@@over this error occurred@@@@@@@@@@@@
2025-01-22T10:26:50.335 [32] {MyRundecIP}/api/34/execution/151783
2025-01-22T10:26:50.441 [29] {MyRundecIP}/api/34/execution/151784
2025-01-22T10:26:50.485 [32] {MyRundecIP}/api/34/execution/151783
2025-01-22T10:26:50.547 [32] {MyRundecIP}/api/34/execution/151784
2025-01-22T10:26:50.651 [33] {MyRundecIP}/api/34/execution/151783
2025-01-22T10:26:50.681 [32] {MyRundecIP}/api/34/execution/151784
2025-01-22T10:26:50.873 [33] {MyRundecIP}/api/34/execution/151784
2025-01-22T10:26:50.875 [33] @@@@@@@@@@over this error occurred@@@@@@@@@@@@


It seems like about rate limit, but is I just call no more than 10 call in a row.....

2025년 1월 22일 수요일 오전 4시 10분 53초 UTC+9에 rac...@rundeck.com님이 작성:

[HYUNWOO OH]

by the way, is there rate limit in rundeck api call? what's the value of rate limit, and why rundeck throw 403 unauthorized when the limit exceed? Do they "block" the user that request more than rate limit?

2025년 1월 22일 수요일 오전 10시 40분 22초 UTC+9에 HYUNWOO OH님이 작성:

[rac...@rundeck.com]

Hi,

I made a test to dispatch a lot of executions on Rundeck 5.0.1 / 5.8.0. I couldn’t see any rate limit or unauthorized message.

for i in $(seq 1 50); do curl --location --request POST 'http://localhost:4440/api/46/job/cf277608-eeda-4a38-ac36-852e1f99e0cf/run' \ --header 'Accept: application/json' \ --header 'X-Rundeck-Auth-Token: nUSDCHHdihsa9KWQAub8h5Y04vRVAEGW' \ --header 'Content-Type: application/json' --data '' | jq done

1. Are you using Rundeck OSS? Runbook Automation (The Commercial version of Rundeck, formerly “Rundeck Enterprise”) has an API rate limit capability.
2. I used a local WAR-based instance. Can you describe how you deployed rundeck? Maybe behind some webserver/lb/gateway?

Regards!

​

[HYUNWOO OH]

Hi, really sorry for very late answer.

I had succeeded to reproduce the issue with test code. I use the C# rundeck Library, and I post the issue with this Library github.
rundeckClient: admin is not authorized for: /api/34/{jobId}/executions · Issue #4 · panoramicdata/Rundeck.Api

what I have done in the code above is:
1) get all the project and job list with "/projects" , "/project/{projectName}/jobs" API
2) make the request to get execution list with "/job/{id}/executions" API, using multi thread

check the issue, then kindly check if this problem is related to rundeck security or authorization policy please. 

Regards!

2025년 1월 22일 수요일 오후 11시 7분 50초 UTC+9에 rac...@rundeck.com님이 작성: